Admin
a779a8bf73
The dev and prod stacks each declared the same nine services, which is how the S3 credentials and the gateway configuration ended up diverging. compose.yml now holds every service with no published port and no domain in it, and the overlays only add what is specific: host ports and pgAdmin for development, the nginx edge and the mounted secrets for production. The applications sit behind the `apps` profile, so a plain `up` still starts infrastructure only. Everything environment-specific moves to the env files: the public URLs, the credentials and the environment name. The SeaweedFS identity file is rendered inside the container from S3_ACCESS_KEY and S3_SECRET_KEY, so the store and the applications can no longer be given different keys.
41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
name: musify-prod
|
|
|
|
# Production overlay: adds the nginx edge and the host-mounted secrets.
|
|
# Nothing but nginx publishes a port; every other service is reachable only on
|
|
# the internal `musify-prod_default` network.
|
|
#
|
|
# docker compose --env-file deploy/.env.prod \
|
|
# -f deploy/compose.yml -f deploy/compose.prod.yml --profile apps up -d --build
|
|
#
|
|
# Use ./up.sh, which also generates the stream keys, provisions Zitadel and
|
|
# applies the database migrations.
|
|
|
|
services:
|
|
worker:
|
|
# yt-dlp reads the YouTube cookie jar from here (see YTDLP_ADDITIONAL_ARGUMENTS).
|
|
volumes:
|
|
- ./secrets:/secrets:ro
|
|
|
|
nginx:
|
|
image: nginx:1.27-alpine
|
|
container_name: musify-nginx
|
|
depends_on:
|
|
- api
|
|
- gateway
|
|
- zitadel
|
|
- web-player
|
|
environment:
|
|
# The entrypoint renders /etc/nginx/templates/*.template with envsubst.
|
|
# The filter keeps it from eating nginx's own $host / $remote_addr.
|
|
MUSIFY_ROOT_DOMAIN: ${ROOT_DOMAIN}
|
|
MUSIFY_MAX_UPLOAD_SIZE: ${MAX_UPLOAD_SIZE:-1024m}
|
|
NGINX_ENVSUBST_FILTER: ^MUSIFY_
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./nginx/templates:/etc/nginx/templates:ro
|
|
- ./nginx/snippets:/etc/nginx/snippets:ro
|
|
- ./nginx/certs:/etc/nginx/certs:ro
|
|
restart: unless-stopped
|