e22aeb9b5a
- backend/Dockerfile: split builder/runner, runtime libs only, non-root app user, curl for healthcheck, --frozen via new uv.lock - frontend/Dockerfile: npm ci instead of npm install (deterministic), USER node - docker-compose.prod.yml: working backend healthcheck (curl now in image), redis healthcheck, drop dead NEXT_PUBLIC_API_BASE_URL env (Next.js bakes NEXT_PUBLIC_* at build time, runtime override is no-op) - docker-compose.yml: same redis healthcheck, BACKEND_URL for next.config rewrites, drop uv from CMD (not in new image) - Caddyfile: handle (not handle_path) so /api prefix is preserved into FastAPI router - next.config.ts: rewrite /api/* and /health to BACKEND_URL in dev (no Caddy locally) - frontend/src/lib/api.ts: empty default = same-origin relative URLs - Makefile: drop uv run from migrate target - Add backend/uv.lock and frontend/package-lock.json for reproducible builds Verified: docker build succeeds for both, backend container starts, /health responds, curl healthcheck works inside image, container runs as non-root. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
91 lines
2.4 KiB
YAML
91 lines
2.4 KiB
YAML
# Production compose. Pulls pre-built images from GHCR
|
|
# (built and pushed by .github/workflows/deploy.yml).
|
|
#
|
|
# Place at /opt/gendesign/docker-compose.prod.yml on the VM.
|
|
# Required env in /opt/gendesign/.env:
|
|
# POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORD
|
|
# IMAGE_TAG (defaults to "latest")
|
|
#
|
|
# In production the browser talks to Caddy on :80/:443.
|
|
# Caddy proxies /api/* and /health straight to backend, the rest to frontend.
|
|
# So the frontend uses same-origin relative URLs — no NEXT_PUBLIC_API_BASE_URL needed.
|
|
#
|
|
# Postgres + Redis run alongside the app on the same VM (Discovery mode).
|
|
# Volumes are shared with docker-compose.yml so switching between files preserves data.
|
|
|
|
services:
|
|
postgres:
|
|
image: postgis/postgis:16-3.4
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
# Bind to 127.0.0.1 only — accessible from host (for SSH tunnel) but not from public internet.
|
|
# UFW additionally blocks 5432 from outside.
|
|
ports:
|
|
- "127.0.0.1:5432:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
volumes:
|
|
- redis_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 5
|
|
|
|
backend:
|
|
image: ghcr.io/lekss361/gendesign-backend:${IMAGE_TAG:-latest}
|
|
restart: unless-stopped
|
|
env_file: ./backend/.env
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_started
|
|
ports:
|
|
- "127.0.0.1:8000:8000"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "http://localhost:8000/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
frontend:
|
|
image: ghcr.io/lekss361/gendesign-frontend:${IMAGE_TAG:-latest}
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:3000:3000"
|
|
depends_on:
|
|
- backend
|
|
|
|
caddy:
|
|
image: caddy:2
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy_data:/data
|
|
- caddy_config:/config
|
|
depends_on:
|
|
- backend
|
|
- frontend
|
|
|
|
volumes:
|
|
postgres_data:
|
|
redis_data:
|
|
caddy_data:
|
|
caddy_config:
|