alex
f92f9c33e6
- docker-compose.traefik.yml now contains api, web, db services only - Assumes external Traefik proxy is already deployed - Uses external traefik network for discovery - docker-compose.prod.yml remains the full stack with embedded Traefik
90 lines
3.0 KiB
YAML
90 lines
3.0 KiB
YAML
services:
|
|
api:
|
|
build:
|
|
context: ./apps/api
|
|
dockerfile: Dockerfile
|
|
environment:
|
|
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
|
|
- ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
|
|
- TOOL_DOMAIN=${TOOL_DOMAIN:-tools.localhost}
|
|
- API_URL=${API_URL:-http://localhost:8000}
|
|
- WEB_URL=${WEB_URL:-http://localhost:5173}
|
|
- CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
|
|
- AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
|
|
- AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
|
|
- AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
|
|
- SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-change-me-in-production}
|
|
- ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES:-60}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- platform
|
|
- traefik
|
|
volumes:
|
|
- api-data:/data
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.headquarter-api.rule=Host(`api.${ROOT_DOMAIN:-localhost}`)
|
|
- traefik.http.routers.headquarter-api.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
|
|
- traefik.http.routers.headquarter-api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
|
|
- traefik.http.services.headquarter-api.loadbalancer.server.port=8000
|
|
- traefik.http.routers.headquarter-api.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 5s
|
|
|
|
web:
|
|
build:
|
|
context: ./apps/web
|
|
dockerfile: Dockerfile
|
|
environment:
|
|
- VITE_API_URL=${VITE_API_URL:-http://localhost:8000}
|
|
- VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER}
|
|
- VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID}
|
|
depends_on:
|
|
- api
|
|
networks:
|
|
- platform
|
|
- traefik
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.headquarter-web.rule=Host(`${ROOT_DOMAIN:-localhost}`)
|
|
- traefik.http.routers.headquarter-web.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
|
|
- traefik.http.routers.headquarter-web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
|
|
- traefik.http.services.headquarter-web.loadbalancer.server.port=8080
|
|
- traefik.http.routers.headquarter-web.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: postgres:17-alpine
|
|
environment:
|
|
- POSTGRES_USER=${POSTGRES_USER:-postgres}
|
|
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
|
|
- POSTGRES_DB=${POSTGRES_DB:-headquarter}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
networks:
|
|
- platform
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-headquarter}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres-data:
|
|
api-data:
|
|
|
|
networks:
|
|
platform:
|
|
driver: bridge
|
|
traefik:
|
|
name: ${TRAEFIK_NETWORK:-traefik}
|
|
external: true
|