326 lines
10 KiB
YAML
326 lines
10 KiB
YAML
services:
|
||
postgres:
|
||
image: postgres:16-alpine
|
||
container_name: lendry-id-postgres
|
||
restart: unless-stopped
|
||
environment:
|
||
POSTGRES_USER: ${POSTGRES_USER:-lendry}
|
||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-lendry_password}
|
||
POSTGRES_DB: ${POSTGRES_DB:-lendry_id}
|
||
ports:
|
||
- "5432:5432"
|
||
volumes:
|
||
- postgres_data:/var/lib/postgresql/data
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-lendry} -d ${POSTGRES_DB:-lendry_id}"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 5
|
||
|
||
redis:
|
||
image: redis:7-alpine
|
||
container_name: lendry-id-redis
|
||
restart: unless-stopped
|
||
command: ["redis-server", "--appendonly", "yes"]
|
||
ports:
|
||
- "6379:6379"
|
||
volumes:
|
||
- redis_data:/data
|
||
healthcheck:
|
||
test: ["CMD", "redis-cli", "ping"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 5
|
||
|
||
rabbitmq:
|
||
image: rabbitmq:3.13-management-alpine
|
||
container_name: lendry-id-rabbitmq
|
||
restart: unless-stopped
|
||
environment:
|
||
RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-lendry}
|
||
RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-lendry_password}
|
||
ports:
|
||
- "5672:5672"
|
||
- "15672:15672"
|
||
volumes:
|
||
- rabbitmq_data:/var/lib/rabbitmq
|
||
healthcheck:
|
||
test: ["CMD", "rabbitmq-diagnostics", "ping"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 5
|
||
|
||
minio:
|
||
image: minio/minio:latest
|
||
container_name: lendry-id-minio
|
||
restart: unless-stopped
|
||
command: server /data --console-address ":9001"
|
||
environment:
|
||
MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
|
||
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
|
||
ports:
|
||
- "127.0.0.1:9000:9000"
|
||
- "127.0.0.1:9001:9001"
|
||
volumes:
|
||
- minio_data:/data
|
||
healthcheck:
|
||
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 5
|
||
|
||
sso-core:
|
||
pull_policy: build
|
||
build:
|
||
context: .
|
||
dockerfile: apps/sso-core/Dockerfile
|
||
args:
|
||
NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org}
|
||
container_name: lendry-id-sso-core
|
||
restart: unless-stopped
|
||
environment:
|
||
DATABASE_URL: postgresql://${POSTGRES_USER:-lendry}:${POSTGRES_PASSWORD:-lendry_password}@postgres:5432/${POSTGRES_DB:-lendry_id}?schema=public
|
||
JWT_ACCESS_SECRET: ${JWT_ACCESS_SECRET:-docker-access-secret}
|
||
JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:-docker-refresh-secret}
|
||
DATA_ENCRYPTION_KEY: ${DATA_ENCRYPTION_KEY:-docker-data-encryption-secret-change-me}
|
||
REDIS_URL: redis://redis:6379
|
||
GRPC_URL: 0.0.0.0:50051
|
||
HTTP_PORT: 3001
|
||
MINIO_ENDPOINT: minio:9000
|
||
MINIO_PUBLIC_ENDPOINT: ${MINIO_PUBLIC_ENDPOINT:-localhost:9000}
|
||
MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
|
||
MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
|
||
MINIO_BUCKET: ${MINIO_BUCKET:-lendry-id}
|
||
MINIO_USE_SSL: ${MINIO_USE_SSL:-false}
|
||
PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:3002/idp-api}
|
||
RABBITMQ_URL: amqp://${RABBITMQ_DEFAULT_USER:-lendry}:${RABBITMQ_DEFAULT_PASS:-lendry_password}@rabbitmq:5672/
|
||
LDAP_AUTH_URL: http://ldap-auth:8086
|
||
OAUTH_SSL_SANS_FILE: /data/nginx-certs/oauth-redirect-sans.txt
|
||
volumes:
|
||
- ./nginx/certs:/data/nginx-certs
|
||
ports:
|
||
- "3001:3001"
|
||
- "50051:50051"
|
||
depends_on:
|
||
postgres:
|
||
condition: service_healthy
|
||
redis:
|
||
condition: service_healthy
|
||
minio:
|
||
condition: service_healthy
|
||
rabbitmq:
|
||
condition: service_started
|
||
ldap-auth:
|
||
condition: service_healthy
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3001/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
|
||
interval: 10s
|
||
timeout: 10s
|
||
retries: 12
|
||
start_period: 120s
|
||
|
||
api-gateway:
|
||
pull_policy: build
|
||
build:
|
||
context: .
|
||
dockerfile: apps/api-gateway/Dockerfile
|
||
args:
|
||
NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org}
|
||
container_name: lendry-id-api-gateway
|
||
restart: unless-stopped
|
||
environment:
|
||
PORT: 3000
|
||
SSO_CORE_GRPC_URL: sso-core:50051
|
||
JWT_ACCESS_SECRET: ${JWT_ACCESS_SECRET:-docker-access-secret}
|
||
MINIO_ENDPOINT: minio:9000
|
||
MINIO_PUBLIC_ENDPOINT: ${MINIO_PUBLIC_ENDPOINT:-localhost:9000}
|
||
MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
|
||
MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
|
||
MINIO_BUCKET: ${MINIO_BUCKET:-lendry-id}
|
||
MINIO_USE_SSL: ${MINIO_USE_SSL:-false}
|
||
PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:3002/idp-api}
|
||
FEDCM_COOKIE_SECURE: ${FEDCM_COOKIE_SECURE:-false}
|
||
TRUST_PROXY: ${TRUST_PROXY:-true}
|
||
ports:
|
||
- "127.0.0.1:3000:3000"
|
||
depends_on:
|
||
sso-core:
|
||
condition: service_healthy
|
||
minio:
|
||
condition: service_healthy
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
|
||
interval: 10s
|
||
timeout: 10s
|
||
retries: 12
|
||
start_period: 60s
|
||
|
||
media-ws:
|
||
pull_policy: build
|
||
build:
|
||
context: .
|
||
dockerfile: apps/media-ws/Dockerfile
|
||
container_name: lendry-id-media-ws
|
||
restart: unless-stopped
|
||
environment:
|
||
PORT: 8085
|
||
REDIS_ADDR: redis:6379
|
||
RABBITMQ_URL: amqp://${RABBITMQ_DEFAULT_USER:-lendry}:${RABBITMQ_DEFAULT_PASS:-lendry_password}@rabbitmq:5672/
|
||
JWT_ACCESS_SECRET: ${JWT_ACCESS_SECRET:-docker-access-secret}
|
||
ports:
|
||
- "127.0.0.1:8085:8085"
|
||
depends_on:
|
||
redis:
|
||
condition: service_healthy
|
||
rabbitmq:
|
||
condition: service_healthy
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "wget -qO- http://localhost:8085/health >/dev/null 2>&1 || exit 1"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 10
|
||
|
||
ldap-auth:
|
||
pull_policy: build
|
||
build:
|
||
context: .
|
||
dockerfile: apps/ldap-auth/Dockerfile
|
||
container_name: lendry-id-ldap-auth
|
||
restart: unless-stopped
|
||
environment:
|
||
PORT: 8086
|
||
LDAP_DNS_SERVERS: ${LDAP_DNS_SERVERS:-}
|
||
LDAP_EXTRA_HOSTS: ${LDAP_EXTRA_HOSTS:-}
|
||
ports:
|
||
- "8086:8086"
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "wget -qO- http://localhost:8086/health >/dev/null 2>&1 || exit 1"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 10
|
||
|
||
frontend:
|
||
pull_policy: build
|
||
build:
|
||
context: .
|
||
dockerfile: apps/frontend/Dockerfile
|
||
args:
|
||
NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org}
|
||
NEXT_PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:3002/idp-api}
|
||
NEXT_PUBLIC_WS_URL: ${PUBLIC_WS_URL:-ws://localhost:8085/ws}
|
||
INTERNAL_API_URL: ${INTERNAL_API_URL:-http://api-gateway:3000}
|
||
INTERNAL_WS_URL: ${INTERNAL_WS_URL:-http://media-ws:8085}
|
||
container_name: lendry-id-frontend
|
||
restart: unless-stopped
|
||
environment:
|
||
PORT: 3000
|
||
HOSTNAME: 0.0.0.0
|
||
NEXT_TELEMETRY_DISABLED: 1
|
||
NEXT_PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:3002/idp-api}
|
||
NEXT_PUBLIC_WS_URL: ${PUBLIC_WS_URL:-ws://localhost:8085/ws}
|
||
INTERNAL_API_URL: ${INTERNAL_API_URL:-http://api-gateway:3000}
|
||
INTERNAL_WS_URL: ${INTERNAL_WS_URL:-http://media-ws:8085}
|
||
ports:
|
||
- "127.0.0.1:3002:3000"
|
||
volumes:
|
||
- ./apps/frontend/public/downloads:/app/apps/frontend/public/downloads:ro
|
||
depends_on:
|
||
api-gateway:
|
||
condition: service_healthy
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "node -e \"fetch('http://localhost:3000').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 10
|
||
|
||
tauri-apk-builder:
|
||
pull_policy: build
|
||
build:
|
||
context: .
|
||
dockerfile: tauri_app/Dockerfile.apk
|
||
args:
|
||
NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org}
|
||
container_name: lendry-id-tauri-apk-builder
|
||
restart: "no"
|
||
environment:
|
||
VITE_API_URL: ${PUBLIC_API_URL:-http://localhost:3002/idp-api}
|
||
VITE_FRONTEND_URL: ${PUBLIC_FRONTEND_URL:-http://localhost:3002}
|
||
PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:3002/idp-api}
|
||
PUBLIC_FRONTEND_URL: ${PUBLIC_FRONTEND_URL:-http://localhost:3002}
|
||
volumes:
|
||
- ./apps/frontend/public/downloads:/out
|
||
|
||
docs:
|
||
pull_policy: build
|
||
build:
|
||
context: .
|
||
dockerfile: apps/docs/Dockerfile
|
||
args:
|
||
NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org}
|
||
NEXT_PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:3002/idp-api}
|
||
container_name: lendry-id-docs
|
||
restart: unless-stopped
|
||
depends_on:
|
||
api-gateway:
|
||
condition: service_healthy
|
||
environment:
|
||
PORT: 3000
|
||
HOSTNAME: 0.0.0.0
|
||
NEXT_TELEMETRY_DISABLED: 1
|
||
NEXT_PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:3002/idp-api}
|
||
INTERNAL_API_URL: http://api-gateway:3000
|
||
ports:
|
||
- "127.0.0.1:3003:3000"
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "node -e \"fetch('http://localhost:3000/docs').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 10
|
||
|
||
nginx:
|
||
profiles: ["proxy"]
|
||
image: nginx:1.27-alpine
|
||
container_name: lendry-id-nginx
|
||
restart: unless-stopped
|
||
ports:
|
||
- "${NGINX_HTTP_PORT:-80}:80"
|
||
- "${NGINX_HTTPS_PORT:-443}:443"
|
||
volumes:
|
||
- ./nginx/conf.d:/etc/nginx/conf.d:ro
|
||
- ./nginx/certs:/etc/nginx/certs:ro
|
||
depends_on:
|
||
api-gateway:
|
||
condition: service_healthy
|
||
frontend:
|
||
condition: service_healthy
|
||
docs:
|
||
condition: service_healthy
|
||
media-ws:
|
||
condition: service_started
|
||
healthcheck:
|
||
test: ["CMD", "nginx", "-t"]
|
||
interval: 30s
|
||
timeout: 5s
|
||
retries: 3
|
||
|
||
# После recreate api-gateway nginx держит старый IP upstream → 502. Этот watcher
|
||
# делает nginx -s reload когда gateway снова поднялся (~55 с на Nest bootstrap).
|
||
nginx-gateway-sync:
|
||
profiles: ["proxy"]
|
||
image: docker:27-cli
|
||
container_name: lendry-id-nginx-gateway-sync
|
||
restart: unless-stopped
|
||
volumes:
|
||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||
- ./infra/nginx-gateway-sync/entrypoint.sh:/entrypoint.sh:ro
|
||
depends_on:
|
||
nginx:
|
||
condition: service_started
|
||
entrypoint: ["/bin/sh", "/entrypoint.sh"]
|
||
|
||
volumes:
|
||
postgres_data:
|
||
redis_data:
|
||
rabbitmq_data:
|
||
minio_data:
|