129 lines
2.7 KiB
YAML
129 lines
2.7 KiB
YAML
---
|
|
# Stack: tracearr
|
|
#
|
|
# But:
|
|
# - Deployer Tracearr avec TimescaleDB et Redis
|
|
# - Eviter les mots de passe en clair dans Git
|
|
# - Stocker les secrets dans /opt/stacks/tracearr/secrets
|
|
#
|
|
# Notes:
|
|
# - Le fichier .env de production n est pas utilise
|
|
# - Les secrets sont lus depuis des fichiers Docker secrets
|
|
|
|
services:
|
|
tracearr:
|
|
image: ghcr.io/connorgallopo/tracearr:latest
|
|
container_name: tracearr
|
|
restart: unless-stopped
|
|
|
|
depends_on:
|
|
timescale:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
|
|
ports:
|
|
- "3000:3000"
|
|
|
|
environment:
|
|
NODE_ENV: production
|
|
PORT: "3000"
|
|
HOST: 0.0.0.0
|
|
TZ: Europe/Paris
|
|
DATABASE_URL_FILE: /run/secrets/database_url
|
|
REDIS_URL: redis://redis:6379
|
|
JWT_SECRET_FILE: /run/secrets/jwt_secret
|
|
COOKIE_SECRET_FILE: /run/secrets/cookie_secret
|
|
BETTER_AUTH_SECRET_FILE: /run/secrets/better_auth_secret
|
|
CORS_ORIGIN: https://tracearr.thomasmlg.fr
|
|
LOG_LEVEL: info
|
|
|
|
secrets:
|
|
- database_url
|
|
- jwt_secret
|
|
- cookie_secret
|
|
- better_auth_secret
|
|
|
|
volumes:
|
|
- tracearr_backups:/data/backup
|
|
|
|
networks:
|
|
- tracearr_network
|
|
|
|
timescale:
|
|
image: timescale/timescaledb-ha:pg18.1-ts2.25.0
|
|
container_name: tracearr-db
|
|
restart: unless-stopped
|
|
shm_size: 512mb
|
|
|
|
ulimits:
|
|
nofile:
|
|
soft: 65536
|
|
hard: 65536
|
|
|
|
command: >
|
|
postgres
|
|
-c timescaledb.license=timescale
|
|
-c timescaledb.max_tuples_decompressed_per_dml_transaction=0
|
|
-c max_locks_per_transaction=4096
|
|
-c timescaledb.telemetry_level=off
|
|
|
|
environment:
|
|
POSTGRES_USER: tracearr
|
|
POSTGRES_PASSWORD_FILE: /run/secrets/db_password
|
|
POSTGRES_DB: tracearr
|
|
|
|
secrets:
|
|
- db_password
|
|
|
|
volumes:
|
|
- timescale_data:/home/postgres/pgdata/data
|
|
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U tracearr"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
networks:
|
|
- tracearr_network
|
|
|
|
redis:
|
|
image: redis:8-alpine
|
|
container_name: tracearr-redis
|
|
restart: unless-stopped
|
|
command: redis-server --appendonly yes
|
|
|
|
volumes:
|
|
- redis_data:/data
|
|
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
networks:
|
|
- tracearr_network
|
|
|
|
secrets:
|
|
db_password:
|
|
file: ./secrets/db_password
|
|
database_url:
|
|
file: ./secrets/database_url
|
|
jwt_secret:
|
|
file: ./secrets/jwt_secret
|
|
cookie_secret:
|
|
file: ./secrets/cookie_secret
|
|
better_auth_secret:
|
|
file: ./secrets/better_auth_secret
|
|
|
|
networks:
|
|
tracearr_network:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
tracearr_backups:
|
|
timescale_data:
|
|
redis_data:
|