68ad014df0
`docker compose up` failed with "port is already allocated": 3000 was taken by an unrelated project on the same machine. Publishing it was never needed — in production the only thing that has to reach this service is the reverse proxy, which does so over the compose network as `landing:3000`. `expose` replaces `ports`, and a commented `ports` block stays for the cases that do want a host binding. LANDING_PORT is kept but re-labelled as only mattering then. Verified: the container binds nothing on the host, answers 200 with the full page from another container on the network, and stays healthy — its health check was always internal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
74 lines
2.5 KiB
YAML
74 lines
2.5 KiB
YAML
# Production. One service.
|
|
#
|
|
# The Pireon API is external — a separate deployment on the public internet, not
|
|
# part of this stack — so there is nothing here to orchestrate alongside the
|
|
# landing, and nothing to wait for on startup. What it does mean is that the
|
|
# container needs outbound HTTPS: the page is server-rendered, so every request
|
|
# it serves makes ten calls to `landing-api.pireon.dev` from inside the
|
|
# container. Behind a restrictive egress policy, that host has to be allowed or
|
|
# every page renders as if the API were in maintenance.
|
|
#
|
|
# NEXUS_TOKEN=… docker compose build # the build needs the private registry
|
|
# docker compose up -d
|
|
#
|
|
# Put a reverse proxy in front for TLS. It should pass the response headers
|
|
# through untouched: the app answers 503 with `Retry-After` while the API is in
|
|
# maintenance, and 404 for addresses it does not serve.
|
|
|
|
services:
|
|
landing:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
secrets:
|
|
- nexus_token
|
|
image: pireon/landing:latest
|
|
restart: unless-stopped
|
|
# No `ports`. Publishing on the host collides with whatever else is using
|
|
# that number on the machine, and in production the only thing that needs
|
|
# to reach this is the reverse proxy — which does so over the compose
|
|
# network, by service name, on the port below.
|
|
#
|
|
# proxy_pass http://landing:3000;
|
|
#
|
|
# To reach it from the host anyway (a quick check, or a deployment with no
|
|
# proxy in front), uncomment this and set LANDING_PORT to a free port:
|
|
#
|
|
# ports:
|
|
# - '${LANDING_PORT:-3000}:3000'
|
|
expose:
|
|
- '3000'
|
|
environment:
|
|
# Where the public API lives. The only setting the app actually reads.
|
|
PIREON_API_URL: ${PIREON_API_URL:-https://landing-api.pireon.dev/api}
|
|
PORT: '3000'
|
|
NODE_ENV: production
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- node
|
|
- -e
|
|
- "fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 15s
|
|
retries: 3
|
|
# The server writes nothing: the build output is all it has, and Nitro only
|
|
# ever needs a scratch directory.
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: '10m'
|
|
max-file: '3'
|
|
|
|
secrets:
|
|
nexus_token:
|
|
# Read from the environment at build time so the token never lands in a
|
|
# file next to the compose config.
|
|
environment: NEXUS_TOKEN
|