From cbca7f986602f2858023daaac05b8febe85b93fb Mon Sep 17 00:00:00 2001
From: Mike McFetridge <91107715+mmcfetridge1969@users.noreply.github.com>
Date: Sun, 26 Jul 2026 09:35:02 -0400
Subject: [PATCH] added safeline

---
 .gitea/workflows/deploy-safeline.yml |  35 +++++++
 safeline/.env                        |   9 ++
 safeline/docker-compose.yml          | 144 +++++++++++++++++++++++++++
 3 files changed, 188 insertions(+)
 create mode 100644 .gitea/workflows/deploy-safeline.yml
 create mode 100644 safeline/.env
 create mode 100644 safeline/docker-compose.yml

diff --git a/.gitea/workflows/deploy-safeline.yml b/.gitea/workflows/deploy-safeline.yml
new file mode 100644
index 0000000..390a64a
--- /dev/null
+++ b/.gitea/workflows/deploy-safeline.yml
@@ -0,0 +1,35 @@
+name: Deploy Safeline
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'Safeline/**'
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Sync Safeline to Host
+        uses: appleboy/scp-action@master
+        with:
+          host: "192.168.2.13"
+          username: "miker"
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          source: "Safeline/*"
+          target: "/opt/Docker-Deployments/Safeline"
+          strip_components: 1
+
+      - name: Deploy Safeline Stack
+        uses: appleboy/ssh-action@master
+        with:
+          host: "192.168.2.13"
+          username: "miker"
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          script: |
+            cd /opt/Docker-Deployments/Safeline
+            docker compose up -d --remove-orphans
\ No newline at end of file
diff --git a/safeline/.env b/safeline/.env
new file mode 100644
index 0000000..5190310
--- /dev/null
+++ b/safeline/.env
@@ -0,0 +1,9 @@
+SAFELINE_DIR=/opt/Docker-Deployments/Safeline
+IMAGE_TAG=latest
+MGT_PORT=5443
+POSTGRES_PASSWORD=xop9BVh4CusNNwwrBurj
+SUBNET_PREFIX=172.22.222
+IMAGE_PREFIX=chaitin
+ARCH_SUFFIX=
+RELEASE=
+REGION=-g
diff --git a/safeline/docker-compose.yml b/safeline/docker-compose.yml
new file mode 100644
index 0000000..f902df8
--- /dev/null
+++ b/safeline/docker-compose.yml
@@ -0,0 +1,144 @@
+networks:
+  safeline-ce:
+    name: safeline-ce
+    driver: bridge
+    ipam:
+      driver: default
+      config:
+        - gateway: ${SUBNET_PREFIX:?SUBNET_PREFIX required}.1
+          subnet: ${SUBNET_PREFIX}.0/24
+    driver_opts:
+      com.docker.network.bridge.name: safeline-ce
+
+services:
+  postgres:
+    container_name: safeline-pg
+    restart: always
+    image: ${POSTGRES_IMAGE:-${IMAGE_PREFIX}/safeline-postgres${ARCH_SUFFIX}:15.18}
+    volumes:
+      - ${SAFELINE_DIR}/resources/postgres/data:/var/lib/postgresql/data
+      - /etc/localtime:/etc/localtime:ro
+    environment:
+      - POSTGRES_USER=safeline-ce
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?postgres password required}
+    networks:
+      safeline-ce:
+        ipv4_address: ${SUBNET_PREFIX}.2
+    command: [postgres, -c, max_connections=600]
+    healthcheck:
+      test: pg_isready -U safeline-ce -d safeline-ce
+  mgt:
+    container_name: safeline-mgt
+    restart: always
+    image: ${IMAGE_PREFIX}/safeline-mgt${REGION}${ARCH_SUFFIX}:${IMAGE_TAG:?image tag required}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ${SAFELINE_DIR}/resources/mgt:/app/data
