admin
ebc5267f35
Redis had no auth, defended only by not being port-mapped to the host. Defense-in-depth per the audit — REDIS_PASSWORD is generated server-side in docker/.env (not committed) and threaded through to both the redis service's --requirepass and the app's REDIS_URL.
35 lines
947 B
YAML
35 lines
947 B
YAML
services:
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: pawfeed-redis
|
|
restart: unless-stopped
|
|
volumes:
|
|
- redis_data:/data
|
|
command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
|
|
|
|
pawfeed:
|
|
build:
|
|
context: ..
|
|
dockerfile: docker/Dockerfile
|
|
args:
|
|
# Only public vars needed at build time (baked into client bundle).
|
|
# Docker Compose reads these from docker/.env automatically.
|
|
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY}
|
|
NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
|
|
NEXT_PUBLIC_SENTRY_DSN: ${NEXT_PUBLIC_SENTRY_DSN}
|
|
image: pawfeed:latest
|
|
container_name: pawfeed
|
|
restart: unless-stopped
|
|
ports:
|
|
- "4563:3000"
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
NODE_ENV: production
|
|
REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
|
|
depends_on:
|
|
- redis
|
|
|
|
volumes:
|
|
redis_data:
|