alex
139654d5c0
- Create docker-compose.prod.yml with Traefik, API, web, and DB services - Add Portainer stack deployment files - Configure Let's Encrypt TLS and health checks - Add deployment environment variable examples - Update portainer.env.example with additional config vars
119 lines
3.6 KiB
YAML
119 lines
3.6 KiB
YAML
version: "3.8"
|
|
|
|
services:
|
|
traefik:
|
|
image: traefik:v3.1
|
|
command:
|
|
- --api.dashboard=true
|
|
- --providers.docker=true
|
|
- --providers.docker.exposedbydefault=false
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.websecure.address=:443
|
|
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
|
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
|
- --certificatesresolvers.letsencrypt.acme.tlschallenge=true
|
|
- --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}
|
|
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
|
|
- --log.level=INFO
|
|
- --accesslog=true
|
|
- --accesslog.format=json
|
|
- --metrics.prometheus=true
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- traefik-certs:/letsencrypt
|
|
networks:
|
|
- platform
|
|
- tools
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN}`)
|
|
- traefik.http.routers.traefik-dashboard.entrypoints=websecure
|
|
- traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt
|
|
- traefik.http.routers.traefik-dashboard.service=api@internal
|
|
- traefik.http.routers.traefik-dashboard.middlewares=auth@file
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "traefik", "healthcheck"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
api:
|
|
image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/api:${API_TAG:-latest}
|
|
env_file:
|
|
- stack.env
|
|
environment:
|
|
- DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
|
|
- ROOT_DOMAIN=${ROOT_DOMAIN}
|
|
- CORS_ORIGINS=https://${ROOT_DOMAIN},https://*.${ROOT_DOMAIN}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- platform
|
|
volumes:
|
|
- api-data:/data
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN}`)
|
|
- traefik.http.routers.api.entrypoints=websecure
|
|
- traefik.http.routers.api.tls.certresolver=letsencrypt
|
|
- traefik.http.services.api.loadbalancer.server.port=8000
|
|
- traefik.http.routers.api.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 5s
|
|
|
|
web:
|
|
image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/web:${WEB_TAG:-latest}
|
|
env_file:
|
|
- stack.env
|
|
depends_on:
|
|
- api
|
|
networks:
|
|
- platform
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN}`)
|
|
- traefik.http.routers.web.entrypoints=websecure
|
|
- traefik.http.routers.web.tls.certresolver=letsencrypt
|
|
- traefik.http.services.web.loadbalancer.server.port=8080
|
|
- traefik.http.routers.web.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: postgres:17-alpine
|
|
environment:
|
|
- POSTGRES_USER=${POSTGRES_USER}
|
|
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
|
- POSTGRES_DB=${POSTGRES_DB}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
networks:
|
|
- platform
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres-data:
|
|
api-data:
|
|
traefik-certs:
|
|
|
|
networks:
|
|
platform:
|
|
driver: bridge
|
|
tools:
|
|
driver: bridge
|
|
external: false
|