62 lines
2.0 KiB
YAML
62 lines
2.0 KiB
YAML
# Production. One service.
|
|
#
|
|
# The Pireon API is external — a separate deployment on the public internet, not
|
|
# part of this stack — so there is nothing here to orchestrate alongside the
|
|
# landing, and nothing to wait for on startup. What it does mean is that the
|
|
# container needs outbound HTTPS: the page is server-rendered, so every request
|
|
# it serves makes ten calls to `landing-api.pireon.dev` from inside the
|
|
# container. Behind a restrictive egress policy, that host has to be allowed or
|
|
# every page renders as if the API were in maintenance.
|
|
#
|
|
# NEXUS_TOKEN=… docker compose build # the build needs the private registry
|
|
# docker compose up -d
|
|
#
|
|
# Put a reverse proxy in front for TLS. It should pass the response headers
|
|
# through untouched: the app answers 503 with `Retry-After` while the API is in
|
|
# maintenance, and 404 for addresses it does not serve.
|
|
|
|
services:
|
|
landing:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
secrets:
|
|
- nexus_token
|
|
image: pireon/landing:latest
|
|
restart: unless-stopped
|
|
ports:
|
|
- '${LANDING_PORT:-3000}:3000'
|
|
environment:
|
|
# Where the public API lives. The only setting the app actually reads.
|
|
PIREON_API_URL: ${PIREON_API_URL:-https://landing-api.pireon.dev/api}
|
|
PORT: '3000'
|
|
NODE_ENV: production
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- node
|
|
- -e
|
|
- "fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 15s
|
|
retries: 3
|
|
# The server writes nothing: the build output is all it has, and Nitro only
|
|
# ever needs a scratch directory.
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: '10m'
|
|
max-file: '3'
|
|
|
|
secrets:
|
|
nexus_token:
|
|
# Read from the environment at build time so the token never lands in a
|
|
# file next to the compose config.
|
|
environment: NEXUS_TOKEN
|