Replace hardcoded 'hq-api' and '' router names with
configurable hq-api and -web. This ensures
unique identifiers per deployment and avoids conflicts with other
services sharing the same Traefik instance.
Services should reference networks by their compose key name ('traefik'),
not by the env var. The actual Docker network name is already configurable
via TRAEFIK_NETWORK in the network definition at the bottom.
- Replace hardcoded 'traefik' network references with configurable
traefik in both api and web services
- Network definition at bottom already supported configuration,
but service references were still hardcoded
- Add docker-compose.yml with postgres, redis, api, and web services
- Add multi-stage Dockerfile for API (Python 3.11)
- Add multi-stage Dockerfile for web (Node.js 20 + nginx)
- Add Makefile with common development commands
- Add .env.example with all required environment variables
- Add placeholder pyproject.toml and package.json for builds
- Configure health checks for all services
- Setup persistent volumes for postgres, redis, and repos
- Run services as non-root users
- Add VITE_OIDC_REDIRECT_URI to .env.example and docker-compose files
- Pass OIDC variables as build args in Dockerfile (build-time only)
- Update both docker-compose.prod.yml and docker-compose.traefik.yml
- Fixes undefined OIDC variables causing 404 on login redirect
The sec-headers@file middleware was referenced but not defined,
causing Traefik to return 404 for all routes.
- Changed sec-headers@file to default-security-headers@file in both
docker-compose.prod.yml and docker-compose.traefik.yml
- This assumes the external Traefik has default-security-headers defined
in its file provider configuration (e.g., in dynamic/middlewares.yml)
If you don't have this middleware defined, either:
1. Define it in your Traefik dynamic configuration, or
2. Remove the middleware label entirely
- docker-compose.traefik.yml now contains api, web, db services only
- Assumes external Traefik proxy is already deployed
- Uses external traefik network for discovery
- docker-compose.prod.yml remains the full stack with embedded Traefik
- Delete docker-compose.traefik.yml (redundant overlay)
- Remove Traefik service from docker-compose.prod.yml
- Add traefik external network and labels to api/web services in prod compose
- Add TRAEFIK_ENTRYPOINT env var to all Traefik router labels
- Remove deploy/ folder (portainer-stack.yml, .env examples, README)
Production compose now assumes external Traefik proxy on Docker network.
All environment variables come from host environment only.
- Remove env_file references from docker-compose.yml and docker-compose.prod.yml
- Add explicit environment variable forwarding for all services
- Use TRAEFIK_NETWORK env var in docker-compose.traefik.yml instead of hardcoded name
- Add VITE_* frontend variables to .env.example and deploy/.env.example
- Add missing production variables (TRAEFIK_ENTRYPOINT, TRAEFIK_CERT_RESOLVER) to deploy/.env.example
This makes environment configuration more explicit and easier to manage
across different deployment scenarios (local dev, CI/CD, Portainer).
Fusion
alex