feat(platform): add production CI and containers

2026-08-15 22:45:35 +07:00
parent b13c547068
commit cea4378f56
17 changed files with 567 additions and 14 deletions
@@ -1,9 +1,63 @@
+# Production deployment example. Development continues to run Java from the IDE.
+name: labtimesheet-prod
+
 services:
-  postgres:
-    image: 'postgres:latest'
+  app:
+    image: "${LAB_IMAGE:?Set LAB_IMAGE to an immutable sha-* image tag}"
+    restart: unless-stopped
    environment:
-      - 'POSTGRES_DB=mydatabase'
-      - 'POSTGRES_PASSWORD=secret'
-      - 'POSTGRES_USER=myuser'
+      SPRING_PROFILES_ACTIVE: prod
+      LAB_DB_URL: "${LAB_DB_URL:?Set the JDBC PostgreSQL URL}"
+      LAB_DB_USERNAME: "${LAB_DB_USERNAME:?Set the database username}"
+      LAB_DB_PASSWORD: "${LAB_DB_PASSWORD:?Set the database password}"
+      LAB_PUBLIC_ORIGIN: "${LAB_PUBLIC_ORIGIN:?Set the public HTTPS origin}"
+      LAB_SECURITY_MASTER_KEY: "${LAB_SECURITY_MASTER_KEY:?Set a Base64 256-bit key}"
+      LAB_FORWARD_HEADERS_STRATEGY: "${LAB_FORWARD_HEADERS_STRATEGY:?Set the explicit proxy strategy}"
    ports:
-      - '5432'
+      # Bind locally by default; terminate HTTPS in a reverse proxy on the same host.
+      - "${LAB_HTTP_BIND:-127.0.0.1}:${LAB_HTTP_PORT:-8080}:8080"
+    depends_on:
+      postgres:
+        condition: service_healthy
+        # External-database mode leaves the bundled-db profile disabled.
+        required: false
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    stop_grace_period: 40s
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/actuator/health/readiness"]
+      interval: 30s
+      timeout: 5s
+      start_period: 45s
+      retries: 3
+
+  postgres:
+    # Pinned PostgreSQL 18.4 multi-architecture image.
+    image: postgres:18.4@sha256:a02db8cac496f15b094798a38254f14d6e00741f709360e5e00bb6668ea31636
+    profiles: ["bundled-db"]
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: "${POSTGRES_DB:-labtimesheet}"
+      POSTGRES_USER: "${POSTGRES_USER:-labtimesheet}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?Set the bundled PostgreSQL password}"
+    volumes:
+      # PostgreSQL 18 stores versioned data beneath this parent directory.
+      - postgres_data:/var/lib/postgresql
+    shm_size: 256mb
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+
+volumes:
+  # Container replacement keeps this volume. It is not a substitute for backups.
+  postgres_data: