Oier Bravo Urtasun
33b32cae4a
Ambrosio's TLS is now handled by the Traefik that NetBird's self-hosted installer deploys. kong + app attach to that Traefik network and expose themselves via Docker-provider labels (erosi-kong priority 100 for Supabase API paths, erosi-app priority 1 for everything else on erosi.limonia.net). No container publishes host ports; host Caddy is out of the deploy path permanently. Keycloak is no longer bundled — PUBLIC_KEYCLOAK_URL points at an external IdP. The deploy script writes .env with FILL_IN_* placeholders for PUBLIC_KEYCLOAK_URL, KEYCLOAK_CLIENT_SECRET, and TRAEFIK_NETWORK, and fails fast until they are filled. New domain: erosi.limonia.net. realm-export.erosi.json is retained as reference for the external Keycloak operator; it is no longer imported by this stack. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
218 lines
8.7 KiB
YAML
218 lines
8.7 KiB
YAML
name: colectivo-erosi
|
|
|
|
# Production stack for ambrosio.
|
|
# Domain: erosi.limonia.net (app + Supabase API, single-domain).
|
|
# Keycloak: external — URL set via PUBLIC_KEYCLOAK_URL in .env.
|
|
#
|
|
# TLS + reverse proxy is handled by Traefik (deployed by NetBird's self-hosted
|
|
# installer on ambrosio). `kong` and `app` attach to Traefik's Docker network
|
|
# (name in ${TRAEFIK_NETWORK}) and expose themselves via traefik.* labels.
|
|
# No container binds a host port.
|
|
#
|
|
# Bring up: docker compose -f infra/docker-compose.erosi.yml --env-file .env up -d --build
|
|
# Logs: docker compose -f infra/docker-compose.erosi.yml logs -f
|
|
# Tear down: docker compose -f infra/docker-compose.erosi.yml down
|
|
|
|
services:
|
|
|
|
# ── PostgreSQL 15 (Supabase image — internal roles preconfigured) ──────────
|
|
db:
|
|
image: supabase/postgres:15.1.1.78
|
|
restart: always
|
|
healthcheck:
|
|
test: pg_isready -U postgres -h localhost
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
environment:
|
|
POSTGRES_HOST: /var/run/postgresql
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
JWT_SECRET: ${SUPABASE_JWT_SECRET}
|
|
JWT_EXP: 3600
|
|
volumes:
|
|
- db-data:/var/lib/postgresql/data
|
|
- ./db-init:/docker-entrypoint-initdb.d:ro
|
|
networks: [colectivo]
|
|
|
|
# ── GoTrue (Supabase Auth) ─────────────────────────────────────────────────
|
|
auth:
|
|
image: supabase/gotrue:v2.158.1
|
|
restart: always
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
environment:
|
|
GOTRUE_API_HOST: "0.0.0.0"
|
|
GOTRUE_API_PORT: 9999
|
|
API_EXTERNAL_URL: ${PUBLIC_APP_URL}
|
|
GOTRUE_API_EXTERNAL_URL: ${PUBLIC_APP_URL}
|
|
GOTRUE_DB_DRIVER: postgres
|
|
GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@db:5432/postgres
|
|
GOTRUE_SITE_URL: ${PUBLIC_APP_URL}
|
|
GOTRUE_URI_ALLOW_LIST: "${PUBLIC_APP_URL}/auth/callback,${PUBLIC_APP_URL}/*"
|
|
GOTRUE_JWT_SECRET: ${SUPABASE_JWT_SECRET}
|
|
GOTRUE_JWT_EXP: 3600
|
|
GOTRUE_DISABLE_SIGNUP: "false"
|
|
GOTRUE_EXTERNAL_KEYCLOAK_ENABLED: "true"
|
|
GOTRUE_EXTERNAL_KEYCLOAK_CLIENT_ID: ${PUBLIC_KEYCLOAK_CLIENT_ID}
|
|
GOTRUE_EXTERNAL_KEYCLOAK_SECRET: ${KEYCLOAK_CLIENT_SECRET}
|
|
GOTRUE_EXTERNAL_KEYCLOAK_SCOPES: "openid profile email"
|
|
# Browser-facing Keycloak issuer URL. GoTrue appends /.well-known to it.
|
|
GOTRUE_EXTERNAL_KEYCLOAK_URL: ${PUBLIC_KEYCLOAK_URL}/realms/${PUBLIC_KEYCLOAK_REALM}
|
|
GOTRUE_EXTERNAL_KEYCLOAK_REDIRECT_URI: ${PUBLIC_SUPABASE_URL}/auth/v1/callback
|
|
GOTRUE_MAILER_AUTOCONFIRM: "true"
|
|
networks: [colectivo]
|
|
|
|
# ── PostgREST ──────────────────────────────────────────────────────────────
|
|
rest:
|
|
image: postgrest/postgrest:v12.2.0
|
|
restart: always
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
environment:
|
|
PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@db:5432/postgres
|
|
PGRST_DB_SCHEMAS: public,storage,graphql_public
|
|
PGRST_DB_ANON_ROLE: anon
|
|
PGRST_JWT_SECRET: ${SUPABASE_JWT_SECRET}
|
|
PGRST_DB_USE_LEGACY_GUCS: "false"
|
|
PGRST_APP_SETTINGS_JWT_SECRET: ${SUPABASE_JWT_SECRET}
|
|
PGRST_APP_SETTINGS_JWT_EXP: 3600
|
|
networks: [colectivo]
|
|
|
|
# ── Realtime (pinned to v2.76.5 — see CLAUDE.md note on handle_out/3) ──────
|
|
realtime:
|
|
image: supabase/realtime:v2.76.5
|
|
restart: always
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
environment:
|
|
PORT: 4000
|
|
DB_HOST: db
|
|
DB_PORT: 5432
|
|
DB_USER: supabase_admin
|
|
DB_PASSWORD: ${POSTGRES_PASSWORD}
|
|
DB_NAME: postgres
|
|
DB_AFTER_CONNECT_QUERY: SET search_path TO _realtime
|
|
DB_ENC_KEY: ${REALTIME_ENC_KEY}
|
|
API_JWT_SECRET: ${SUPABASE_JWT_SECRET}
|
|
SELF_HOST_TENANT_NAME: realtime
|
|
SEED_SELF_HOST: "true"
|
|
RUN_JANITOR: "true"
|
|
APP_NAME: realtime
|
|
SECRET_KEY_BASE: ${REALTIME_SECRET_KEY_BASE}
|
|
ERL_AFLAGS: -proto_dist inet_tcp
|
|
DNS_NODES: "''"
|
|
RLIMIT_NOFILE: "10000"
|
|
METRICS_JWT_SECRET: ${SUPABASE_JWT_SECRET}
|
|
networks: [colectivo]
|
|
|
|
# ── Storage ────────────────────────────────────────────────────────────────
|
|
storage:
|
|
image: supabase/storage-api:v1.11.13
|
|
restart: always
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
rest: { condition: service_started }
|
|
environment:
|
|
ANON_KEY: ${PUBLIC_SUPABASE_ANON_KEY}
|
|
SERVICE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
|
|
POSTGREST_URL: http://rest:3000
|
|
PGRST_JWT_SECRET: ${SUPABASE_JWT_SECRET}
|
|
DATABASE_URL: postgres://supabase_storage_admin:${POSTGRES_PASSWORD}@db:5432/postgres
|
|
FILE_SIZE_LIMIT: 52428800
|
|
STORAGE_BACKEND: file
|
|
FILE_STORAGE_BACKEND_PATH: /var/lib/storage
|
|
TENANT_ID: colectivo-erosi
|
|
REGION: local
|
|
GLOBAL_S3_BUCKET: stub
|
|
ENABLE_IMAGE_TRANSFORMATION: "true"
|
|
IMGPROXY_URL: http://imgproxy:5001
|
|
volumes:
|
|
- storage-data:/var/lib/storage
|
|
networks: [colectivo]
|
|
|
|
# ── ImgProxy ───────────────────────────────────────────────────────────────
|
|
imgproxy:
|
|
image: darthsim/imgproxy:v3.8.0
|
|
restart: always
|
|
environment:
|
|
IMGPROXY_BIND: ":5001"
|
|
IMGPROXY_LOCAL_FILESYSTEM_ROOT: /
|
|
IMGPROXY_USE_ETAG: "true"
|
|
IMGPROXY_ENABLE_WEBP_DETECTION: "true"
|
|
volumes:
|
|
- storage-data:/var/lib/storage:ro
|
|
networks: [colectivo]
