Admin
63018a7c72
Postgres, Zitadel, SeaweedFS, RabbitMQ and Jaeger no longer run as part of this stack. They're shared services (used by Musify, Ping and docker-manager) that now live in a separate Infrastructure repository and must already be running. deploy/compose.yml keeps only what's specific to Musify: its own database connection, its own OIDC app and storage bucket (created against the shared Zitadel/SeaweedFS via zitadel-init/seaweedfs-init), and the application containers. A new wait-for-postgres one-shot replaces the in-file Postgres health check, which no longer works now that Postgres lives in a different compose project. compose.prod.yml joins Infrastructure's infra-net network instead of running its own copies. Docs and READMEs updated to match.
51 lines
1.9 KiB
YAML
51 lines
1.9 KiB
YAML
name: musify-prod
|
|
|
|
# Production overlay: adds the nginx edge and joins Infrastructure's shared
|
|
# `infra-net` network so this project's containers can reach Postgres,
|
|
# Zitadel, SeaweedFS, RabbitMQ and Jaeger by container name. None of them
|
|
# run as part of this compose project anymore (see
|
|
# ../../../Infrastructure/README.md, which must already be up). Nothing but
|
|
# nginx publishes a port; every other service is reachable only on infra-net.
|
|
#
|
|
# docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml up -d
|
|
# docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml --profile apps up -d --build
|
|
|
|
networks:
|
|
default:
|
|
name: infra-net
|
|
external: true
|
|
|
|
services:
|
|
# zitadel-init (compose.yml) edits whichever env file is mounted here.
|
|
zitadel-init:
|
|
volumes:
|
|
- ./.env.prod:/workspace/.env
|
|
|
|
# Every vhost proxies through `set $upstream ...; proxy_pass $upstream;`
|
|
# with the embedded Docker DNS resolver (see nginx/templates), so nginx
|
|
# does not need api/gateway/web-player to exist at its own startup, only
|
|
# at request time. That is what lets it start in the FIRST command
|
|
# (profile-gated services aren't part of that invocation yet) and still be
|
|
# reachable at the auth domain for zitadel-init to provision through.
|
|
nginx:
|
|
image: nginx:1.27-alpine
|
|
container_name: musify-nginx
|
|
environment:
|
|
# The entrypoint renders /etc/nginx/templates/*.template with envsubst.
|
|
# The filter keeps it from eating nginx's own $host / $remote_addr.
|
|
MUSIFY_ROOT_DOMAIN: ${ROOT_DOMAIN}
|
|
MUSIFY_MAX_UPLOAD_SIZE: ${MAX_UPLOAD_SIZE:-1024m}
|
|
NGINX_ENVSUBST_FILTER: ^MUSIFY_
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./nginx/templates:/etc/nginx/templates:ro
|
|
- ./nginx/snippets:/etc/nginx/snippets:ro
|
|
- ./nginx/certs:/etc/nginx/certs:ro
|
|
- nginx_cache:/var/cache/nginx
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
nginx_cache:
|