yell/compose.yaml at main · echohello-dev/yell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# Docker Compose configuration for Yell (local development)
# Usage: docker compose up -d

version: '3.9'

services:
  traefik:
    image: traefik:latest
    container_name: yell-proxy
    restart: unless-stopped
    ports:
      - '80:80'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    user: '1000:1000'
    command:
      - --api.dashboard=true
      - --entrypoints.web.address=:80
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=yell-network
      - --log.level=INFO
    networks:
      - yell-network

  postgres:
    image: postgres:16-alpine
    container_name: yell-db
    restart: unless-stopped
    env_file: .env
    environment:
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_INITDB_ARGS: '--encoding=UTF8 --locale=en_US.UTF-8'
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - '${DB_PORT}:5432'
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /run
      - /tmp
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${DB_USER}']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - yell-network

  redis:
    image: redis:7-alpine
    container_name: yell-cache
    restart: unless-stopped
    env_file: .env
    command: redis-server --requirepass ${REDIS_PASSWORD} --appendonly yes
    volumes:
      - redis_data:/data
    ports:
      - '${REDIS_PORT}:6379'
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /run
      - /tmp
    healthcheck:
      test: ['CMD', 'redis-cli', '--raw', 'incr', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - yell-network

  web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
    image: yell:latest
    container_name: yell-web
    restart: unless-stopped
    env_file: .env
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://${DB_USER}:${DB_PASSWORD}@postgres:5432/${DB_NAME}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      PORT: 3000
      HOST: 0.0.0.0
      NODE_OPTIONS: '--max-old-space-size=512'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    tmpfs:
      - /run
      - /tmp
    user: '1000:1000'
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:3000/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    labels:
      - traefik.enable=true
      - traefik.http.routers.web.rule=Host(`${WEB_URL}`)
      - traefik.http.routers.web.entrypoints=web
      - traefik.http.services.web.loadbalancer.server.port=3000
      - traefik.http.middlewares.web-headers.headers.accesscontrolalloworiginlist=${APP_URL}
      - traefik.http.middlewares.web-headers.headers.customresponseheaders.X-Content-Type-Options=nosniff
      - traefik.http.middlewares.web-headers.headers.customresponseheaders.X-Frame-Options=DENY
      - traefik.http.middlewares.web-headers.headers.customresponseheaders.X-XSS-Protection=1; mode=block
      - traefik.http.routers.web.middlewares=web-headers
    networks:
      - yell-network

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local

networks:
  yell-network:
    driver: bridge