mirror of
https://github.com/R0m1k3/podcastic.git
synced 2026-10-12 01:36:20 +02:00
Enable mongod --auth with root credentials from MONGO_USER/PASSWORD, and redis-server --requirepass from REDIS_PASSWORD. App connection strings now embed credentials. All secrets are required (no fallback) so misconfiguration fails fast at compose time. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
73 lines
2.0 KiB
YAML
73 lines
2.0 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
mongodb:
|
|
image: mongo:8
|
|
container_name: podcastic-mongodb
|
|
restart: unless-stopped
|
|
command: ["--auth"]
|
|
environment:
|
|
MONGO_INITDB_ROOT_USERNAME: ${MONGO_USER:?MONGO_USER is required}
|
|
MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD:?MONGO_PASSWORD is required}
|
|
MONGO_INITDB_DATABASE: podcastic
|
|
volumes:
|
|
- mongodb_data:/data/db
|
|
networks:
|
|
- podcastic_net
|
|
healthcheck:
|
|
test: ["CMD", "mongosh", "--quiet", "-u", "${MONGO_USER}", "-p", "${MONGO_PASSWORD}", "--authenticationDatabase", "admin", "--eval", "db.adminCommand('ping')"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: podcastic-redis
|
|
restart: unless-stopped
|
|
command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:?REDIS_PASSWORD is required}"]
|
|
volumes:
|
|
- redis_data:/data
|
|
networks:
|
|
- podcastic_net
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
app:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: podcastic-app
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${PORT:-3579}:3579"
|
|
environment:
|
|
NODE_ENV: production
|
|
PORT: 3579
|
|
MONGODB_URI: mongodb://${MONGO_USER}:${MONGO_PASSWORD}@mongodb:27017/podcastic?authSource=admin
|
|
REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
|
|
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required (min 32 chars, generate with: openssl rand -base64 32)}
|
|
JWT_EXPIRES_IN: 7d
|
|
JWT_REFRESH_EXPIRES_IN: 30d
|
|
CORS_ORIGIN: ${CORS_ORIGIN:-}
|
|
PODCAST_INDEX_API_KEY: ${PODCAST_INDEX_API_KEY:-}
|
|
PODCAST_INDEX_API_SECRET: ${PODCAST_INDEX_API_SECRET:-}
|
|
depends_on:
|
|
mongodb:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks:
|
|
- podcastic_net
|
|
|
|
volumes:
|
|
mongodb_data:
|
|
redis_data:
|
|
|
|
networks:
|
|
podcastic_net:
|
|
driver: bridge
|