LiberoStack/docker-compose.prod.yml at main · Iloopp/LiberoStack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    env_file:
      # Keep database credentials outside the Compose file. install.sh creates
      # .env from .env.example and replaces the default password automatically.
      - .env
    volumes:
      # Persistent database storage. Without this named volume, all membership,
      # webhook, and subscription data would disappear when the container is
      # removed or recreated.
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      # pg_isready gates the web service so migrations/app startup do not race
      # against PostgreSQL initialization on small VPS instances.
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    networks:
      - internal

  web:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    env_file:
      # Runtime secrets are injected as environment variables. They are never
      # baked into the Docker image.
      - .env
    environment:
      # Force production mode inside the container regardless of local .env.
      ENV: production
      # Docker service DNS name. The host-facing localhost value in .env.example
      # is correct for local scripts, but containers must connect to postgres.
      POSTGRES_SERVER: postgres:5432
      # Public URL used by OAuth callback generation and customer-facing links.
      APP_BASE_URL: https://${APP_DOMAIN}
    depends_on:
      postgres:
        condition: service_healthy
    expose:
      # Expose only to the private Docker network. The app is not bound directly
      # to the VPS public interface; Caddy is the only public entrypoint.
      - "8000"
    networks:
      - internal

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    environment:
      # Caddyfile uses {$APP_DOMAIN}. The :? guard fails fast if install.sh has
      # not written a domain into .env.
      APP_DOMAIN: ${APP_DOMAIN:?APP_DOMAIN must be set in .env}
    ports:
      # Public HTTP/HTTPS entrypoints. Caddy automatically obtains and renews
      # certificates through ACME when the domain resolves to this VPS.
      - "80:80"
      - "443:443"
    volumes:
      # Read-only reverse proxy configuration.
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      # ACME certificates and account keys. Persisting /data prevents rate-limit
      # pain and certificate loss when the caddy container is recreated.
      - caddy_data:/data
      # Caddy runtime/admin config storage. Persisting /config keeps Caddy state
      # stable across image upgrades and restarts.
      - caddy_config:/config
    depends_on:
      - web
    networks:
      - internal

volumes:
  postgres_data:
  caddy_data:
  caddy_config:

networks:
  internal:
    driver: bridge