docker-compose.prod.yml

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║ DEPLOYMENT — TLS handled by YOUR OWN reverse proxy (stack serves HTTP)     ║
# ╚══════════════════════════════════════════════════════════════════════════╝
#
# Use this when you already run your own reverse proxy that holds the HTTPS
# certificate (e.g. on a NAS or a front server) and forwards traffic to this
# stack. The stack itself stays on plain HTTP behind that proxy.
#
# Containers: MeteorPointer-DB + MeteorPointer-API (HTTP on port 8000).
# Django trusts the proxy's X-Forwarded-Proto header, so it still knows the
# original request was HTTPS.
#
# Steps:
#   1) cp .env.example .env  and set the "Common" + "your own proxy" values, e.g.
#        DOMAIN=api.robozor.cz        # the public hostname your proxy serves
#   2) docker compose -f docker-compose.prod.yml up -d
#   3) In your proxy, forward  https://api.robozor.cz  ->  this machine, port 8000.
#      (Set API_BIND=127.0.0.1:8000 if the proxy runs on this same machine and the
#       API should not be reachable from the rest of the network.)
#
#   Address to enter in the mobile app (API server URL):  https://api.robozor.cz
#
#   Logs:  docker compose -f docker-compose.prod.yml logs -f api
#   Stop:  docker compose -f docker-compose.prod.yml down
#
# If you do NOT have your own proxy and want this stack to get and renew the
# certificate itself, use docker-compose.tls.yml instead.

name: meteorpointer

x-api-env: &api-env
  DJANGO_DEBUG: ${DJANGO_DEBUG:-false}
  DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:?set in .env}
  DJANGO_ALLOWED_HOSTS: ${DJANGO_ALLOWED_HOSTS:-localhost,127.0.0.1,api}
  DJANGO_CSRF_TRUSTED_ORIGINS: ${DJANGO_CSRF_TRUSTED_ORIGINS:-}
  DOMAIN: ${DOMAIN:-}
  JWT_SECRET: ${JWT_SECRET:?set in .env}
  POSTGRES_DB: ${POSTGRES_DB:-meteorpointer}
  POSTGRES_USER: ${POSTGRES_USER:-meteorpointer}
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
  POSTGRES_HOST: db
  POSTGRES_PORT: 5432

services:
  db:
    image: postgres:16-alpine
    container_name: MeteorPointer-DB
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-meteorpointer}
      POSTGRES_USER: ${POSTGRES_USER:-meteorpointer}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
    volumes:
      - meteorpointer_db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-meteorpointer} -d ${POSTGRES_DB:-meteorpointer}"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  api:
    image: ghcr.io/bolidozor/meteorpointer-api:${API_TAG:-latest}
    container_name: MeteorPointer-API
    environment:
      <<: *api-env
    depends_on:
      db:
        condition: service_healthy
    ports:
      # Default 0.0.0.0:8000. Set API_BIND=127.0.0.1:8000 in .env so only a
      # host proxy on this machine can reach the API.
      - "${API_BIND:-8000}:8000"
    restart: unless-stopped

volumes:
  meteorpointer_db_data: