first commit

compose.production.yml

@@ -0,0 +1,87 @@
+name: malenia
+
+services:
+  caddy:
+    build:
+      context: .
+      dockerfile: deploy/caddy/Dockerfile
+      args:
+        CADDY_VERSION: ${CADDY_VERSION:-2.10.2}
+    depends_on:
+      backend:
+        condition: service_healthy
+    environment:
+      ACME_EMAIL: ${ACME_EMAIL:?Set ACME_EMAIL in .env}
+    ports:
+      - "80:80"
+      - "443:443"
+    restart: unless-stopped
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+    networks:
+      - public
+      - private
+
+  backend:
+    build:
+      context: .
+      dockerfile: deploy/backend/Dockerfile
+    depends_on:
+      postgres:
+        condition: service_healthy
+    env_file: ${ENV_FILE:-.env}
+    restart: unless-stopped
+    volumes:
+      - ${KEYS_DIR:-./keys}:/run/secrets/keys:ro
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/', timeout=5)"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    networks:
+      - private
+
+  migrate:
+    build:
+      context: .
+      dockerfile: deploy/backend/Dockerfile
+    command: ["alembic", "upgrade", "head"]
+    depends_on:
+      postgres:
+        condition: service_healthy
+    env_file: ${ENV_FILE:-.env}
+    profiles: ["tools"]
+    volumes:
+      - ${KEYS_DIR:-./keys}:/run/secrets/keys:ro
+    networks:
+      - private
+
+  postgres:
+    image: postgres:16.8-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+      TZ: UTC
+    restart: unless-stopped
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - private
+
+volumes:
+  caddy_data:
+  caddy_config:
+  postgres_data:
+
+networks:
+  public:
+  private:
+    internal: true