sakshamandClaude Sonnet 5
3d6fe56991
Local dev gets an unauthenticated Adminer instance bound to loopback only. In production, any account with is_admin=true can open it - the app mints a short-lived token from a live admin session, which Nginx's new db.ciagent.org block exchanges for a session cookie that re-checks admin status on every request, instead of a shared static password that wouldn't scale to multiple admins or revoke live. Co-Authored-By: Claude Sonnet 5 <[email protected]>
128 lines
3.4 KiB
YAML
128 lines
3.4 KiB
YAML
name: ci-agent
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ciagent
|
|
POSTGRES_PASSWORD: ciagent
|
|
POSTGRES_DB: ciagent
|
|
ports:
|
|
- "5432:5432"
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ciagent -d ciagent"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
ports:
|
|
- "6379:6379"
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: infrastructure/docker/api.Dockerfile
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
DATABASE_URL: postgresql+psycopg://ciagent:ciagent@postgres:5432/ciagent
|
|
REDIS_URL: redis://redis:6379/0
|
|
ports:
|
|
- "8000:8000"
|
|
volumes:
|
|
- ./apps/api:/app
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
command: >
|
|
sh -c "alembic upgrade head &&
|
|
uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload"
|
|
|
|
worker:
|
|
build:
|
|
context: .
|
|
dockerfile: infrastructure/docker/api.Dockerfile
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
DATABASE_URL: postgresql+psycopg://ciagent:ciagent@postgres:5432/ciagent
|
|
REDIS_URL: redis://redis:6379/0
|
|
volumes:
|
|
- ./apps/api:/app
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
command: celery -A app.tasks.celery_app worker --loglevel=INFO -Q default,collection,analysis,notifications,maintenance,enrichment
|
|
|
|
beat:
|
|
build:
|
|
context: .
|
|
dockerfile: infrastructure/docker/api.Dockerfile
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
DATABASE_URL: postgresql+psycopg://ciagent:ciagent@postgres:5432/ciagent
|
|
REDIS_URL: redis://redis:6379/0
|
|
volumes:
|
|
- ./apps/api:/app
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
command: celery -A app.tasks.celery_app beat --loglevel=INFO
|
|
|
|
web:
|
|
build:
|
|
context: .
|
|
dockerfile: infrastructure/docker/web.Dockerfile
|
|
restart: unless-stopped
|
|
environment:
|
|
# Baked into the browser bundle - must be an address the *browser*
|
|
# (not the container) can reach, so a LAN client needs this set to
|
|
# the host machine's LAN IP, not localhost. See .env.example.
|
|
NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8000}
|
|
# "Git Repository" landing-page link - blank here so the frontend
|
|
# falls back to its own hardcoded default (the canonical upstream
|
|
# repo). Only set this to point the button at a different git server.
|
|
NEXT_PUBLIC_GIT_REPO_URL: ${NEXT_PUBLIC_GIT_REPO_URL:-}
|
|
ports:
|
|
- "3000:3000"
|
|
volumes:
|
|
- ./apps/web:/app
|
|
- /app/node_modules
|
|
- /app/.next
|
|
depends_on:
|
|
- api
|
|
|
|
adminer:
|
|
image: adminer:4.8.1-standalone
|
|
restart: unless-stopped
|
|
environment:
|
|
ADMINER_DEFAULT_SERVER: postgres
|
|
ports:
|
|
# Loopback-only, matching this app's loopback-trust philosophy - not
|
|
# meant to be reachable from the LAN. See Settings -> Database.
|
|
- "127.0.0.1:8081:8080"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
|
|
volumes:
|
|
postgres-data:
|