B0rbor4d
cf7c29639c
Backend: config/db/security/logging core, SQLAlchemy models (Server, Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh, cau, audit, job_runner), REST API (auth, servers, updates, audit), Socket.io WebSocket layer. Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers, Updates, Audit, Login), axios + socket.io-client, nginx prod config.
138 lines
4.3 KiB
YAML
138 lines
4.3 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
# ---------------------------------------------------------------
|
|
# Backend - FastAPI (Production)
|
|
# ---------------------------------------------------------------
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
target: production
|
|
container_name: insight-updater-backend
|
|
restart: unless-stopped
|
|
environment:
|
|
- APP_ENV=production
|
|
- DATABASE_URL=postgresql+asyncpg://${DB_USER}:${DB_PASSWORD}@db:5432/${DB_NAME}
|
|
- REDIS_URL=redis://redis:6379/0
|
|
- SECRET_KEY=${SECRET_KEY}
|
|
- ENCRYPTION_KEY=${ENCRYPTION_KEY}
|
|
- JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
|
|
- JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
|
|
- WINRM_TRANSPORT=${WINRM_TRANSPORT:-ntlm}
|
|
- WINRM_CERT_VALIDATION=${WINRM_CERT_VALIDATION:-validate}
|
|
- LDAP_ENABLED=${LDAP_ENABLED:-false}
|
|
- LDAP_URI=${LDAP_URI}
|
|
- LDAP_BIND_DN=${LDAP_BIND_DN}
|
|
- LDAP_BIND_PASSWORD=${LDAP_BIND_PASSWORD}
|
|
- LDAP_USER_SEARCH_BASE=${LDAP_USER_SEARCH_BASE}
|
|
- LDAP_USER_FILTER=${LDAP_USER_FILTER}
|
|
- LOG_LEVEL=${LOG_LEVEL:-INFO}
|
|
- LOG_FORMAT=json
|
|
volumes:
|
|
- ./data:/app/data
|
|
- ./keys:/app/keys:ro
|
|
- ./certs:/app/certs:ro
|
|
networks:
|
|
- internal
|
|
- traefik-public
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1.0'
|
|
memory: 1G
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 256M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 20s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik-public"
|
|
- "traefik.http.routers.updater-api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)"
|
|
- "traefik.http.routers.updater-api.entrypoints=websecure"
|
|
- "traefik.http.routers.updater-api.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.updater-api.loadbalancer.server.port=8000"
|
|
- "traefik.http.routers.updater-ws.rule=Host(`${DOMAIN}`) && PathPrefix(`/ws`)"
|
|
- "traefik.http.routers.updater-ws.entrypoints=websecure"
|
|
- "traefik.http.routers.updater-ws.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.updater-ws.loadbalancer.server.port=8000"
|
|
|
|
# ---------------------------------------------------------------
|
|
# Frontend - Nginx (Production)
|
|
# ---------------------------------------------------------------
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile
|
|
target: production
|
|
container_name: insight-updater-frontend
|
|
restart: unless-stopped
|
|
networks:
|
|
- internal
|
|
- traefik-public
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik-public"
|
|
- "traefik.http.routers.updater-web.rule=Host(`${DOMAIN}`)"
|
|
- "traefik.http.routers.updater-web.entrypoints=websecure"
|
|
- "traefik.http.routers.updater-web.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.updater-web.loadbalancer.server.port=80"
|
|
|
|
# ---------------------------------------------------------------
|
|
# Redis - Pub/Sub, Caching, Rate Limiting
|
|
# ---------------------------------------------------------------
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: insight-updater-redis
|
|
restart: unless-stopped
|
|
command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
|
|
volumes:
|
|
- redis-data:/data
|
|
networks:
|
|
- internal
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 3
|
|
|
|
# ---------------------------------------------------------------
|
|
# PostgreSQL - Production Database
|
|
# ---------------------------------------------------------------
|
|
db:
|
|
image: postgres:16-alpine
|
|
container_name: insight-updater-db
|
|
restart: unless-stopped
|
|
environment:
|
|
- POSTGRES_DB=${DB_NAME}
|
|
- POSTGRES_USER=${DB_USER}
|
|
- POSTGRES_PASSWORD=${DB_PASSWORD}
|
|
volumes:
|
|
- pg-data:/var/lib/postgresql/data
|
|
networks:
|
|
- internal
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 3
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.5'
|
|
memory: 512M
|
|
|
|
networks:
|
|
internal:
|
|
driver: bridge
|
|
traefik-public:
|
|
external: true
|
|
|
|
volumes:
|
|
redis-data:
|
|
pg-data: |