fix: Add resource constraints

ansible/inventory/full/group_vars/all/secrets.yml

@@ -1,3 +0,0 @@
-secrets:
-  admin_username: admin
-  admin_password: "r5qNySaG8VdNqhrAk5pIdbCr3+JeV1WqdvF4TPnUd3c="

docker/stacks/authentik/docker-stack.yml

@@ -40,6 +40,18 @@ services:
       - authentik
     volumes:
       - redis_data:/data
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints: [node.role != manager]
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 128M
+        reservations:
+          cpus: '0.1'
+          memory: 32M
 
   server:
     image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.3}
@@ -70,6 +82,15 @@ services:
         - "traefik.swarm.network=traefik"
       mode: replicated
       replicas: 1
+      placement:
+        constraints: [node.role != manager]
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 1G
+        reservations:
+          cpus: '0.1'
+          memory: 64M
 
   worker:
     image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.3}
@@ -98,3 +119,15 @@ services:
       - authentik_templates:/templates
     depends_on:
       - redis
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints: [node.role != manager]
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 512M
+        reservations:
+          cpus: '0.1'
+          memory: 64M

docker/stacks/db-ui/docker-stack.yml

@@ -1,3 +1,4 @@
+---
 version: '3.1'
 
 networks:
@@ -21,6 +22,15 @@ services:
         - "traefik.swarm.network=traefik"
       mode: replicated
       replicas: 1
+      placement:
+        constraints: [node.role != manager]
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 128M
+        reservations:
+          cpus: '0.1'
+          memory: 32M
 
   pgadmin:
     image: dpage/pgadmin4
@@ -39,3 +49,12 @@ services:
         - "traefik.swarm.network=traefik"
       mode: replicated
       replicas: 1
+      placement:
+        constraints: [node.role != manager]
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 128M
+        reservations:
+          cpus: '0.1'
+          memory: 32M

docker/stacks/dockge/docker-stack.yml

@@ -1,3 +1,4 @@
+---
 version: "3.8"
 
 networks:
@@ -43,3 +44,10 @@ services:
       replicas: 1
       placement:
         constraints: [node.role == manager]
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 128M
+        reservations:
+          cpus: '0.1'
+          memory: 32M

docker/stacks/infisical/docker-stack.yml

@@ -1,3 +1,4 @@
+---
 version: "3"
 
 services:
@@ -18,6 +19,13 @@ services:
     command: npm run migration:latest
     networks:
       - infisical
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints: [node.role != manager]
+      restart_policy:
+        condition: none
 
   backend:
     container_name: infisical-backend
@@ -50,6 +58,17 @@ services:
         - "traefik.http.routers.infisical.tls.certresolver=letsencrypt"
         - "traefik.http.services.infisical.loadbalancer.server.port=8080"
         - "traefik.swarm.network=traefik"
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints: [node.role != manager]
+      resources:
+        limits:
+          cpus: '0.50'
+          memory: 1G
+        reservations:
+          cpus: '0.25'
+          memory: 128M
 
   redis:
     image: redis
@@ -61,6 +80,18 @@ services:
       - infisical
     volumes:
       - redis_data:/data
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints: [node.role != manager]
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 128M
+        reservations:
+          cpus: '0.1'
+          memory: 32M
 
 networks:
   infisical: