Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 11:05:39 +02:00
commit c8e6f30a27
720 changed files with 140143 additions and 0 deletions
@@ -0,0 +1,127 @@
+# Lokales Dev-Compose. Härtung ggü. Backlog-Findings:
+#   - F-11: alle Images auf konkrete Tags gepinnt (kein :latest / rollender Tag)
+#   - F-18: Host-Ports NUR auf 127.0.0.1 gebunden (nicht auf allen Interfaces des
+#           Entwicklerrechners); Redis mit Passwort (requirepass);
+#           security_opt no-new-privileges auf allen Services.
+# Für Prod/Testserver gilt docker-compose.coolify.yml (Netzsegmentierung, Limits etc.).
+services:
+  app:
+    build: .
+    ports:
+      - "127.0.0.1:3000:3000"
+    env_file: .env
+    security_opt:
+      - "no-new-privileges:true"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+      garage:
+        condition: service_healthy
+      garage-provision:
+        condition: service_completed_successfully
+    restart: unless-stopped
+
+  # Wird in Iteration 4 aktiviert (BullMQ-Scheduler, siehe docs/SPEC.md §4.5)
+  worker:
+    profiles: ["worker"]
+    build: .
+    command: ["npm", "run", "worker"]
+    env_file: .env
+    security_opt:
+      - "no-new-privileges:true"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    restart: unless-stopped
+
+  postgres:
+    image: pgvector/pgvector:0.8.0-pg16
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-isms}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-isms}
+      POSTGRES_DB: ${POSTGRES_DB:-isms}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    ports:
+      - "127.0.0.1:5432:5432"
+    security_opt:
+      - "no-new-privileges:true"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-isms}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  redis:
+    image: redis:7.4.2-alpine
+    # F-18: Redis mit Passwort. REDIS_URL in .env muss das Passwort tragen, z. B.
+    # redis://:${REDIS_PASSWORD}@localhost:6379
+    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:-isms-redis}"]
+    volumes:
+      - redisdata:/data
+    ports:
+      - "127.0.0.1:6379:6379"
+    security_opt:
+      - "no-new-privileges:true"
+
+  # Objektspeicher: Garage (S3-kompatibel) — ersetzt MinIO (EOL). S3-API auf 3900,
+  # Admin-API auf 3903 (nur lokal gebunden). Dev-Secrets kommen aus .env (siehe
+  # .env.example: GARAGE_RPC_SECRET/GARAGE_ADMIN_TOKEN, S3_ACCESS_KEY/S3_SECRET_KEY).
+  garage:
+    image: dxflrs/garage:v1.2.0
+    environment:
+      GARAGE_RPC_SECRET: ${GARAGE_RPC_SECRET:-0000000000000000000000000000000000000000000000000000000000000002}
+      GARAGE_ADMIN_TOKEN: ${GARAGE_ADMIN_TOKEN:-0000000000000000000000000000000000000000000000000000000000000003}
+    volumes:
+      - ./deploy/garage.toml:/etc/garage.toml:ro
+      - garage_meta:/var/lib/garage/meta
+      - garage_data:/var/lib/garage/data
+    ports:
+      - "127.0.0.1:3900:3900"
+      - "127.0.0.1:3903:3903"
+    security_opt:
+      - "no-new-privileges:true"
+    healthcheck:
+      test: ["CMD", "/garage", "status"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 5s
+
+  # Idempotenter Provisioning-Job (Layout + Bucket + Key + Rechte via Admin-API).
+  # Nutzt das App-Image (tsx vorhanden); läuft einmalig vor der app.
+  garage-provision:
+    build: .
+    command: ["npx", "tsx", "scripts/garage-provision.ts"]
+    environment:
+      GARAGE_ADMIN_URL: http://garage:3903
+      GARAGE_ADMIN_TOKEN: ${GARAGE_ADMIN_TOKEN:-0000000000000000000000000000000000000000000000000000000000000003}
+      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-GKdead0000beef0000cafe0000}
+      S3_SECRET_KEY: ${S3_SECRET_KEY:-0000000000000000000000000000000000000000000000000000000000000001}
+      S3_BUCKET: ${S3_BUCKET:-isms-documents}
+      GARAGE_CAPACITY_BYTES: ${GARAGE_CAPACITY_BYTES:-10000000000}
+    security_opt:
+      - "no-new-privileges:true"
+    depends_on:
+      garage:
+        condition: service_healthy
+    restart: "no"
+
+  mailhog:
+    image: mailhog/mailhog:v1.0.1
+    profiles: ["dev"]
+    ports:
+      - "127.0.0.1:1025:1025"
+      - "127.0.0.1:8025:8025"
+    security_opt:
+      - "no-new-privileges:true"
+
+volumes:
+  pgdata:
+  redisdata:
+  garage_meta:
+  garage_data: