Giorgio Gilestro
83ffa7dbf8
Networking: the superadmin console now mirrors `app` instead of a loopback-only host port. Base compose drops the host port; the dev override binds 127.0.0.1:8091; the prod overlay joins the `intranet` network and listens on :80 with --proxy-headers so NPM can proxy it. CLI: add `purge-test-users` (dry-run by default, --commit to delete, --keep allow-list defaulting to the real accounts). Deletes child rows explicitly (DB-agnostic) plus email-keyed OTPs, so smoke-test signups that were pointed at prod can be cleaned repeatably instead of via ad-hoc SQL. Covered by 6 new tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
66 lines
3.1 KiB
YAML
66 lines
3.1 KiB
YAML
# Production overlay. Applied on the VPS with:
|
|
#
|
|
# docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
|
|
#
|
|
# Drops the host port binding entirely and joins the `intranet` external
|
|
# Docker network so a front-side proxy (Nginx Proxy Manager) on the same
|
|
# network can reach the container directly. The app listens on port 80
|
|
# inside the container so NPM upstreams are uniform across services
|
|
# (always `<container-name>:80`).
|
|
#
|
|
# The local-dev compose (just `docker-compose.yml` alone) still binds to
|
|
# the host port from `.env` / CASSANDRA_PORT — unchanged.
|
|
|
|
services:
|
|
app:
|
|
# --proxy-headers makes Starlette honour X-Forwarded-Proto / -For from
|
|
# NPM, so request.url_for() generates https:// URLs (otherwise static
|
|
# asset links render as http://… and browsers block as mixed content).
|
|
# --forwarded-allow-ips=* is safe here: the container has no host port,
|
|
# only the intranet bridge reaches it.
|
|
command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "80",
|
|
"--workers", "1", "--proxy-headers", "--forwarded-allow-ips=*"]
|
|
expose:
|
|
- "80"
|
|
networks:
|
|
- default
|
|
- intranet
|
|
# The shared `intranet` network has many other containers aliased as
|
|
# `db` and `redis`; Docker's embedded DNS would pick one of those
|
|
# before ours. Use the project-prefixed container names instead —
|
|
# those are globally unique on the daemon.
|
|
environment:
|
|
DATABASE_URL: mysql+aiomysql://${MARIADB_USER:-cassandra}:${MARIADB_PASSWORD:-changeme}@readmarkets-db-1:3306/${MARIADB_DATABASE:-cassandra}
|
|
REDIS_URL: redis://readmarkets-redis-1:6379/0
|
|
|
|
scheduler:
|
|
# Scheduler isn't fronted by NPM, so it doesn't need intranet — but
|
|
# it does share the same DNS-collision problem on `default` (it only
|
|
# joins `default`, where our `db` alias would normally win… except
|
|
# the scheduler too is multi-network if you ever decide to expose
|
|
# its health endpoint via NPM). Future-proofing: use the explicit
|
|
# container names here too.
|
|
environment:
|
|
DATABASE_URL: mysql+aiomysql://${MARIADB_USER:-cassandra}:${MARIADB_PASSWORD:-changeme}@readmarkets-db-1:3306/${MARIADB_DATABASE:-cassandra}
|
|
REDIS_URL: redis://readmarkets-redis-1:6379/0
|
|
|
|
admin:
|
|
# Fronted by NPM like `app`: listen on 80 and join the `intranet` network
|
|
# so the proxy can reach it as `readmarkets-admin-1:80`. No host port.
|
|
# --proxy-headers so redirect/asset URLs honour X-Forwarded-Proto from NPM.
|
|
# Still gated by ADMIN_CONSOLE_PASSWORD; add an NPM access rule in front for
|
|
# a second layer. Project-prefixed DB name avoids the shared-network `db`
|
|
# DNS collision (same reason as app/scheduler).
|
|
command: ["uvicorn", "admin.main:app", "--host", "0.0.0.0", "--port", "80",
|
|
"--workers", "1", "--proxy-headers", "--forwarded-allow-ips=*"]
|
|
expose:
|
|
- "80"
|
|
networks:
|
|
- default
|
|
- intranet
|
|
environment:
|
|
DATABASE_URL: mysql+aiomysql://${MARIADB_USER:-cassandra}:${MARIADB_PASSWORD:-changeme}@readmarkets-db-1:3306/${MARIADB_DATABASE:-cassandra}
|
|
|
|
networks:
|
|
intranet:
|
|
external: true
|