|
|
|
|
# ── Kong (API Gateway) — exposed on the Traefik network via labels ────────
|
|
kong:
|
|
image: kong:2.8.1
|
|
restart: always
|
|
entrypoint: ["/bin/bash", "/home/kong/kong-start.sh"]
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
environment:
|
|
KONG_DATABASE: "off"
|
|
KONG_DECLARATIVE_CONFIG: /home/kong/kong.yml
|
|
KONG_DNS_ORDER: LAST,A,CNAME
|
|
KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth,rate-limiting
|
|
KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
|
|
KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
|
|
SUPABASE_ANON_KEY: ${PUBLIC_SUPABASE_ANON_KEY}
|
|
SUPABASE_SERVICE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
|
|
volumes:
|
|
- ./kong.yml:/home/kong/temp.yml:ro
|
|
- ./kong-start.sh:/home/kong/kong-start.sh:ro
|
|
networks: [colectivo, traefik]
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=${TRAEFIK_NETWORK}"
|
|
- "traefik.http.routers.erosi-kong.rule=Host(`erosi.limonia.net`) && (PathPrefix(`/rest/v1`) || PathPrefix(`/auth/v1`) || PathPrefix(`/realtime/v1`) || PathPrefix(`/storage/v1`) || PathPrefix(`/graphql/v1`) || PathPrefix(`/pg`))"
|
|
- "traefik.http.routers.erosi-kong.entrypoints=${TRAEFIK_ENTRYPOINT}"
|
|
- "traefik.http.routers.erosi-kong.tls.certresolver=${TRAEFIK_CERTRESOLVER}"
|
|
- "traefik.http.routers.erosi-kong.priority=100"
|
|
- "traefik.http.services.erosi-kong.loadbalancer.server.port=8000"
|
|
|
|
# ── App (SvelteKit Node server) — built on the host from the repo ──────────
|
|
# Build args bake the PUBLIC_* values into the client bundle (SvelteKit reqs).
|
|
app:
|
|
image: colectivo-web:erosi
|
|
build:
|
|
context: ..
|
|
dockerfile: apps/web/Dockerfile
|
|
args:
|
|
PUBLIC_SUPABASE_URL: ${PUBLIC_SUPABASE_URL}
|
|
PUBLIC_SUPABASE_ANON_KEY: ${PUBLIC_SUPABASE_ANON_KEY}
|
|
PUBLIC_KEYCLOAK_URL: ${PUBLIC_KEYCLOAK_URL}
|
|
PUBLIC_KEYCLOAK_REALM: ${PUBLIC_KEYCLOAK_REALM}
|
|
PUBLIC_KEYCLOAK_CLIENT_ID: ${PUBLIC_KEYCLOAK_CLIENT_ID}
|
|
PUBLIC_APP_URL: ${PUBLIC_APP_URL}
|
|
restart: always
|
|
environment:
|
|
PUBLIC_SUPABASE_URL: ${PUBLIC_SUPABASE_URL}
|
|
PUBLIC_SUPABASE_ANON_KEY: ${PUBLIC_SUPABASE_ANON_KEY}
|
|
PUBLIC_KEYCLOAK_URL: ${PUBLIC_KEYCLOAK_URL}
|
|
PUBLIC_KEYCLOAK_REALM: ${PUBLIC_KEYCLOAK_REALM}
|
|
PUBLIC_KEYCLOAK_CLIENT_ID: ${PUBLIC_KEYCLOAK_CLIENT_ID}
|
|
PUBLIC_APP_URL: ${PUBLIC_APP_URL}
|
|
NODE_ENV: production
|
|
networks: [colectivo, traefik]
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=${TRAEFIK_NETWORK}"
|
|
- "traefik.http.routers.erosi-app.rule=Host(`erosi.limonia.net`)"
|
|
- "traefik.http.routers.erosi-app.entrypoints=${TRAEFIK_ENTRYPOINT}"
|
|
- "traefik.http.routers.erosi-app.tls.certresolver=${TRAEFIK_CERTRESOLVER}"
|
|
- "traefik.http.routers.erosi-app.priority=1"
|
|
- "traefik.http.services.erosi-app.loadbalancer.server.port=3000"
|
|
|
|
networks:
|
|
colectivo:
|
|
driver: bridge
|
|
traefik:
|
|
name: ${TRAEFIK_NETWORK}
|
|
external: true
|
|
|
|
volumes:
|
|
db-data:
|
|
storage-data:
|