V2.1 (#21)

Working version Reviewed-on: WikiDeck/wikideck#21
2026-11-01 22:07:51 +00:00
parent 1edf2e6200
commit 636f5b9c77
80 changed files with 4065 additions and 549 deletions
@@ -0,0 +1,39 @@
+# Gated candidate profile, NOT an announcement of a production-ready or launched network.
+# Review docs/mainnet-launch.md before attempting activation.
+services:
+  mainnet:
+    build:
+      context: .
+      target: runtime
+      args:
+        WIKIDECK_NETWORK: mainnet
+        WIKIDECK_GENESIS_TIME: "${WIKIDECK_GENESIS_TIME:-1793491200}"
+    ports:
+      - "127.0.0.1:${WIKIDECK_MAINNET_PORT:-3201}:3001"
+    environment:
+      WIKIDECK_NETWORK: mainnet
+      WIKIDECK_GENESIS_TIME: "${WIKIDECK_GENESIS_TIME:-1793491200}"
+      PUBLIC_ORIGIN: "${WIKIDECK_MAINNET_ORIGIN:-}"
+      WIKIDECK_PEERS: "${WIKIDECK_MAINNET_PEERS:-}"
+      WIKIDECK_MAINNET_LAUNCH: "${WIKIDECK_MAINNET_LAUNCH:-}"
+      WIKIDECK_MAINNET_RISK_ACK: "${WIKIDECK_MAINNET_RISK_ACK:-}"
+      WIKIDECK_ALLOW_PRIVATE_PEERS: "0"
+      # Empty by default; set only the actual edge-to-container source IP/CIDR after topology review.
+      WIKIDECK_TRUSTED_PROXIES: "${WIKIDECK_TRUSTED_PROXIES:-}"
+      # Diagnostics are deliberately disabled here. Never publish an operations port.
+    volumes:
+      - mainnet-candidate-data:/app/data
+    init: true
+    restart: "no"
+    read_only: true
+    tmpfs:
+      - /tmp:size=32m,mode=1777,noexec,nosuid
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    pids_limit: 128
+    mem_limit: 1g
+    cpus: 1.0
+    stop_grace_period: 30s
+
+volumes:
+  mainnet-candidate-data: