Esa Kataja
c6a8532569
With dev and prod open side by side in the same browser, the tabs were indistinguishable. ENV is written into the title of every page unless it says prod, so "dev · Foodster" picks itself out. The value is used verbatim, so ENV=staging labels itself too, and prod and production both count as unmarked so a stray capital cannot tag the real instance. Environment variables lose their prefix: PASSWORD, DB, ENV, ADDR, HOST, REPO, TAG. The container namespaces them already, and this matches how the other services here are configured. PUID/PGID are the exception rather than UID/GID. UID is read-only in bash, so a value set in .env would be silently replaced by the invoking shell's own and compose's user: would ignore what was asked for. Breaking for a running instance: the deployed .env has to be rewritten in the same deploy, or the app will refuse to start on an unset PASSWORD.
39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
services:
|
|
app:
|
|
image: ${REPO:?set REPO in .env}:${TAG:-latest}
|
|
restart: unless-stopped
|
|
|
|
# A bind mount rather than a named volume: the database sits in ./data on
|
|
# the host, where it can be listed, copied and backed up without going
|
|
# through the container engine. The image runs as UID 65534, so the
|
|
# container has to be told which host user owns that directory.
|
|
#
|
|
# PUID/PGID rather than UID/GID: UID is a read-only variable in bash, so a
|
|
# value set here would be silently replaced by the invoking shell's own.
|
|
user: "${PUID:-1000}:${PGID:-1000}"
|
|
volumes:
|
|
- ./data:/data
|
|
|
|
environment:
|
|
PASSWORD: ${PASSWORD:?set PASSWORD in .env}
|
|
DB: /data/foodster.db
|
|
ENV: ${ENV:-prod}
|
|
TZ: ${TZ:-Europe/Helsinki}
|
|
|
|
# No published ports: Traefik reaches the container over the shared
|
|
# network. Publishing 8080 as well would put an unencrypted copy of the
|
|
# app on the host, bypassing TLS.
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.foodster.entrypoints=websecure
|
|
- traefik.http.routers.foodster.rule=Host(`${HOST:?set HOST in .env}`)
|
|
- traefik.http.routers.foodster.tls=true
|
|
- traefik.http.services.foodster.loadbalancer.server.port=8080
|
|
- traefik.docker.network=traefik
|
|
networks:
|
|
- traefik
|
|
|
|
networks:
|
|
traefik:
|
|
external: true
|