docker-compose.prod.yml - master - nasya/SafeDrop

docker-compose.prod.yml
351 строка12 KB
nasya
Initial commit
24 май 2026, 16:12
24 май 2026, 16:1216bc032
name: safedrop-prod

x-prod-build: &prod-build
  context: .
  dockerfile: infra/docker/node-service.Dockerfile

x-public-env: &public-env
  AUTH_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
  PUBLIC_AUTH_URL: ${PUBLIC_BASE_URL:-http://localhost}
  HYDRA_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
  PUBLIC_HYDRA_CLIENT_ID: ${PUBLIC_HYDRA_CLIENT_ID:-safedrop-web}
  WEB_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}

x-db-env: &db-env
  DATABASE_URL: postgresql://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for prod}@postgres:5432/${POSTGRES_DB:-safedrop}?options=-c%20search_path%3Dpublic

x-object-storage-env: &object-storage-env
  OBJECT_STORAGE_ENDPOINT: ${OBJECT_STORAGE_ENDPOINT:-http://minio:9000}
  OBJECT_STORAGE_PUBLIC_ENDPOINT: ${PUBLIC_BASE_URL:-http://localhost}
  OBJECT_STORAGE_REGION: ${OBJECT_STORAGE_REGION:-us-east-1}
  OBJECT_STORAGE_ACCESS_KEY: ${OBJECT_STORAGE_ACCESS_KEY:-safedrop}
  OBJECT_STORAGE_SECRET_KEY: ${OBJECT_STORAGE_SECRET_KEY:?set OBJECT_STORAGE_SECRET_KEY for prod}
  OBJECT_STORAGE_BUCKET: ${OBJECT_STORAGE_BUCKET:-safedrop-files}
  OBJECT_STORAGE_FORCE_PATH_STYLE: ${OBJECT_STORAGE_FORCE_PATH_STYLE:-true}

x-fastify-health: &fastify-health
  interval: 10s
  timeout: 5s
  retries: 20
  start_period: 10s

services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-safedrop}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for prod}
      POSTGRES_DB: ${POSTGRES_DB:-safedrop}
    volumes:
      - safedrop-postgres-prod:/var/lib/postgresql
      - ./infra/docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-safedrop} -d ${POSTGRES_DB:-safedrop}"]
      interval: 10s
      timeout: 5s
      retries: 10

  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${OBJECT_STORAGE_ACCESS_KEY:-safedrop}
      MINIO_ROOT_PASSWORD: ${OBJECT_STORAGE_SECRET_KEY:?set OBJECT_STORAGE_SECRET_KEY for prod}
      MINIO_API_CORS_ALLOW_ORIGIN: ${PUBLIC_BASE_URL:-http://localhost}
    volumes:
      - safedrop-minio-prod:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 10

  minio-init:
    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
    entrypoint: ["/bin/sh"]
    command:
      - -ec
      - |
        mc alias set local http://minio:9000 ${OBJECT_STORAGE_ACCESS_KEY:-safedrop} ${OBJECT_STORAGE_SECRET_KEY:?set OBJECT_STORAGE_SECRET_KEY for prod}
        mc mb --ignore-existing local/${OBJECT_STORAGE_BUCKET:-safedrop-files}
        mc anonymous set none local/${OBJECT_STORAGE_BUCKET:-safedrop-files}
    depends_on:
      minio:
        condition: service_healthy

  safedrop-migrate:
    image: safedrop-migrate-prod:latest
    build:
      <<: *prod-build
      target: migrate
    environment:
      <<: *db-env
    depends_on:
      postgres:
        condition: service_healthy

  kratos-migrate:
    image: oryd/kratos:v1.2.0
    command: migrate sql -e --yes
    environment:
      DSN: postgres://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for prod}@postgres:5432/${POSTGRES_DB:-safedrop}?sslmode=disable&search_path=kratos
    volumes:
      - ./infra/docker/ory/kratos:/etc/config/kratos:ro
    depends_on:
      postgres:
        condition: service_healthy

  kratos:
    image: oryd/kratos:v1.2.0
    entrypoint: ["sh", "-c"]
    command:
      - sh /usr/local/bin/render-config.sh /etc/config/kratos/kratos.yml /tmp/kratos.yml && kratos serve --config /tmp/kratos.yml
    environment:
      DSN: postgres://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for prod}@postgres:5432/${POSTGRES_DB:-safedrop}?sslmode=disable&search_path=kratos
      COURIER_SMTP_CONNECTION_URI: ${COURIER_SMTP_CONNECTION_URI:?set COURIER_SMTP_CONNECTION_URI for prod}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-replace-me}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-replace-me}
      YANDEX_CLIENT_ID: ${YANDEX_CLIENT_ID:-replace-me}
      YANDEX_CLIENT_SECRET: ${YANDEX_CLIENT_SECRET:-replace-me}
      AUTH_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
      WEB_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
      KRATOS_COOKIE_SECRET: ${KRATOS_COOKIE_SECRET:?set KRATOS_COOKIE_SECRET for prod}
      KRATOS_CIPHER_SECRET: ${KRATOS_CIPHER_SECRET:?set KRATOS_CIPHER_SECRET for prod}
      KRATOS_LOG_LEVEL: ${KRATOS_LOG_LEVEL:-info}
      KRATOS_LEAK_SENSITIVE_VALUES: "false"
      TELEGRAM_OIDC_ISSUER_URL: http://telegram-oidc-bridge:3005
    expose:
      - "4433"
      - "4434"
    volumes:
      - ./infra/docker/ory/kratos:/etc/config/kratos:ro
      - ./infra/docker/ory/render-config.sh:/usr/local/bin/render-config.sh:ro
    depends_on:
      kratos-migrate:
        condition: service_completed_successfully
      telegram-oidc-bridge:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4434/health/ready"]
      interval: 10s
      timeout: 5s
      retries: 20

  hydra-migrate:
    image: oryd/hydra:v2.2.0
    command: migrate sql -e --yes
    environment:
      DSN: postgres://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for prod}@postgres:5432/${POSTGRES_DB:-safedrop}?sslmode=disable&search_path=hydra
    depends_on:
      postgres:
        condition: service_healthy

  hydra:
    image: oryd/hydra:v2.2.0
    entrypoint: ["sh", "-c"]
    command:
      - sh /usr/local/bin/render-config.sh /etc/config/hydra/hydra.yml /tmp/hydra.yml && hydra serve all --config /tmp/hydra.yml
    environment:
      DSN: postgres://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for prod}@postgres:5432/${POSTGRES_DB:-safedrop}?sslmode=disable&search_path=hydra
      SECRETS_SYSTEM: ${SECRETS_SYSTEM:?set SECRETS_SYSTEM for prod}
      URLS_SELF_ISSUER: ${PUBLIC_BASE_URL:-http://localhost}
      URLS_LOGIN: ${PUBLIC_BASE_URL:-http://localhost}/login
      URLS_CONSENT: ${PUBLIC_BASE_URL:-http://localhost}/consent
      WEB_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
      HYDRA_LOG_LEVEL: ${HYDRA_LOG_LEVEL:-info}
      HYDRA_EXPOSE_INTERNAL_ERRORS: "false"
    expose:
      - "4444"
      - "4445"
    volumes:
      - ./infra/docker/ory/hydra:/etc/config/hydra:ro
      - ./infra/docker/ory/render-config.sh:/usr/local/bin/render-config.sh:ro
    depends_on:
      hydra-migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4445/health/ready"]
      interval: 10s
      timeout: 5s
      retries: 20

  hydra-client-init:
    image: safedrop-hydra-client-init-prod:latest
    build:
      <<: *prod-build
      target: hydra-client-init
    environment:
      NODE_ENV: production
      HYDRA_ADMIN_URL: http://hydra:4445
      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost}
      PUBLIC_HYDRA_CLIENT_ID: ${PUBLIC_HYDRA_CLIENT_ID:-safedrop-web}
      WEB_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
    depends_on:
      hydra:
        condition: service_healthy

  telegram-oidc-bridge:
    image: safedrop-telegram-oidc-bridge-prod:latest
    build:
      <<: *prod-build
      target: telegram-oidc-bridge
    environment:
      NODE_ENV: production
      TELEGRAM_BRIDGE_PUBLIC_URL: ${TELEGRAM_BRIDGE_PUBLIC_URL:-http://telegram-oidc-bridge:3005}
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
    expose:
      - "3005"
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3005/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  file-service:
    image: safedrop-file-service-prod:latest
    build:
      <<: *prod-build
      target: file-service
    environment:
      <<: [*db-env, *object-storage-env]
      NODE_ENV: production
    expose:
      - "3001"
    depends_on:
      safedrop-migrate:
        condition: service_completed_successfully
      minio-init:
        condition: service_completed_successfully
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3001/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  key-service:
    image: safedrop-key-service-prod:latest
    build:
      <<: *prod-build
      target: key-service
    environment:
      <<: *db-env
      NODE_ENV: production
    expose:
      - "3002"
    depends_on:
      safedrop-migrate:
        condition: service_completed_successfully
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3002/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  share-service:
    image: safedrop-share-service-prod:latest
    build:
      <<: *prod-build
      target: share-service
    environment:
      <<: [*db-env, *object-storage-env]
      NODE_ENV: production
      SHARE_CLEANUP_LIMIT: ${SHARE_CLEANUP_LIMIT:-100}
      SHARE_CLEANUP_INTERVAL_SECONDS: ${SHARE_CLEANUP_INTERVAL_SECONDS:-60}
    expose:
      - "3003"
    depends_on:
      safedrop-migrate:
        condition: service_completed_successfully
      minio-init:
        condition: service_completed_successfully
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3003/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  api-gateway:
    image: safedrop-api-gateway-prod:latest
    build:
      <<: *prod-build
      target: api-gateway
    environment:
      NODE_ENV: production
      AUTH_MODE: ${AUTH_MODE:-hydra}
      FILE_SERVICE_URL: http://file-service:3001
      KEY_SERVICE_URL: http://key-service:3002
      SHARE_SERVICE_URL: http://share-service:3003
      HYDRA_ADMIN_URL: http://hydra:4445
    expose:
      - "8080"
    depends_on:
      hydra-client-init:
        condition: service_completed_successfully
      hydra:
        condition: service_healthy
      file-service:
        condition: service_healthy
      key-service:
        condition: service_healthy
      share-service:
        condition: service_healthy
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  auth-ui:
    image: safedrop-auth-ui-prod:latest
    build:
      <<: *prod-build
      target: auth-ui
    environment:
      <<: [*public-env, *db-env]
      NODE_ENV: production
      KRATOS_INTERNAL_URL: http://kratos:4433
      HYDRA_ADMIN_URL: http://hydra:4445
    expose:
      - "3004"
    depends_on:
      kratos:
        condition: service_healthy
      hydra:
        condition: service_healthy
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3004/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  web-app:
    image: safedrop-web-prod:latest
    build:
      context: .
      dockerfile: infra/docker/web.Dockerfile
      args:
        PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost}
        PUBLIC_API_URL: ${PUBLIC_BASE_URL:-http://localhost}
        PUBLIC_AUTH_URL: ${PUBLIC_BASE_URL:-http://localhost}
        PUBLIC_HYDRA_URL: ${PUBLIC_BASE_URL:-http://localhost}
        PUBLIC_HYDRA_CLIENT_ID: ${PUBLIC_HYDRA_CLIENT_ID:-safedrop-web}
    expose:
      - "5173"

  reverse-proxy:
    image: traefik:v3
    command:
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --providers.file.filename=/etc/traefik/dynamic.yml
      - --providers.file.watch=true
      - --api.dashboard=false
      - --log.level=INFO
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./infra/docker/traefik/dynamic-prod.yml:/etc/traefik/dynamic.yml:ro
    depends_on:
      web-app:
        condition: service_started
      api-gateway:
        condition: service_healthy
      auth-ui:
        condition: service_healthy
      hydra:
        condition: service_healthy
      minio:
        condition: service_healthy

volumes:
  safedrop-postgres-prod:
  safedrop-minio-prod: