82 lines
3.3 KiB
YAML
82 lines
3.3 KiB
YAML
# For development the database alone is enough: ./scripts/db.sh up
|
|
# Full / production run: docker compose up -d --build
|
|
#
|
|
# SESSION_SECRET must be set in the environment or in a .env file next to this
|
|
# one. It is not marked required here because compose resolves every variable in
|
|
# the file whatever service you name, and that would break `./scripts/db.sh up`.
|
|
# The server refuses to start without it and says so.
|
|
services:
|
|
db:
|
|
image: postgres:17-alpine
|
|
container_name: szabadpalya-db
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-szabadpalya}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-szabadpalya}
|
|
POSTGRES_DB: ${POSTGRES_DB:-szabadpalya}
|
|
# Loopback only. Docker publishes ports by writing DNAT rules that bypass
|
|
# UFW entirely, so a bare "5433:5432" would put Postgres on the public
|
|
# internet no matter what the host firewall says. Development still reaches
|
|
# it on localhost:5433, which is all scripts/db.sh ever wanted.
|
|
ports:
|
|
- "127.0.0.1:5433:5432"
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-szabadpalya} -d ${POSTGRES_DB:-szabadpalya}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
# Runs once, migrates, exits. The app starts only after it succeeds.
|
|
#
|
|
# Same image as app, same binary, one flag different — so the two can never
|
|
# disagree about what "migrated" means. That used to be a separate Dockerfile
|
|
# stage; a command override says it with less machinery and one less image to
|
|
# ship.
|
|
migrate:
|
|
image: szabadpalya:latest
|
|
command: ["server", "-migrate"]
|
|
build:
|
|
context: .
|
|
target: runner
|
|
environment:
|
|
DATABASE_URL: postgresql://${POSTGRES_USER:-szabadpalya}:${POSTGRES_PASSWORD:-szabadpalya}@db:5432/${POSTGRES_DB:-szabadpalya}
|
|
SESSION_SECRET: ${SESSION_SECRET:-}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
restart: "no"
|
|
|
|
# `image:` is what lets scripts/deploy.sh build on a laptop and ship the
|
|
# result: compose uses an image of this name when one is already present and
|
|
# only falls back to `build:` when it is not, or when asked with --build.
|
|
app:
|
|
image: szabadpalya:latest
|
|
build:
|
|
context: .
|
|
target: runner
|
|
environment:
|
|
DATABASE_URL: postgresql://${POSTGRES_USER:-szabadpalya}:${POSTGRES_PASSWORD:-szabadpalya}@db:5432/${POSTGRES_DB:-szabadpalya}
|
|
SESSION_SECRET: ${SESSION_SECRET:-}
|
|
BASE_URL: ${BASE_URL:-http://localhost:3000}
|
|
ADMIN_EMAILS: ${ADMIN_EMAILS:-}
|
|
# Loopback only: nginx terminates TLS and proxies to 127.0.0.1:3000.
|
|
# Published on every interface this would also answer on http://<ip>:3000,
|
|
# which is the same site without TLS — and BASE_URL being https there means
|
|
# the session cookie is Secure, so logging in that way silently fails.
|
|
ports:
|
|
- "127.0.0.1:3000:3000"
|
|
depends_on:
|
|
migrate:
|
|
condition: service_completed_successfully
|
|
restart: unless-stopped
|
|
|
|
# Declared, and named explicitly. Without the name compose would derive one from
|
|
# the project directory (szabadpalya_pgdata) while scripts/db.sh's no-compose
|
|
# path uses szabadpalya-pgdata — two databases, one of them silently empty,
|
|
# depending on whether the compose plugin happens to be installed.
|
|
volumes:
|
|
pgdata:
|
|
name: szabadpalya_pgdata
|