admin
2d0e390c76
Step 2/2 (Audit Gitea #17). NPM's proxy host now forwards to pawfeed:3000 over the shared nginx_default Docker network (verified working in the previous deploy), so the app no longer needs a published host port at all — it was reachable unencrypted on the LAN, bypassing Cloudflare's TLS termination and protections entirely.
41 lines
1.0 KiB
YAML
41 lines
1.0 KiB
YAML
services:
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: pawfeed-redis
|
|
restart: unless-stopped
|
|
volumes:
|
|
- redis_data:/data
|
|
command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
|
|
|
|
pawfeed:
|
|
build:
|
|
context: ..
|
|
dockerfile: docker/Dockerfile
|
|
args:
|
|
# Only public vars needed at build time (baked into client bundle).
|
|
# Docker Compose reads these from docker/.env automatically.
|
|
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY}
|
|
NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
|
|
NEXT_PUBLIC_SENTRY_DSN: ${NEXT_PUBLIC_SENTRY_DSN}
|
|
image: pawfeed:latest
|
|
container_name: pawfeed
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
NODE_ENV: production
|
|
REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
|
|
depends_on:
|
|
- redis
|
|
networks:
|
|
- default
|
|
- nginx_default
|
|
|
|
volumes:
|
|
redis_data:
|
|
|
|
networks:
|
|
default:
|
|
nginx_default:
|
|
external: true
|