docker-compose.prod.yml

version: "3.5"

services:
  reverse-proxy:
    image: traefik:v3.0
    container_name: traefik
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.postgres.address=:5432/tcp"
      - "--certificatesresolvers.defaultresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.defaultresolver.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.defaultresolver.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
      - "5432:5432"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${LETSENCRYPT_DATA:-letsencrypt}:/letsencrypt
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_PUBLIC_HOSTNAME}`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=defaultresolver"
      - "traefik.http.services.traefik.loadbalancer.server.port=8080"
  postgres:
    image: postgres:16-alpine
    container_name: jimmodel_postgres
    hostname: ${POSTGRES_INTERNAL_HOSTNAME}
    restart: always
    volumes:
      - ${DB_DATA:-postgres_data}:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_NAME}
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.postgres.rule=HostSNI(`${POSTGRES_PUBLIC_HOSTNAME}`)"
      - "traefik.tcp.routers.postgres.entrypoints=postgres"
      - "traefik.tcp.routers.postgres.tls=true"
      - "traefik.tcp.routers.postgres.tls.certresolver=defaultresolver"
      - "traefik.tcp.services.postgres.loadbalancer.server.port=5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5

  minio:
    image: quay.io/minio/minio
    container_name: jimmodel_minio
    hostname: ${MINIO_INTERNAL_HOSTNAME}
    restart: always
    volumes:
      - ${MINIO_DATA:-minio_data}:/data
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
    ports:
      - "9000:9000"
      - "9001:9001"
    command: server /data --console-address ":9001"
    healthcheck:
      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9000' || exit 1
      interval: 5s
      retries: 1
      start_period: 5s
      timeout: 5s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jimmodel-minio.rule=Host(`${MINIO_PUBLIC_HOSTNAME}`)"
      - "traefik.http.routers.jimmodel-minio.entrypoints=websecure"
      - "traefik.http.services.jimmodel-minio.loadbalancer.server.port=9000"
      - "traefik.http.routers.jimmodel-minio.service=jimmodel-minio"
      - "traefik.http.routers.jimmodel-minio.tls.certresolver=defaultresolver"

      - "traefik.http.routers.jimmodel-minio-dashboard.rule=Host(`${MINIO_DASHBOARD_PUBLIC_HOSTNAME}`)"
      - "traefik.http.routers.jimmodel-minio-dashboard.entrypoints=websecure"
      - "traefik.http.routers.jimmodel-minio-dashboard.service=jimmodel-minio-dashboard"
      - "traefik.http.services.jimmodel-minio-dashboard.loadbalancer.server.port=9001"
      - "traefik.http.routers.jimmodel-minio-dashboard.tls.certresolver=defaultresolver"
  minio-mc:
    image: minio/mc
    depends_on:
      minio:
        condition: service_healthy
    volumes:
      - ./scripts/minio-entrypoint.sh:/scripts/entrypoint.sh
    entrypoint: /scripts/entrypoint.sh
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      ACCESS_KEY: ${S3_ACCESS_KEY}
      SECRET_KEY: ${S3_SECRET_KEY}
      BUCKET_NAME: ${S3_BUCKET_NAME}
      MINIO_URL: https://${MINIO_PUBLIC_HOSTNAME}
  app:
    build:
      context: .
      args:
        - NODE_ENV=production
      target: runner
    container_name: jimmodel_app
    restart: always
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      URL: ${URL}
      DB_USER: ${DB_USER}
      DB_PASSWORD: ${DB_PASSWORD}
      DB_NAME: ${DB_NAME}
      DB_HOST: ${POSTGRES_INTERNAL_HOSTNAME}
      AUTH_SECRET: ${AUTH_SECRET}
      AUTH_TRUST_HOST: true
      S3_ACCESS_KEY: ${S3_ACCESS_KEY}
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_ENDPOINT: ${MINIO_INTERNAL_HOSTNAME}
      S3_PORT: ${S3_PORT}
      S3_BUCKET_NAME: ${S3_BUCKET_NAME}
    labels:
      - "traefik.enable=true"
      - traefik.http.routers.jimmodel-app.rule=Host(`${APP_PUBLIC_HOSTNAME}`) || Host(`www.${APP_PUBLIC_HOSTNAME}`)
      - "traefik.http.routers.jimmodel-app.entrypoints=websecure"
      - "traefik.http.services.jimmodel-app.loadbalancer.server.port=3000"
      - "traefik.http.routers.jimmodel-app.tls.certresolver=defaultresolver"
  app-initializer:
    build:
      context: .
      args:
        - NODE_ENV=production
      target: initializer-runner
    container_name: jimmodel_app_initializer
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DB_USER: ${DB_USER}
      DB_PASSWORD: ${DB_PASSWORD}
      DB_NAME: ${DB_NAME}
      DB_HOST: postgres
      ROOT_USER: ${ROOT_USER:-root}
      ROOT_PASSWORD: ${ROOT_PASSWORD:-password}
volumes:
  postgres_data:
  minio_data:
  letsencrypt: