msolarczekandClaude Opus 5
c8e6f30a27
Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
128 lines
4.0 KiB
YAML
128 lines
4.0 KiB
YAML
# Lokales Dev-Compose. Härtung ggü. Backlog-Findings:
|
|
# - F-11: alle Images auf konkrete Tags gepinnt (kein :latest / rollender Tag)
|
|
# - F-18: Host-Ports NUR auf 127.0.0.1 gebunden (nicht auf allen Interfaces des
|
|
# Entwicklerrechners); Redis mit Passwort (requirepass);
|
|
# security_opt no-new-privileges auf allen Services.
|
|
# Für Prod/Testserver gilt docker-compose.coolify.yml (Netzsegmentierung, Limits etc.).
|
|
services:
|
|
app:
|
|
build: .
|
|
ports:
|
|
- "127.0.0.1:3000:3000"
|
|
env_file: .env
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_started
|
|
garage:
|
|
condition: service_healthy
|
|
garage-provision:
|
|
condition: service_completed_successfully
|
|
restart: unless-stopped
|
|
|
|
# Wird in Iteration 4 aktiviert (BullMQ-Scheduler, siehe docs/SPEC.md §4.5)
|
|
worker:
|
|
profiles: ["worker"]
|
|
build: .
|
|
command: ["npm", "run", "worker"]
|
|
env_file: .env
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_started
|
|
restart: unless-stopped
|
|
|
|
postgres:
|
|
image: pgvector/pgvector:0.8.0-pg16
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-isms}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-isms}
|
|
POSTGRES_DB: ${POSTGRES_DB:-isms}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
ports:
|
|
- "127.0.0.1:5432:5432"
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-isms}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
redis:
|
|
image: redis:7.4.2-alpine
|
|
# F-18: Redis mit Passwort. REDIS_URL in .env muss das Passwort tragen, z. B.
|
|
# redis://:${REDIS_PASSWORD}@localhost:6379
|
|
command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:-isms-redis}"]
|
|
volumes:
|
|
- redisdata:/data
|
|
ports:
|
|
- "127.0.0.1:6379:6379"
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
|
|
# Objektspeicher: Garage (S3-kompatibel) — ersetzt MinIO (EOL). S3-API auf 3900,
|
|
# Admin-API auf 3903 (nur lokal gebunden). Dev-Secrets kommen aus .env (siehe
|
|
# .env.example: GARAGE_RPC_SECRET/GARAGE_ADMIN_TOKEN, S3_ACCESS_KEY/S3_SECRET_KEY).
|
|
garage:
|
|
image: dxflrs/garage:v1.2.0
|
|
environment:
|
|
GARAGE_RPC_SECRET: ${GARAGE_RPC_SECRET:-0000000000000000000000000000000000000000000000000000000000000002}
|
|
GARAGE_ADMIN_TOKEN: ${GARAGE_ADMIN_TOKEN:-0000000000000000000000000000000000000000000000000000000000000003}
|
|
volumes:
|
|
- ./deploy/garage.toml:/etc/garage.toml:ro
|
|
- garage_meta:/var/lib/garage/meta
|
|
- garage_data:/var/lib/garage/data
|
|
ports:
|
|
- "127.0.0.1:3900:3900"
|
|
- "127.0.0.1:3903:3903"
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
healthcheck:
|
|
test: ["CMD", "/garage", "status"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 12
|
|
start_period: 5s
|
|
|
|
# Idempotenter Provisioning-Job (Layout + Bucket + Key + Rechte via Admin-API).
|
|
# Nutzt das App-Image (tsx vorhanden); läuft einmalig vor der app.
|
|
garage-provision:
|
|
build: .
|
|
command: ["npx", "tsx", "scripts/garage-provision.ts"]
|
|
environment:
|
|
GARAGE_ADMIN_URL: http://garage:3903
|
|
GARAGE_ADMIN_TOKEN: ${GARAGE_ADMIN_TOKEN:-0000000000000000000000000000000000000000000000000000000000000003}
|
|
S3_ACCESS_KEY: ${S3_ACCESS_KEY:-GKdead0000beef0000cafe0000}
|
|
S3_SECRET_KEY: ${S3_SECRET_KEY:-0000000000000000000000000000000000000000000000000000000000000001}
|
|
S3_BUCKET: ${S3_BUCKET:-isms-documents}
|
|
GARAGE_CAPACITY_BYTES: ${GARAGE_CAPACITY_BYTES:-10000000000}
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
depends_on:
|
|
garage:
|
|
condition: service_healthy
|
|
restart: "no"
|
|
|
|
mailhog:
|
|
image: mailhog/mailhog:v1.0.1
|
|
profiles: ["dev"]
|
|
ports:
|
|
- "127.0.0.1:1025:1025"
|
|
- "127.0.0.1:8025:8025"
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
|
|
volumes:
|
|
pgdata:
|
|
redisdata:
|
|
garage_meta:
|
|
garage_data:
|