113 lines
3.0 KiB
YAML
113 lines
3.0 KiB
YAML
# Clusev — PROD stack. Plain Docker Compose, no Portainer.
|
|
#
|
|
# Caddy is the ONLY host-exposed service (auto-TLS when APP_DOMAIN is set; plain
|
|
# HTTP on the bare IP otherwise). app/reverb are internal-only on the clusev net.
|
|
#
|
|
# Bootstrap + operate with ./install.sh. Manual deploy:
|
|
# docker compose -f docker-compose.prod.yml build
|
|
# docker compose -f docker-compose.prod.yml up -d
|
|
# docker compose -f docker-compose.prod.yml exec -u app app php artisan migrate --force
|
|
name: clusev
|
|
|
|
# Locally-built tag by default; override CLUSEV_IMAGE with a GHCR digest
|
|
# (ghcr.io/<owner>/clusev@sha256:...) once CI signs + publishes images.
|
|
x-image: &image
|
|
image: "${CLUSEV_IMAGE:-clusev-app:prod}"
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
networks:
|
|
- clusev
|
|
|
|
services:
|
|
app:
|
|
<<: *image
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
target: prod
|
|
expose:
|
|
- "80"
|
|
depends_on:
|
|
mariadb:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_started
|
|
|
|
reverb:
|
|
<<: *image
|
|
command: php artisan reverb:start --host=0.0.0.0 --port=8080
|
|
expose:
|
|
- "8080"
|
|
depends_on:
|
|
redis:
|
|
condition: service_started
|
|
|
|
queue:
|
|
<<: *image
|
|
command: php artisan queue:work --tries=3 --timeout=90 --sleep=1
|
|
depends_on:
|
|
mariadb:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_started
|
|
|
|
caddy:
|
|
image: caddy:2-alpine # pin by @sha256 digest before the first prod push
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${APP_PORT:-80}:80"
|
|
- "443:443"
|
|
- "443:443/udp" # HTTP/3
|
|
environment:
|
|
SITE_ADDRESS: "${SITE_ADDRESS:-:80}"
|
|
# never empty: bare-IP mode has no cert, so this address is unused
|
|
ACME_EMAIL: "${ACME_EMAIL:-admin@localhost}"
|
|
volumes:
|
|
- ./docker/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy-data:/data # ACME account + certs — MUST persist across recreate
|
|
- caddy-config:/config
|
|
depends_on:
|
|
- app
|
|
- reverb
|
|
networks:
|
|
- clusev
|
|
|
|
mariadb:
|
|
image: mariadb:11
|
|
restart: unless-stopped
|
|
environment:
|
|
MARIADB_DATABASE: "${DB_DATABASE:-clusev}"
|
|
MARIADB_USER: "${DB_USERNAME:-clusev}"
|
|
MARIADB_PASSWORD: "${DB_PASSWORD:?set DB_PASSWORD in .env}"
|
|
MARIADB_ROOT_PASSWORD: "${DB_ROOT_PASSWORD:?set DB_ROOT_PASSWORD in .env}"
|
|
volumes:
|
|
- mariadb-data:/var/lib/mysql
|
|
healthcheck:
|
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 30
|
|
networks:
|
|
- clusev
|
|
# no host ports in prod — DB is reachable only on the internal clusev network
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
command: redis-server --appendonly yes --requirepass "${REDIS_PASSWORD:?set REDIS_PASSWORD in .env}"
|
|
volumes:
|
|
- redis-data:/data
|
|
networks:
|
|
- clusev
|
|
|
|
volumes:
|
|
mariadb-data:
|
|
redis-data:
|
|
caddy-data:
|
|
caddy-config:
|
|
|
|
networks:
|
|
clusev:
|
|
driver: bridge
|