updated files for a prod env

docker-compose.yaml

@@ -1,42 +1,70 @@
 services:
   backend:
-    image: golang:1.24
-    working_dir: /backend
-
+    build:
+      context: ./backend
+      dockerfile: Dockerfile.prod
     depends_on:
-      - db
+      db:
+        condition: service_healthy
     environment:
       - DATABASE_URL=${DATABASE_URL}
       - ODH_LICENCE_KEY=${ODH_LICENCE_KEY}
       - TZ=Europe/Berlin
     volumes:
-      - ./backend:/backend
-    command: go run cmd/server/main.go
+      # Working directory inside Dockerfile.prod is /app — must match the
+      # frontend's mount of the same host path below, since that's how
+      # downloaded media becomes visible to the frontend at all.
+      - ./backend/public/storage:/app/public/storage
     restart: unless-stopped
+    healthcheck:
+      # Distroless has no shell/wget/curl, so the binary checks itself —
+      # see the `healthcheck` subcommand in cmd/server/main.go.
+      test: ["CMD", "/app/vindn-backend", "healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
   db:
     image: postgres:14
     environment:
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
-      POSTGRES_DB: postgres
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      # No insecure default here on purpose — POSTGRES_PASSWORD must be set
+      # in this environment's own .env (matching the credentials embedded
+      # in DATABASE_URL), so a prod deploy fails loudly instead of quietly
+      # running on the well-known "postgres" password.
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env}
+      POSTGRES_DB: ${POSTGRES_DB:-postgres}
 #    ports:
 #      - "5432:5432"
     volumes:
       - ./pgdata:/var/lib/postgresql/data
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   frontend:
-    build: ./frontend
-    working_dir: /app
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile.prod
     depends_on:
-      - db
+      db:
+        condition: service_healthy
     environment:
       - DATABASE_URL=${DATABASE_URL}
+      - APP_ENV=prod
+      - APP_DEBUG=0
     volumes:
-      - ./frontend:/app
       - ./backend/public/storage:/app/public/storage
-    command: sh -c "composer install --no-interaction && php -S 0.0.0.0:8000 -t public"
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
     networks:
       - traefik
       - default
@@ -50,7 +78,7 @@ services:
     - "traefik.http.routers.vindn.tls=true"
     - "traefik.http.routers.vindn.middlewares=www-redirect-reverse_vindn"
     - "traefik.http.middlewares.www-redirect-reverse_vindn.redirectregex.permanent=true"
-    - "traefik.http.middlewares.www-redirect-reverse_vindn.redirectregex.regex=^http[|s]://${VIRTUAL_HOST}/(.*)"
+    - "traefik.http.middlewares.www-redirect-reverse_vindn.redirectregex.regex=^https?://${VIRTUAL_HOST}/(.*)"
     - "traefik.http.middlewares.www-redirect-reverse_vindn.redirectregex.replacement=https://www.${VIRTUAL_HOST}/$${1}"
 
 networks: