docker-compose.secrets.yml•1.79 kB
version: '3.8'
# This file demonstrates proper secret management for production deployments
# Use with: docker-compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.secrets.yml up
services:
mcp-server:
depends_on:
redis:
condition: service_healthy
environment:
- REDIS_HOST=redis
- REDIS_PORT=6379
# Reference the secret file location inside the container
- REDIS_PASSWORD_FILE=/run/secrets/redis_password
# Grant the service access to the secret
secrets:
- redis_password
networks:
- mcp-network
redis:
image: redis:7-alpine
hostname: redis
restart: always
# Configure Redis to read password from the secret file
command: >
sh -c 'REDIS_PASS=$$(cat /run/secrets/redis_password 2>/dev/null || echo "");
if [ -n "$$REDIS_PASS" ]; then
exec redis-server --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASS"
else
exec redis-server --appendonly yes --appendfsync everysec
fi'
volumes:
- redis-data:/data
networks:
- mcp-network
secrets:
- redis_password
healthcheck:
test: >
sh -c 'REDIS_PASS=$$(cat /run/secrets/redis_password 2>/dev/null || echo "");
if [ -n "$$REDIS_PASS" ]; then
redis-cli -a "$$REDIS_PASS" ping
else
redis-cli ping
fi'
interval: 10s
timeout: 5s
retries: 5
# Define the secrets
secrets:
redis_password:
# For production, use external: true and manage secrets via Docker Swarm or Kubernetes
# For local testing, create a file: echo "your-secure-password" > redis_password.txt
file: ./redis_password.txt
networks:
mcp-network:
driver: bridge
volumes:
redis-data: