72 lines
2.6 KiB
YAML
72 lines
2.6 KiB
YAML
# Compose-Service für eldov.win.
|
|
# Host: free-warez.win (gleicher VPS-Cluster wie w-make.com).
|
|
# Traefik routet eldov.win per Docker-Labels zum Container.
|
|
#
|
|
# Auf dem VPS muss liegen:
|
|
# - Traefik-Netzwerk 'proxy' (vom traefik3-crowdsec-stack Container erstellt)
|
|
# - .env.local mit ADMIN_PASSWORD + SESSION_SECRET
|
|
# - Volume 'eldov_data' für die SQLite-DB
|
|
|
|
services:
|
|
app:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-https://eldov.win}
|
|
image: eldov-portfolio:1.0.0
|
|
container_name: eldov-portfolio
|
|
mem_limit: 512m
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env.local
|
|
environment:
|
|
- NODE_ENV=production
|
|
- NEXT_TELEMETRY_DISABLED=1
|
|
- DB_PATH=/app/data/eldov.db
|
|
# Hinter Traefik: X-Forwarded-For für Rate-Limiting vertrauen
|
|
- TRUST_PROXY_HEADERS=true
|
|
volumes:
|
|
- eldov_data:/app/data
|
|
expose:
|
|
- "3000"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/').then(r=>process.exit(r.ok||r.status===307?0:1)).catch(()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
networks:
|
|
- default
|
|
- proxy
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=proxy"
|
|
- "traefik.http.routers.eldov-win.rule=Host(`eldov.win`) || Host(`www.eldov.win`)"
|
|
- "traefik.http.routers.eldov-win.priority=100"
|
|
- "traefik.http.routers.eldov-win.entrypoints=websecure"
|
|
- "traefik.http.routers.eldov-win.tls=true"
|
|
- "traefik.http.routers.eldov-win.tls.certresolver=http_resolver"
|
|
- "traefik.http.routers.eldov-win.middlewares=my-get-real-ip@file,default@file,crowdsec-bouncer-plugin@file"
|
|
- "traefik.http.routers.eldov-win.service=eldov-win"
|
|
- "traefik.http.services.eldov-win.loadbalancer.server.port=3000"
|
|
- "com.centurylinklabs.watchtower.enable=false"
|
|
# HTTP→HTTPS-Redirect für die unverschlüsselte Variante (Traefik
|
|
# bringt dafür eine eingebaute redirectScheme-Middleware mit).
|
|
- "traefik.http.routers.eldov-win-http.rule=Host(`eldov.win`) || Host(`www.eldov.win`)"
|
|
- "traefik.http.routers.eldov-win-http.entrypoints=web"
|
|
- "traefik.http.routers.eldov-win-http.middlewares=redirect-to-https"
|
|
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
|
|
- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
|
|
|
|
volumes:
|
|
eldov_data:
|
|
name: eldov_data
|
|
|
|
networks:
|
|
proxy:
|
|
name: proxy
|
|
external: true
|