Tronax
2899eb205b
- Go backend skeleton: config (caarlos0/env), slog JSON logging, pgxpool store, HTTP server with graceful shutdown. - httpapi: render helpers, Problem errors, middleware chain (requestID / logging / recover / CORS), /healthz and /readyz. - Migrations: full initial schema (users, sessions, lists, list_members, items, op_log SOURCE OF TRUTH, item_names) + golang-migrate runner binary using source/iofs (embedded). - Docker: multi-stage Dockerfile (Go 1.26 -> distroless nonroot), builds both server and migrate binaries. - deploy: docker-compose (caddy + backend + migrate + postgres:16), Caddyfile (auto-HTTPS), .env.example, pg extensions init script. - AGENTS.md: project context + roadmap for AI agents. Verified: image builds, both binaries run in container (smoke test).
102 lines
2.8 KiB
YAML
102 lines
2.8 KiB
YAML
# Self-hosted deployment for mitbringsl.
|
|
#
|
|
# cp .env.example .env # fill in secrets + domains
|
|
# docker compose up -d --build
|
|
#
|
|
# Services:
|
|
# caddy public reverse proxy with automatic HTTPS (Let's Encrypt)
|
|
# backend mitbringsl Go API (image builds server + migrate binaries)
|
|
# migrate one-shot migration runner, must finish before backend starts
|
|
# db PostgreSQL 16
|
|
name: mitbringsl
|
|
|
|
x-backend-image: &backend-image
|
|
image: mitbringsl-backend
|
|
build:
|
|
context: ../backend
|
|
dockerfile: Dockerfile
|
|
|
|
x-app-env: &appenv
|
|
APP_ENV: ${APP_ENV:-production}
|
|
LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
DATABASE_URL: postgres://${POSTGRES_USER:-app}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-appdb}?sslmode=disable
|
|
|
|
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-app}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
|
|
POSTGRES_DB: ${POSTGRES_DB:-appdb}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
- ./db/init:/docker-entrypoint-initdb.d:ro # runs on first init only
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-app} -d ${POSTGRES_DB:-appdb}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
networks: [appnet]
|
|
# Only expose the DB to the host for local debugging; remove in prod.
|
|
# ports:
|
|
# - "5432:5432"
|
|
|
|
migrate:
|
|
<<: *backend-image
|
|
restart: "no"
|
|
command: ["/app/migrate", "up"]
|
|
environment:
|
|
<<: *appenv
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks: [appnet]
|
|
|
|
backend:
|
|
<<: *backend-image
|
|
restart: unless-stopped
|
|
environment:
|
|
<<: *appenv
|
|
HTTP_ADDR: ":8080"
|
|
PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:8080}
|
|
SESSION_TOKEN_TTL: ${SESSION_TOKEN_TTL:-720h}
|
|
# OIDC (all optional)
|
|
OIDC_GOOGLE_ENABLED: ${OIDC_GOOGLE_ENABLED:-false}
|
|
OIDC_GOOGLE_CLIENT_ID: ${OIDC_GOOGLE_CLIENT_ID:-}
|
|
OIDC_GOOGLE_ISSUER: ${OIDC_GOOGLE_ISSUER:-https://accounts.google.com}
|
|
OIDC_GENERIC_ENABLED: ${OIDC_GENERIC_ENABLED:-false}
|
|
OIDC_GENERIC_ISSUER: ${OIDC_GENERIC_ISSUER:-}
|
|
OIDC_GENERIC_CLIENT_ID: ${OIDC_GENERIC_CLIENT_ID:-}
|
|
CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-}
|
|
expose: ["8080"]
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
migrate:
|
|
condition: service_completed_successfully
|
|
networks: [appnet]
|
|
|
|
caddy:
|
|
image: caddy:2-alpine
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80" # ACME HTTP-01 challenge + redirect
|
|
- "443:443"
|
|
- "443:443/udp" # HTTP/3
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy_data:/data
|
|
- caddy_config:/config
|
|
depends_on:
|
|
- backend
|
|
networks: [appnet]
|
|
|
|
volumes:
|
|
pgdata:
|
|
caddy_data:
|
|
caddy_config:
|
|
|
|
networks:
|
|
appnet:
|