mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 07:41:23 +00:00
Each invoke runs in an ephemeral locked-down container — no network, read-only rootfs, 128MiB/0.5CPU/64-pid caps, non-root, cap-drop ALL. Source travels as base64 in the container env and materializes in the tmpfs, so no bind mount is needed (Docker Desktop / remote daemons work). Timeout force-removes the named container. exec driver stays the default; the trust-model docs now describe both. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
136 lines
3.9 KiB
YAML
136 lines
3.9 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
ports:
|
|
- "${POSTGRES_PORT:-5432}:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 20
|
|
restart: unless-stopped
|
|
|
|
dragonfly:
|
|
image: docker.dragonflydb.io/dragonflydb/dragonfly:v2.0.0
|
|
command: ["--logtostderr", "--proactor_threads=4"]
|
|
ports:
|
|
- "${DRAGONFLY_PORT:-6379}:6379"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "redis-cli -p 6379 ping | grep -q PONG"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
|
|
backend:
|
|
image: ghcr.io/dvorinka/primora-backend:latest
|
|
build:
|
|
context: .
|
|
dockerfile: apps/backend/Dockerfile
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable
|
|
DRAGONFLY_URL: redis://dragonfly:6379/0
|
|
BACKEND_STORAGE_ROOT: /data/storage
|
|
BACKEND_MIGRATIONS_DIR: /app/db/migrations
|
|
VITE_APP_URL: ${VITE_APP_URL}
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
dragonfly:
|
|
condition: service_started
|
|
volumes:
|
|
- backend_storage:/data/storage
|
|
# Uncomment for FUNCTIONS_DRIVER=docker — sibling containers for
|
|
# sandboxed function runs. Socket access is root-equivalent on the
|
|
# host; leave commented unless you run untrusted function code.
|
|
# - /var/run/docker.sock:/var/run/docker.sock
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -fsS http://localhost:8080/api/v1/health/liveness || exit 1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 20s
|
|
restart: unless-stopped
|
|
|
|
auth:
|
|
image: ghcr.io/dvorinka/primora-auth:latest
|
|
build:
|
|
context: .
|
|
dockerfile: apps/auth/Dockerfile
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable
|
|
DRAGONFLY_URL: redis://dragonfly:6379/0
|
|
BETTER_AUTH_URL: ${BETTER_AUTH_URL:-http://localhost/auth}
|
|
AUTH_BASE_URL: ${AUTH_BASE_URL:-http://localhost/auth}
|
|
VITE_APP_URL: ${VITE_APP_URL:-http://localhost}
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
dragonfly:
|
|
condition: service_started
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://localhost:3001/health >/dev/null 2>&1 || exit 1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 20s
|
|
restart: unless-stopped
|
|
|
|
frontend:
|
|
image: ghcr.io/dvorinka/primora-frontend:latest
|
|
build:
|
|
context: .
|
|
dockerfile: apps/frontend/Dockerfile
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
VITE_APP_URL: http://localhost
|
|
VITE_AUTH_BASE_URL: http://localhost/auth
|
|
VITE_API_BASE_URL: http://localhost/api/v1
|
|
FRONTEND_PORT: 3000
|
|
depends_on:
|
|
backend:
|
|
condition: service_started
|
|
auth:
|
|
condition: service_started
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/ >/dev/null 2>&1 || exit 1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
|
|
nginx:
|
|
image: nginx:1.27-alpine
|
|
depends_on:
|
|
backend:
|
|
condition: service_started
|
|
auth:
|
|
condition: service_started
|
|
frontend:
|
|
condition: service_started
|
|
ports:
|
|
- "${NGINX_PORT}:80"
|
|
volumes:
|
|
- ./infra/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/nginx-health >/dev/null 2>&1 || exit 1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres_data:
|
|
backend_storage:
|