+      - ${SAFELINE_DIR}/logs/nginx:/app/log/nginx:z
+      - ${SAFELINE_DIR}/resources/sock:/app/sock
+      - /var/run:/app/run
+    ports:
+      - ${MGT_PORT:-9443}:1443
+    healthcheck:
+      test: curl -k -f https://localhost:1443/api/open/health
+    environment:
+      - MGT_PG=postgres://safeline-ce:${POSTGRES_PASSWORD}@safeline-pg/safeline-ce?sslmode=disable
+      - MGT_PROXY=${MGT_PROXY}
+    depends_on:
+      - postgres
+      - fvm
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
+    networks:
+      safeline-ce:
+        ipv4_address: ${SUBNET_PREFIX}.4
+  detect:
+    container_name: safeline-detector
+    restart: always
+    image: ${IMAGE_PREFIX}/safeline-detector${REGION}${ARCH_SUFFIX}:${IMAGE_TAG}
+    volumes:
+      - ${SAFELINE_DIR}/resources/detector:/resources/detector
+      - ${SAFELINE_DIR}/logs/detector:/logs/detector
+      - /etc/localtime:/etc/localtime:ro
+    environment:
+      - LOG_DIR=/logs/detector
+    networks:
+      safeline-ce:
+        ipv4_address: ${SUBNET_PREFIX}.5
+  tengine:
+    container_name: safeline-tengine
+    restart: always
+    image: ${IMAGE_PREFIX}/safeline-tengine${REGION}${ARCH_SUFFIX}:${IMAGE_TAG}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /etc/resolv.conf:/etc/resolv.conf:ro
+      - ${SAFELINE_DIR}/resources/nginx:/etc/nginx
+      - ${SAFELINE_DIR}/resources/detector:/resources/detector
+      - ${SAFELINE_DIR}/resources/chaos:/resources/chaos
+      - ${SAFELINE_DIR}/logs/nginx:/var/log/nginx:z
+      - ${SAFELINE_DIR}/resources/cache:/usr/local/nginx/cache
+      - ${SAFELINE_DIR}/resources/sock:/app/sock
+    environment:
+      - TCD_MGT_API=https://${SUBNET_PREFIX}.4:1443/api/open/publish/server
+      - TCD_SNSERVER=${SUBNET_PREFIX}.5:8000
+      # deprecated
+      - SNSERVER_ADDR=${SUBNET_PREFIX}.5:8000
+      - CHAOS_ADDR=${SUBNET_PREFIX}.10
+    ulimits:
+      nofile: 131072
+    network_mode: host
+  luigi:
+    container_name: safeline-luigi
+    restart: always
+    image: ${IMAGE_PREFIX}/safeline-luigi${REGION}${ARCH_SUFFIX}:${IMAGE_TAG}
+    environment:
+      - MGT_IP=${SUBNET_PREFIX}.4
+      - LUIGI_PG=postgres://safeline-ce:${POSTGRES_PASSWORD}@safeline-pg/safeline-ce?sslmode=disable
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ${SAFELINE_DIR}/resources/luigi:/app/data
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
+    depends_on:
+      - detect
+      - mgt
+    networks:
+      safeline-ce:
+        ipv4_address: ${SUBNET_PREFIX}.7
+  fvm:
+    container_name: safeline-fvm
+    restart: always
+    image: ${IMAGE_PREFIX}/safeline-fvm${REGION}${ARCH_SUFFIX}:${IMAGE_TAG}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
+    networks:
+      safeline-ce:
+        ipv4_address: ${SUBNET_PREFIX}.8
+  chaos:
+    container_name: safeline-chaos
+    restart: always
+    image: ${IMAGE_PREFIX}/safeline-chaos${REGION}${ARCH_SUFFIX}:${IMAGE_TAG}
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "10"
+    environment:
+      - DB_ADDR=postgres://safeline-ce:${POSTGRES_PASSWORD}@safeline-pg/safeline-ce?sslmode=disable
+    volumes:
+      - ${SAFELINE_DIR}/resources/sock:/app/sock
+      - ${SAFELINE_DIR}/resources/chaos:/app/chaos
+    networks:
+      safeline-ce:
+        ipv4_address: ${SUBNET_PREFIX}.10