alex
139654d5c0
- Create docker-compose.prod.yml with Traefik, API, web, and DB services - Add Portainer stack deployment files - Configure Let's Encrypt TLS and health checks - Add deployment environment variable examples - Update portainer.env.example with additional config vars
118 lines
3.5 KiB
YAML
118 lines
3.5 KiB
YAML
services:
|
|
traefik:
|
|
image: traefik:v3.1
|
|
command:
|
|
- --api.dashboard=true
|
|
- --providers.docker=true
|
|
- --providers.docker.exposedbydefault=false
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.websecure.address=:443
|
|
- --certificatesresolvers.letsencrypt.acme.tlschallenge=true
|
|
- --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-admin@example.com}
|
|
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
|
|
- --log.level=${TRAEFIK_LOG_LEVEL:-INFO}
|
|
- --accesslog=true
|
|
- --accesslog.format=json
|
|
- --metrics.prometheus=true
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- traefik-certs:/letsencrypt
|
|
networks:
|
|
- platform
|
|
- tools
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN:-localhost}`)
|
|
- traefik.http.routers.traefik-dashboard.entrypoints=websecure
|
|
- traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt
|
|
- traefik.http.routers.traefik-dashboard.service=api@internal
|
|
- traefik.http.routers.traefik-dashboard.middlewares=auth@file
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "traefik", "healthcheck"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
api:
|
|
build:
|
|
context: ./apps/api
|
|
dockerfile: Dockerfile
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
|
|
- ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- platform
|
|
volumes:
|
|
- api-data:/data
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN:-localhost}`)
|
|
- traefik.http.routers.api.entrypoints=websecure
|
|
- traefik.http.routers.api.tls.certresolver=letsencrypt
|
|
- traefik.http.services.api.loadbalancer.server.port=8000
|
|
- traefik.http.routers.api.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 5s
|
|
|
|
web:
|
|
build:
|
|
context: ./apps/web
|
|
dockerfile: Dockerfile
|
|
env_file:
|
|
- apps/web/.env
|
|
depends_on:
|
|
- api
|
|
networks:
|
|
- platform
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN:-localhost}`)
|
|
- traefik.http.routers.web.entrypoints=websecure
|
|
- traefik.http.routers.web.tls.certresolver=letsencrypt
|
|
- traefik.http.services.web.loadbalancer.server.port=8080
|
|
- traefik.http.routers.web.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: postgres:17-alpine
|
|
environment:
|
|
- POSTGRES_USER=${POSTGRES_USER:-postgres}
|
|
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
|
|
- POSTGRES_DB=${POSTGRES_DB:-headquarter}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
networks:
|
|
- platform
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-headquarter}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres-data:
|
|
api-data:
|
|
traefik-certs:
|
|
|
|
networks:
|
|
platform:
|
|
driver: bridge
|
|
tools:
|
|
driver: bridge
|
|
external: false
|