4f034bd86b
- backend/alembic/* — alembic infra (env.py, script.py.mako). versions/ empty for now; first migration goes in Stage 2a when models are finalized. - backend/Dockerfile: bake alembic.ini + alembic/ into the image so `docker compose exec backend alembic upgrade head` works in prod. - backend/db/init/99_drop_unused_extensions.sql + bind-mount in both compose files: drops postgis-image's TIGER/topology/fuzzystrmatch on fresh volumes. - .pre-commit-config.yaml + pre-commit in dev deps: ruff/prettier on commit to stop CI failures like UP035 from leaking out. - ops/backup.sh, ops/restore.sh: pg_dump cron script with optional Selectel S3 upload. 7-day local retention. Restore guard: requires RESTORE_CONFIRM=yes. - Makefile: new targets `make migration NAME=...`, `make pre-commit-install`. - backend/.env.example: SENTRY_DSN comment with sentry.io reference.
92 lines
2.5 KiB
YAML
92 lines
2.5 KiB
YAML
# Production compose. Pulls pre-built images from GHCR
|
|
# (built and pushed by .github/workflows/deploy.yml).
|
|
#
|
|
# Place at /opt/gendesign/docker-compose.prod.yml on the VM.
|
|
# Required env in /opt/gendesign/.env:
|
|
# POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORD
|
|
# IMAGE_TAG (defaults to "latest")
|
|
#
|
|
# In production the browser talks to Caddy on :80/:443.
|
|
# Caddy proxies /api/* and /health straight to backend, the rest to frontend.
|
|
# So the frontend uses same-origin relative URLs — no NEXT_PUBLIC_API_BASE_URL needed.
|
|
#
|
|
# Postgres + Redis run alongside the app on the same VM (Discovery mode).
|
|
# Volumes are shared with docker-compose.yml so switching between files preserves data.
|
|
|
|
services:
|
|
postgres:
|
|
image: postgis/postgis:16-3.4
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
# Bind to 127.0.0.1 only — accessible from host (for SSH tunnel) but not from public internet.
|
|
# UFW additionally blocks 5432 from outside.
|
|
ports:
|
|
- "127.0.0.1:5432:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
- ./backend/db/init:/docker-entrypoint-initdb.d:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
volumes:
|
|
- redis_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 5
|
|
|
|
backend:
|
|
image: ghcr.io/lekss361/gendesign-backend:${IMAGE_TAG:-latest}
|
|
restart: unless-stopped
|
|
env_file: ./backend/.env
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_started
|
|
ports:
|
|
- "127.0.0.1:8000:8000"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "http://localhost:8000/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
frontend:
|
|
image: ghcr.io/lekss361/gendesign-frontend:${IMAGE_TAG:-latest}
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:3000:3000"
|
|
depends_on:
|
|
- backend
|
|
|
|
caddy:
|
|
image: caddy:2
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy_data:/data
|
|
- caddy_config:/config
|
|
depends_on:
|
|
- backend
|
|
- frontend
|
|
|
|
volumes:
|
|
postgres_data:
|
|
redis_data:
|
|
caddy_data:
|
|
caddy_config:
|