docker-compose.yml - master - AlexGromer/local-stack-test-work

docker-compose.yml
127 строк5 KB
AlexGromer
Initial commit
24 июн 2026, 12:53
24 июн 2026, 12:53025dfc6
# =====================================================================
#  docker-compose.yml — локальный стенд веб-приложения
#  nginx (TLS :443)  ->  backend (:BACKEND_PORT)  +  PostgreSQL 15  +  Redis
#
#  ВАЖНО: перед `up` запустите ./setup.sh — он создаст .env, nginx/nginx.conf
#  и сертификаты. nginx монтирует уже готовый статичный конфиг.
# =====================================================================
name: local-stack

services:
  # ------------------------------------------------------------------
  #  Nginx — reverse proxy + TLS termination. Конфиг статичный (из setup.sh).
  # ------------------------------------------------------------------
  nginx:
    image: nginx:1.27-alpine
    container_name: ls-nginx
    depends_on:
      backend:
        condition: service_healthy
    ports:
      - "443:443"                          # ТРЕБОВАНИЕ: nginx слушает :443
      # - "80:80"                          # раскомментировать для http->https редиректа с хоста
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro   # готовый конфиг (создан setup.sh)
      - ./nginx/certs:/etc/nginx/certs:ro             # сертификаты (созданы setup.sh)
    healthcheck:                           # HEALTHCHECK 1/4
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:80/healthz"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    networks: [edge]
    restart: unless-stopped

  # ------------------------------------------------------------------
  #  Backend — Python echo-сервер (stdlib). Порт берёт из .env.
  # ------------------------------------------------------------------
  backend:
    image: python:3.12-slim
    container_name: ls-backend
    user: "65534:65534"                    # nobody, не root (least privilege)
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    expose:
      - "${BACKEND_PORT}"
    environment:
      PORT: ${BACKEND_PORT}                # тот же порт, что в upstream nginx
    volumes:
      - ./backend/app.py:/app/app.py:ro
    command: ["python", "/app/app.py"]
    healthcheck:                           # HEALTHCHECK 2/4 (порт читает из PORT внутри контейнера)
      test: ["CMD", "python", "-c", "import os,urllib.request,sys; p=os.environ['PORT']; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:'+p+'/healthz', timeout=3).status==200 else 1)"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
    networks: [edge, internal]
    restart: unless-stopped

  # ------------------------------------------------------------------
  #  PostgreSQL 15
  # ------------------------------------------------------------------
  postgres:
    image: postgres:15-alpine
    container_name: ls-postgres
    environment:
      POSTGRES_USER:     ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB:       ${POSTGRES_DB}
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:                           # HEALTHCHECK 3/4
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB} -h 127.0.0.1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks: [internal]
    restart: unless-stopped
    # ports:
    #   - "127.0.0.1:5432:5432"            # psql с хоста (только localhost!) для локальной отладки

  # ------------------------------------------------------------------
  #  Redis — кэш сессий (с паролем)
  # ------------------------------------------------------------------
  redis:
    image: redis:7-alpine
    container_name: ls-redis
    command:
      - "redis-server"
      - "--requirepass"
      - "${REDIS_PASSWORD}"
      - "--save"
      - "60"
      - "1"
      - "--appendonly"
      - "no"
    volumes:
      - redisdata:/data
    healthcheck:                           # HEALTHCHECK 4/4
      test: ["CMD-SHELL", "redis-cli --no-auth-warning -a ${REDIS_PASSWORD} ping | grep -q PONG"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
    networks: [internal]
    restart: unless-stopped
    # ports:
    #   - "127.0.0.1:6379:6379"            # redis-cli с хоста (только localhost!) для локальной отладки

# ====================================================================
#  Сегментация сетей: edge (периметр) / internal (БД, без egress)
# ====================================================================
networks:
  edge:
    driver: bridge
  internal:
    driver: bridge
    internal: true                         # БД без выхода в интернет

volumes:
  pgdata:
  redisdata: