dfc7cc49b0
Switch prod setup from traefik (external network) to self-contained Caddy container that terminates HTTPS at the IP. Self-signed cert is needed so browsers send Sec-Fetch-Site (only in secure contexts) and Payload admin cookie auth works over http-by-IP won't. - Add caddy:2-alpine service with ports 80/443 and Caddyfile mount - Mount ./certs volume to app (NODE_EXTRA_CA_CERTS) so next/image can optimise absolute https://IP media URLs without cert rejection - Remove traefik-public external network + labels - Update build arg NEXT_PUBLIC_SITE_URL to https://147.135.209.100 - Add postgres-data/backups/certs to .dockerignore Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
99 lines
2.3 KiB
YAML
99 lines
2.3 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
container_name: shumiland-postgres
|
|
environment:
|
|
POSTGRES_USER: shumiland
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: shumiland
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'pg_isready -U shumiland']
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
networks:
|
|
- internal
|
|
|
|
migrate:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.migrator
|
|
container_name: shumiland-migrate
|
|
env_file: .env.production
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ./migrations:/migrations
|
|
networks:
|
|
- internal
|
|
restart: "no"
|
|
|
|
app:
|
|
build:
|
|
context: .
|
|
args:
|
|
NEXT_PUBLIC_SITE_URL: https://147.135.209.100
|
|
container_name: shumiland-app
|
|
env_file: .env.production
|
|
environment:
|
|
NODE_EXTRA_CA_CERTS: /certs/cert.pem
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
migrate:
|
|
condition: service_completed_successfully
|
|
volumes:
|
|
- media_uploads:/app/media
|
|
- ./certs:/certs:ro
|
|
restart: unless-stopped
|
|
networks:
|
|
- internal
|
|
|
|
caddy:
|
|
image: caddy:2-alpine
|
|
container_name: shumiland-caddy
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- ./certs:/certs:ro
|
|
depends_on:
|
|
- app
|
|
restart: unless-stopped
|
|
networks:
|
|
- internal
|
|
|
|
pg_backup:
|
|
image: alpine:3
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data:ro
|
|
- ./backups:/backups
|
|
environment:
|
|
POSTGRES_USER: shumiland
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: shumiland
|
|
POSTGRES_HOST: postgres
|
|
command: >-
|
|
sh -c "apk add --no-cache postgresql-client &&
|
|
echo '0 3 * * * pg_dump postgresql://$$POSTGRES_USER:$$POSTGRES_PASSWORD@$$POSTGRES_HOST/$$POSTGRES_DB | gzip > /backups/shumiland_$$(date +\%Y\%m\%d_\%H\%M\%S).sql.gz && find /backups -mtime +14 -delete' | crontab - &&
|
|
crond -f"
|
|
depends_on:
|
|
- postgres
|
|
restart: unless-stopped
|
|
networks:
|
|
- internal
|
|
|
|
networks:
|
|
internal:
|
|
name: shumiland-internal
|
|
|
|
volumes:
|
|
postgres_data:
|
|
name: shumiland-postgres-data
|
|
media_uploads:
|
|
name: shumiland-media-uploads
|