JobHound/docker-compose.prod.yml at main · sumdher/JobHound · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
# JobHound - docker-compose.prod.yml
# Production Docker Compose configuration.
# Run via: make prod  (wraps with `infisical run --env prod` to inject secrets)

services:
  db:
    # Pin by digest so a tag re-push cannot silently swap the image.
    # To update: docker pull pgvector/pgvector:pg16 && docker inspect --format='{{index .RepoDigests 0}}' pgvector/pgvector:pg16
    image: pgvector/pgvector@sha256:7d400e340efb42f4d8c9c12c6427adb253f726881a9985d2a471bf0eed824dff
    container_name: jobhound_db_prod
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-jobhound}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-jobhound}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-jobhound} -d ${POSTGRES_DB:-jobhound}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    restart: unless-stopped

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      target: production
    container_name: jobhound_backend_prod
    env_file:
      - ./backend/.env          # non-secret config only
    environment:
      # DATABASE_URL built from Infisical root secrets — never hardcoded
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-jobhound}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-jobhound}
      # Secrets — injected by `infisical run` via Makefile
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      JWT_SECRET: ${JWT_SECRET:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      NEBIUS_API_KEY: ${NEBIUS_API_KEY:-}
      RESEND_API_KEY: ${RESEND_API_KEY:-}
    command: >
      sh -c "alembic upgrade head &&
             exec uvicorn app.main:app --host 0.0.0.0 --port 8000
             --workers ${UVICORN_WORKERS:-2}
             --access-log --timeout-keep-alive 30"
    depends_on:
      db:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 20s
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      target: production
    container_name: jobhound_frontend_prod
    environment:
      INTERNAL_API_URL: http://backend:8000
      PORT: 3000
      HOSTNAME: 0.0.0.0
      # Secrets — injected by `infisical run` via Makefile
      NEXTAUTH_URL: ${NEXTAUTH_URL:-}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
    ports:
      - "${FRONTEND_BIND_ADDRESS:-127.0.0.1}:${FRONTEND_PORT:-3001}:3000"
    depends_on:
      backend:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://127.0.0.1:3000 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    restart: unless-stopped

  cloudflared:
    # Pin by digest so a tag re-push cannot silently swap the image.
    # To update: docker pull cloudflare/cloudflared:2024.11.0 && docker inspect --format='{{index .RepoDigests 0}}' cloudflare/cloudflared:2024.11.0
    image: cloudflare/cloudflared@sha256:2c78df02e1f23ab19d4c636921f05b9ebec163b887e946f98e22e56254a5540f
    container_name: jobhound_cloudflared_prod
    command: tunnel --no-autoupdate --config /etc/cloudflared/config.yml run --token ${CLOUDFLARE_TUNNEL_TOKEN}
    depends_on:
      frontend:
        condition: service_healthy
    volumes:
      - ${CLOUDFLARED_CONFIG_PATH:-./deploy/cloudflared/config.yml}:/etc/cloudflared/config.yml:ro
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped

volumes:
  postgres_data: