docker-compose.prod.yml - master - rustwizard/balda

docker-compose.prod.yml
116 строк3 KB
Rust Wizard
feat: friend invites via Telegram startapp deep links
04 авг 2026, 10:52
04 авг 2026, 10:52fc4dbe3
# Production deployment: single VPS, everything behind Caddy (auto-HTTPS).
# Only ports 80/443 are published; Postgres/Redis/Centrifugo/API stay inside
# the compose network. Secrets come from .env (copy .env.prod.example).
name: balda

x-default-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "3"

services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    environment:
      DOMAIN: ${DOMAIN:?set in .env}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - frontend
    logging: *default-logging

  frontend:
    image: rustwizard/balda-frontend
    build:
      context: ./frontend
      dockerfile: ./Dockerfile
    restart: unless-stopped
    depends_on:
      server:
        condition: service_started
      centrifugo:
        condition: service_started
    logging: *default-logging

  server:
    image: rustwizard/balda-server
    build:
      context: .
      dockerfile: ./build/Dockerfile
    restart: unless-stopped
    environment:
      SERVER_ADDR: 0.0.0.0
      SERVER_PORT: 9666
      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:?set in .env}
      # Email/password registration is for local testing only; prod users
      # will authenticate via Telegram. Login for existing accounts stays on.
      AUTH_EMAIL_SIGNUP_ENABLED: "false"
      # Telegram Mini App auth (optional; endpoint answers 503 when empty).
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
      # Public Mini App link (https://t.me/<bot>/<app>) for friend invites.
      TELEGRAM_APP_URL: ${TELEGRAM_APP_URL:-}
      PG_HOST: pg
      PG_USER: balda
      PG_DATABASE: balda
      PG_PASSWORD: ${PG_PASSWORD:?set in .env}
      PG_MAX_POOL_SIZE: 100
      REDIS_ADDR: redis:6379
      MIGRATION_CONN_STRING: postgres://balda:${PG_PASSWORD}@pg:5432/balda?sslmode=disable
      CENTRIFUGO_API_URL: http://centrifugo:8000/api
      CENTRIFUGO_API_KEY: ${CENTRIFUGO_API_KEY:?set in .env}
      CENTRIFUGO_TOKEN_HMAC_SECRET_KEY: ${CENTRIFUGO_SECRET:?set in .env}
    command: ["server"]
    depends_on:
      pg:
        condition: service_healthy
      centrifugo:
        condition: service_started
    logging: *default-logging

  pg:
    image: postgres:16-trixie
    restart: unless-stopped
    volumes:
      - pg_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASSWORD:?set in .env}
      POSTGRES_USER: balda
      POSTGRES_DB: balda
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U balda -d balda"]
      interval: 5s
      timeout: 5s
      retries: 5
    logging: *default-logging

  redis:
    image: redis:8-trixie
    restart: unless-stopped
    volumes:
      - redis_data:/data
    logging: *default-logging

  centrifugo:
    image: centrifugo/centrifugo:v6
    restart: unless-stopped
    environment:
      CENTRIFUGO_CLIENT_TOKEN_HMAC_SECRET_KEY: ${CENTRIFUGO_SECRET:?set in .env}
      CENTRIFUGO_HTTP_API_KEY: ${CENTRIFUGO_API_KEY:?set in .env}
      CENTRIFUGO_CLIENT_ALLOWED_ORIGINS: https://${DOMAIN:?set in .env}
      CENTRIFUGO_HEALTH_ENABLED: "true"
      CENTRIFUGO_CHANNEL_NAMESPACES: '[{"name":"game"}]'
    command: centrifugo
    logging: *default-logging

volumes:
  pg_data:
  redis_data:
  caddy_data:
  caddy_config: