mirror of
https://github.com/siop-spelev/siop2.git
synced 2026-08-08 12:41:54 +00:00
ce24d9c32b
- image api : multi-stage (pnpm deploy --legacy --prod), client Prisma régénéré dans l'arborescence déployée, binaryTargets explicites (debian/arm64 openssl-3), entrypoint migrate deploy → seed optionnel (SEED_ON_START, compilé dist/seed) → API ; non-root, healthcheck /health - image web : nginx alpine, statique Vite, proxy /api résolu À LA REQUÊTE (resolver Docker + variable — nginx démarre sans l'API), fallback SPA, cache immuable /assets, healthcheck IPv4 (127.0.0.1) - infra/docker-compose.dokploy.yml : 5 services préfixés siop2-, secrets exigés, seul siop2-web rejoint dokploy-network (API jamais exposée) - runbook docs/06-production/runbook-dokploy.md : topologie, profils d'environnement, checklist première prod, rollback, répétition locale - répétition locale validée de bout en bout : migrate+seed au boot, parcours demo-login → /users/me à travers nginx conteneurisé, conteneurs healthy ; le double verrou ADR-002 (DEMO_MODE sans I_KNOW en production) a refusé de démarrer — observé en situation réelle - prisma passe en dépendance de production (migrations au boot) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
111 lines
3.4 KiB
YAML
111 lines
3.4 KiB
YAML
# SIOP V2 — compose de PRODUCTION (Dokploy). Voir docs/06-production/runbook-dokploy.md.
|
|
# CONVENTION (leçon v1) : tout service/conteneur est préfixé « siop2- » — le
|
|
# réseau Dokploy est partagé entre projets, un nom générique collisionne.
|
|
# Les secrets (${...}) vivent dans l'environnement du projet Dokploy, jamais ici.
|
|
name: siop2
|
|
|
|
services:
|
|
siop2-postgres:
|
|
container_name: siop2-postgres
|
|
build: ./postgres
|
|
image: siop2/postgres:18-pgvector-postgis
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-siop}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?définir POSTGRES_PASSWORD dans Dokploy}
|
|
POSTGRES_DB: ${POSTGRES_DB:-siop}
|
|
volumes:
|
|
- pg-data:/var/lib/postgresql
|
|
- ./postgres/init.sql:/docker-entrypoint-initdb.d/10-extensions.sql:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-siop} -d ${POSTGRES_DB:-siop}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
siop2-redis:
|
|
container_name: siop2-redis
|
|
image: redis:7.4.9-alpine
|
|
restart: unless-stopped
|
|
volumes:
|
|
- redis-data:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
siop2-minio:
|
|
container_name: siop2-minio
|
|
image: minio/minio:RELEASE.2025-09-07T16-13-09Z
|
|
restart: unless-stopped
|
|
command: server /data --console-address ":9001"
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER:-siop}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?définir MINIO_ROOT_PASSWORD dans Dokploy}
|
|
volumes:
|
|
- minio-data:/data
|
|
healthcheck:
|
|
test: ["CMD", "mc", "ready", "local"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
siop2-api:
|
|
container_name: siop2-api
|
|
build:
|
|
context: ..
|
|
dockerfile: apps/api/Dockerfile
|
|
image: siop2/api:latest
|
|
restart: unless-stopped
|
|
environment:
|
|
NODE_ENV: production
|
|
PORT: 3000
|
|
DATABASE_URL: postgresql://${POSTGRES_USER:-siop}:${POSTGRES_PASSWORD}@siop2-postgres:5432/${POSTGRES_DB:-siop}
|
|
REDIS_URL: redis://siop2-redis:6379
|
|
JWT_SECRET: ${JWT_SECRET:?définir JWT_SECRET dans Dokploy}
|
|
MINIO_ENDPOINT: siop2-minio
|
|
MINIO_PORT: 9000
|
|
MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-siop}
|
|
MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
|
|
# ADR-002 — production client : les 3 variables restent ABSENTES.
|
|
# Instance de démonstration publique UNIQUEMENT :
|
|
# DEMO_MODE=true + DEMO_MODE_I_KNOW=true (double verrou) + SEED_ON_START=true
|
|
DEMO_MODE: ${DEMO_MODE:-}
|
|
DEMO_MODE_I_KNOW: ${DEMO_MODE_I_KNOW:-}
|
|
SEED_ON_START: ${SEED_ON_START:-}
|
|
SEED_DEMO_PASSWORD: ${SEED_DEMO_PASSWORD:-}
|
|
depends_on:
|
|
siop2-postgres:
|
|
condition: service_healthy
|
|
siop2-redis:
|
|
condition: service_healthy
|
|
siop2-minio:
|
|
condition: service_healthy
|
|
|
|
siop2-web:
|
|
container_name: siop2-web
|
|
build:
|
|
context: ..
|
|
dockerfile: apps/web/Dockerfile
|
|
image: siop2/web:latest
|
|
restart: unless-stopped
|
|
environment:
|
|
API_UPSTREAM: siop2-api:3000
|
|
depends_on:
|
|
- siop2-api
|
|
networks:
|
|
- default
|
|
- dokploy-network
|
|
|
|
volumes:
|
|
pg-data:
|
|
redis-data:
|
|
minio-data:
|
|
|
|
networks:
|
|
# Réseau du reverse-proxy Dokploy (Traefik) : seul siop2-web y est exposé,
|
|
# le domaine pointe sur lui (port 80) ; l'API reste interne (proxy /api).
|
|
dokploy-network:
|
|
external: true
|