90 lines
3.0 KiB
YAML
90 lines
3.0 KiB
YAML
services:
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile.prod
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
- DATABASE_URL=${DATABASE_URL}
|
|
- ODH_LICENCE_KEY=${ODH_LICENCE_KEY}
|
|
- TZ=Europe/Berlin
|
|
volumes:
|
|
# Working directory inside Dockerfile.prod is /app — must match the
|
|
# frontend's mount of the same host path below, since that's how
|
|
# downloaded media becomes visible to the frontend at all.
|
|
- ./backend/public/storage:/app/public/storage
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
# Distroless has no shell/wget/curl, so the binary checks itself —
|
|
# see the `healthcheck` subcommand in cmd/server/main.go.
|
|
test: ["CMD", "/app/vindn-backend", "healthcheck"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
db:
|
|
image: postgres:14
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-postgres}
|
|
# No insecure default here on purpose — POSTGRES_PASSWORD must be set
|
|
# in this environment's own .env (matching the credentials embedded
|
|
# in DATABASE_URL), so a prod deploy fails loudly instead of quietly
|
|
# running on the well-known "postgres" password.
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env}
|
|
POSTGRES_DB: ${POSTGRES_DB:-postgres}
|
|
# ports:
|
|
# - "5432:5432"
|
|
volumes:
|
|
- ./pgdata:/var/lib/postgresql/data
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
frontend:
|
|
env_file:
|
|
- .env-frontend
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile.prod
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
- DATABASE_URL=${DATABASE_URL}
|
|
- APP_ENV=prod
|
|
- APP_DEBUG=0
|
|
volumes:
|
|
- ./backend/public/storage:/app/public/storage
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8000/"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
networks:
|
|
- traefik
|
|
- default
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik-docker_default"
|
|
- "traefik.http.routers.vindn.rule=Host(`${VIRTUAL_HOST}`) || Host(`www.${VIRTUAL_HOST}`)"
|
|
- "traefik.http.routers.vindn.entrypoints=websecure"
|
|
- "traefik.http.routers.vindn.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.vindn.loadbalancer.server.port=8000"
|
|
- "traefik.http.routers.vindn.tls=true"
|
|
- "traefik.http.routers.vindn.middlewares=www-redirect-reverse_vindn"
|
|
- "traefik.http.middlewares.www-redirect-reverse_vindn.redirectregex.permanent=true"
|
|
- "traefik.http.middlewares.www-redirect-reverse_vindn.redirectregex.regex=^https?://${VIRTUAL_HOST}/(.*)"
|
|
- "traefik.http.middlewares.www-redirect-reverse_vindn.redirectregex.replacement=https://www.${VIRTUAL_HOST}/$${1}"
|
|
|
|
networks:
|
|
traefik:
|
|
external: true
|
|
name: traefik-docker_default
|