alex
ae4fe95c40
- Delete docker-compose.traefik.yml (redundant overlay) - Remove Traefik service from docker-compose.prod.yml - Add traefik external network and labels to api/web services in prod compose - Add TRAEFIK_ENTRYPOINT env var to all Traefik router labels - Remove deploy/ folder (portainer-stack.yml, .env examples, README) Production compose now assumes external Traefik proxy on Docker network. All environment variables come from host environment only.
90 lines
2.9 KiB
YAML
90 lines
2.9 KiB
YAML
services:
|
|
api:
|
|
build:
|
|
context: ./apps/api
|
|
dockerfile: Dockerfile
|
|
environment:
|
|
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
|
|
- ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
|
|
- TOOL_DOMAIN=${TOOL_DOMAIN:-tools.localhost}
|
|
- API_URL=${API_URL:-http://localhost:8000}
|
|
- WEB_URL=${WEB_URL:-http://localhost:5173}
|
|
- CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
|
|
- AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
|
|
- AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
|
|
- AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
|
|
- SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-change-me-in-production}
|
|
- ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES:-60}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- platform
|
|
- traefik
|
|
volumes:
|
|
- api-data:/data
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN:-localhost}`)
|
|
- traefik.http.routers.api.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
|
|
- traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
|
|
- traefik.http.services.api.loadbalancer.server.port=8000
|
|
- traefik.http.routers.api.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 5s
|
|
|
|
web:
|
|
build:
|
|
context: ./apps/web
|
|
dockerfile: Dockerfile
|
|
environment:
|
|
- VITE_API_URL=${VITE_API_URL:-http://localhost:8000}
|
|
- VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER}
|
|
- VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID}
|
|
depends_on:
|
|
- api
|
|
networks:
|
|
- platform
|
|
- traefik
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN:-localhost}`)
|
|
- traefik.http.routers.web.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
|
|
- traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
|
|
- traefik.http.services.web.loadbalancer.server.port=8080
|
|
- traefik.http.routers.web.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: postgres:17-alpine
|
|
environment:
|
|
- POSTGRES_USER=${POSTGRES_USER:-postgres}
|
|
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
|
|
- POSTGRES_DB=${POSTGRES_DB:-headquarter}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
networks:
|
|
- platform
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-headquarter}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres-data:
|
|
api-data:
|
|
|
|
networks:
|
|
platform:
|
|
driver: bridge
|
|
traefik:
|
|
name: ${TRAEFIK_NETWORK:-traefik}
|
|
external: true
|