Manage the portable stack with Rust and rootless Podman

1 files changed, 47 insertions, 0 deletions

diff --git a/infra/services.toml b/infra/services.toml
new file mode 100644
index 0000000..97091cf
--- /dev/null
+++ b/infra/services.toml
@@ -0,0 +1,47 @@
+# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+format = 1
+
+[services.caddy]
+image = "docker.io/library/caddy:2-alpine@sha256:5f5c8640aae01df9654968d946d8f1a56c497f1dd5c5cda4cf95ab7c14d58648"
+gateway = true
+health = ["caddy", "validate", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+mounts = [
+    { source = "@caddy", target = "/etc/caddy/Caddyfile", read_only = true },
+    { source = "var/data/caddy/data", target = "/data" },
+    { source = "var/data/caddy/config", target = "/config" },
+    { source = "@web", target = "/srv", read_only = true },
+]
+
+[services.cgit]
+image = "localhost/stack-cgit:0.1.0"
+build = "infra/containers/cgit"
+health = ["curl", "--fail", "--silent", "--max-time", "3", "http://127.0.0.1:8080/"]
+mounts = [
+    { source = "var/data/repos", target = "/srv/git", read_only = true },
+    { source = "@cgit", target = "/etc/cgitrc", read_only = true },
+]
+tmpfs = ["/run", "/var/cache/cgit"]
+
+[services.searxng]
+image = "docker.io/searxng/searxng:latest@sha256:1dab138ea70a8ceb4d1c182f5c8f256088406c1742b99e279976157dbe1e9759"
+environment = ["SEARXNG_SECRET"]
+drop_capabilities = true
+health = ["wget", "--quiet", "--spider", "http://127.0.0.1:8080/"]
+mounts = [
+    { source = "var/data/searxng", target = "/etc/searxng" },
+]
+tmpfs = ["/var/cache/searxng:mode=1777"]