il
17326b1b15
update note: - step-ca container doesn't support $PWDPATH anymore - add --password-file argument to exec
39 lines
943 B
Django/Jinja
39 lines
943 B
Django/Jinja
[Quadlet]
|
|
DefaultDependencies=false
|
|
|
|
[Unit]
|
|
Description=CA
|
|
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Container]
|
|
Image=docker.io/smallstep/step-ca:{{ version['containers']['step'] }}
|
|
|
|
ContainerName=ca
|
|
HostName=ca
|
|
|
|
PublishPort={{ services['ca']['ports']['https'] }}:9000/tcp
|
|
|
|
Volume=%h/containers/ca/certs:/home/step/certs:ro
|
|
Volume=%h/containers/ca/secrets:/home/step/secrets:ro
|
|
Volume=%h/containers/ca/config:/home/step/config:rw
|
|
Volume=%h/containers/ca/db:/home/step/db:rw
|
|
Volume=%h/containers/ca/templates:/home/step/templates:rw
|
|
|
|
Environment="TZ=Asia/Seoul"
|
|
# Since 0.30.0, Docker CMD no longer expands PWDPATH.
|
|
#Environment="PWDPATH=/run/secrets/STEP_CA_PASSWORD"
|
|
|
|
Secret=STEP_CA_PASSWORD,target=/run/secrets/STEP_CA_PASSWORD
|
|
|
|
Exec=/usr/local/bin/step-ca --password-file /run/secrets/STEP_CA_PASSWORD /home/step/config/ca.json
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=10s
|
|
TimeoutStopSec=120
|
|
|
|
[Install]
|
|
WantedBy=default.target
|