FullStack_CMS/docker-compose.yml at main · glp-92/FullStack_CMS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
# utilities:
# docker stop $(docker ps -a -q)
# docker rm $(docker ps -a -q)
# debug: docker compose run --entrypoint /bin/bash service-name
# docker run -it --entrypoint /bin/bash -v /home/user/test:/test imagename

services:
  nginx:
    image: nginx:1.29.3-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./frontend/reverse-proxy/nginx.conf:/etc/nginx/nginx.conf
      - ./frontend/reverse-proxy/certs:/etc/nginx/certs
    depends_on:
      frontend:
        condition: service_started
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
        reservations:
          cpus: "0.5"
          memory: 256M
    networks:
      - public-subnet
      - private-subnet

  frontend:
    build:
      context: ./frontend/clientapp/
      args:
        VITE_BACKEND_URL: ${BACKEND_URL}
        VITE_BLOG_NAME: ${BLOG_NAME}
        VITE_GITHUB_LINK: ${GITHUB_LINK}
    restart: unless-stopped
    depends_on:
      backend:
        condition: service_started
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 256M
    networks:
      - private-subnet

  backend:
    build: ./backend/api/
    read_only: true
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
      storage:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:${API_PORT}/health"]
      interval: 5s
      timeout: 3s
      retries: 5
    environment:
      DB_USER: ${DB_USER}
      DB_PASSWORD: ${DB_PASSWORD}
      DB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      DB_BLOG_DB_NAME: ${DB_BLOG_DB_NAME}
      DB_BLOG_SERVICE_USER: ${DB_BLOG_SERVICE_USER}
      DB_BLOG_SERVICE_PASSWORD: ${DB_BLOG_SERVICE_PASSWORD}
      DB_BLOG_ADDR: ${DB_BLOG_ADDR}
      API_PORT: ${API_PORT}
      JWT_ACCESS_TOKEN_EXPIRATION: ${JWT_ACCESS_TOKEN_EXPIRATION}
      JWT_REFRESH_TOKEN_EXPIRATION: ${JWT_REFRESH_TOKEN_EXPIRATION}
      JWT_SIGN_KEY: ${JWT_SIGN_KEY}
      FRONTEND_URL: ${FRONTEND_URL}
      BLOG_USERNAME: ${BLOG_USERNAME}
      BLOG_PASSWORD: ${BLOG_PASSWORD}
    user: 1000:1000
    security_opt:
      - no-new-privileges:true
    networks:
      - private-subnet
      - data-subnet

  database:
    image: mariadb:12.0.2
    restart: unless-stopped
    ports:
      - "127.0.0.1:5306:3306"
    environment:
      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
    volumes:
      - ./backend/mariadb/db:/var/lib/mysql
      - ./backend/mariadb/.initdb:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      start_period: 10s
      interval: 10s
      timeout: 5s
      retries: 10
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: "1"
          memory: 2048M
        reservations:
          cpus: "1"
          memory: 2048M
    networks:
      - data-subnet

  storage:
    image: rustfs/rustfs:latest
    restart: unless-stopped
    security_opt:
      - "no-new-privileges:true"
    ports:
      - "127.0.0.1:9000:9000"
      - "127.0.0.1:9001:9001"
    volumes:
      - ./rustfs_data:/data
    environment:
      RUSTFS_ADDRESS: 0.0.0.0:9000
      RUSTFS_CONSOLE_ADDRESS: 0.0.0.0:9001
      RUSTFS_CONSOLE_ENABLE: true
      RUSTFS_CORS_ALLOWED_ORIGINS: http://localhost:443
      RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS: "*"
      RUSTFS_ACCESS_KEY: "${STORAGE_ACCESS_KEY}"
      RUSTFS_SECRET_KEY: "${STORAGE_SECRET_KEY}"
      RUSTFS_OBS_LOGGER_LEVEL: info
      RUSTFS_TLS_PATH: /opt/tls
      RUSTFS_OBS_ENDPOINT: http://otel-collector:4317
    healthcheck:
      test:
        [
          "CMD",
          "sh",
          "-c",
          "curl -f http://127.0.0.1:9000/health && curl -f http://127.0.0.1:9001/rustfs/console/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - private-subnet

  createbuckets:
    image: minio/mc
    depends_on:
      storage:
        condition: service_healthy
    networks:
      - private-subnet
    entrypoint: >
      /bin/sh -c " /usr/bin/mc alias set blog http://storage:9000 ${STORAGE_ACCESS_KEY} ${STORAGE_SECRET_KEY}; /usr/bin/mc mb blog/${STORAGE_BUCKET_NAME}; /usr/bin/mc anonymous set public blog/${STORAGE_BUCKET_NAME}; exit 0; "

networks:
  public-subnet:
    driver: bridge
  private-subnet:
    driver: bridge
  data-subnet:
    driver: bridge