Claude
499b753c22
- Un seul conteneur applicatif : Express sert l'API, le frontend React compilé (fallback SPA, cache immutable sur /assets) et les images /uploads (nosniff + CSP default-src 'none') - En-têtes de sécurité (CSP stricte, X-Frame-Options DENY, etc.) portés de nginx vers helmet, compression gzip ajoutée - Application exposée sur le port 8321 (APP_PORT), PostgreSQL sur 127.0.0.1:56432 (DB_PORT, loopback uniquement pour l'admin locale) - TRUST_PROXY pilote la confiance aux en-têtes X-Forwarded-* (désactivé par défaut hors reverse-proxy) - Dockerfile multi-étages unique à la racine (build React → deps → image finale non-root, fs en lecture seule) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fkg15RCxNgUys4ru73He2o
59 lines
1.7 KiB
YAML
59 lines
1.7 KiB
YAML
name: sluc-business-club
|
|
|
|
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: sbc
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
|
|
APP_DB_PASSWORD: ${APP_DB_PASSWORD:?set APP_DB_PASSWORD in .env}
|
|
volumes:
|
|
- db_data:/var/lib/postgresql/data
|
|
- ./db/init:/docker-entrypoint-initdb.d:ro
|
|
ports:
|
|
# Loopback only: reachable from the host machine (psql, backups),
|
|
# never from the network. Remove this mapping to close it entirely.
|
|
- "127.0.0.1:${DB_PORT:-56432}:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres -d sbc"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 12
|
|
|
|
app:
|
|
build: .
|
|
restart: unless-stopped
|
|
environment:
|
|
NODE_ENV: production
|
|
PORT: "3000"
|
|
DATABASE_URL: postgres://sbc_app:${APP_DB_PASSWORD}@db:5432/sbc
|
|
JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env}
|
|
ADMIN_INITIAL_PASSWORD: ${ADMIN_INITIAL_PASSWORD:-}
|
|
MEMBER_INITIAL_PASSWORD: ${MEMBER_INITIAL_PASSWORD:-}
|
|
COOKIE_SECURE: ${COOKIE_SECURE:-false}
|
|
TRUST_PROXY: ${TRUST_PROXY:-false}
|
|
UPLOAD_DIR: /data/uploads
|
|
volumes:
|
|
- uploads:/data/uploads
|
|
ports:
|
|
- "${APP_PORT:-8321}:3000"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 6
|
|
|
|
volumes:
|
|
db_data:
|
|
uploads:
|