Initial commit

docker-compose.yml

@@ -0,0 +1,61 @@
+# Production. One service.
+#
+# The Pireon API is external — a separate deployment on the public internet, not
+# part of this stack — so there is nothing here to orchestrate alongside the
+# landing, and nothing to wait for on startup. What it does mean is that the
+# container needs outbound HTTPS: the page is server-rendered, so every request
+# it serves makes ten calls to `landing-api.pireon.dev` from inside the
+# container. Behind a restrictive egress policy, that host has to be allowed or
+# every page renders as if the API were in maintenance.
+#
+#   NEXUS_TOKEN=… docker compose build      # the build needs the private registry
+#   docker compose up -d
+#
+# Put a reverse proxy in front for TLS. It should pass the response headers
+# through untouched: the app answers 503 with `Retry-After` while the API is in
+# maintenance, and 404 for addresses it does not serve.
+
+services:
+  landing:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      secrets:
+        - nexus_token
+    image: pireon/landing:latest
+    restart: unless-stopped
+    ports:
+      - '${LANDING_PORT:-3000}:3000'
+    environment:
+      # Where the public API lives. The only setting the app actually reads.
+      PIREON_API_URL: ${PIREON_API_URL:-https://landing-api.pireon.dev/api}
+      PORT: '3000'
+      NODE_ENV: production
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - "fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      start_period: 15s
+      retries: 3
+    # The server writes nothing: the build output is all it has, and Nitro only
+    # ever needs a scratch directory.
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+    logging:
+      driver: json-file
+      options:
+        max-size: '10m'
+        max-file: '3'
+
+secrets:
+  nexus_token:
+    # Read from the environment at build time so the token never lands in a
+    # file next to the compose config.
+    environment: NEXUS_TOKEN