compose.yaml

services:
  uwsgi:
    build: .
    image: ghcr.io/tomgobravo/tourist-production:latest
    command: uwsgi --strict --need-app --ini /app/uwsgi.ini
    volumes:
      - /var/local/www-data:/data
      - ./tourist/secrets.cfg:/app/tourist/secrets.cfg
      # Run as the host www-data by replacing the container passwd and group files.
      # Within the container the uid on files will now map to names from the host (if any)
      # but that's okay because the container filesystem can be treated as readonly; uwsgi
      # only needs to write to /data, which is mounted from the host filesystem.
      # https://pawitp.medium.com/syncing-host-and-container-users-in-docker-39337eff0094
      # The service prefectagentproduction does the same.
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
    user: "www-data:www-data"
    # This container doesn't really need anything else running to start so a
    # systemd configuration like
    # https://www.jetbrains.com/help/youtrack/server/run-docker-container-as-service.html
    # isn't needed.
    restart: unless-stopped
  prefectagentproduction:
    build: .
    image: ghcr.io/tomgobravo/tourist-production:latest
    command: prefect agent start -q production
    environment:
      PREFECT_HOME: "/prefect_home"
    volumes:
      - /var/local/www-data/tourist-prefect-agent/.prefect:/prefect_home
      - /var/local/www-data:/data
      # See comment about users in service uwsgi.
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
    user: "www-data:www-data"
    restart: unless-stopped