91 lines
3.0 KiB
YAML
91 lines
3.0 KiB
YAML
# wiki-tcg — replaces the previous docker-compose.yml, which did not describe
|
|
# the deployment (findings-02 §5.4).
|
|
#
|
|
# Networks:
|
|
# proxy - shared, created outside compose. NPM meets front-facing
|
|
# containers here. Also used by other stacks later.
|
|
# tcg-internal - private. Only the backend and the database. Marked internal,
|
|
# so the database has no route off this network at all.
|
|
#
|
|
# Deploy: docker compose up -d --build
|
|
# Migrate: docker compose run --rm backend alembic upgrade head
|
|
|
|
services:
|
|
db:
|
|
image: postgres:16
|
|
container_name: wikitcg-db
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: wikitcg
|
|
POSTGRES_USER: wikitcg
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
|
|
PGDATA: /var/lib/postgresql/data
|
|
TZ: Europe/Paris
|
|
volumes:
|
|
# EXACT path from the running container. /mnt/cache, NOT /mnt/user —
|
|
# this deliberately bypasses Unraid's FUSE layer. Do not "correct" it.
|
|
- /mnt/cache/appdata/postgresql16:/var/lib/postgresql/data
|
|
networks:
|
|
- tcg-internal
|
|
# No ports. The database is unreachable from the host and the LAN.
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U wikitcg -d wikitcg"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: dockerfile
|
|
image: wikitcg-backend
|
|
container_name: wikitcg-backend
|
|
restart: unless-stopped
|
|
environment:
|
|
# Runtime connection — DML only, cannot alter schema.
|
|
DATABASE_URL: postgresql://wikitcg_app:${APP_DB_PASSWORD:?}@db:5432/wikitcg
|
|
# Migrations only. Owns the schema. Used by `compose run`, never by the
|
|
# running app. See tcg-remediation-todo.md Task 5.
|
|
MIGRATION_DATABASE_URL: postgresql://wikitcg:${POSTGRES_PASSWORD:?}@db:5432/wikitcg
|
|
JWT_SECRET_KEY: ${JWT_SECRET_KEY:?}
|
|
STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:?}
|
|
STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:?}
|
|
STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:?}
|
|
RESEND_API_KEY: ${RESEND_API_KEY:?}
|
|
EMAIL_FROM: noreply@tcg.gade.gg
|
|
FRONTEND_URL: https://tcg.gade.gg
|
|
CORS_ORIGINS: https://tcg.gade.gg
|
|
WIKIRANK_USER_AGENT: WikiTCG/1.0 (nikolaj@gade.gg)
|
|
TZ: Europe/Paris
|
|
networks:
|
|
- tcg-internal # to reach db
|
|
- proxy # to be reached by NPM
|
|
ports:
|
|
# STAGE 1 ONLY. Remove once NPM points at backend:8000 by name.
|
|
- "555:8000"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: dockerfile
|
|
image: wikitcg-frontend
|
|
container_name: wikitcg-frontend
|
|
restart: unless-stopped
|
|
environment:
|
|
TZ: Europe/Paris
|
|
networks:
|
|
- proxy # NPM only. No database access, by construction.
|
|
ports:
|
|
# STAGE 1 ONLY. Remove once NPM points at frontend:80 by name.
|
|
- "444:80"
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
tcg-internal:
|
|
internal: true
|