docker-compose.prod.yml

services:
  bugzkit-api:
    image: while1618/bugzkit-api:1.0.0
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    environment:
      APP_NAME: ${APP_NAME:-bugzkit}
      API_PORT: ${API_PORT:-8080}
      UI_URL: ${UI_URL:-https://bugzkit.com}
      DOMAIN_NAME: ${DOMAIN_NAME:-.bugzkit.com}
      POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
      POSTGRES_DATABASE: ${POSTGRES_DATABASE:-bugzkit}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_DATABASE: ${REDIS_DATABASE:-0}
      SMTP_HOST: ${SMTP_HOST:-smtp.resend.com}
      SMTP_PORT: ${SMTP_PORT:-2587}
      SMTP_USER: ${SMTP_USER:-resend}
      SMTP_SENDER: ${SMTP_SENDER:-noreply@bugzkit.com}
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
      ACCESS_TOKEN_DURATION: ${ACCESS_TOKEN_DURATION:-900}
      REFRESH_TOKEN_DURATION: ${REFRESH_TOKEN_DURATION:-604800}
      VERIFY_EMAIL_TOKEN_DURATION: ${VERIFY_EMAIL_TOKEN_DURATION:-900}
      RESET_PASSWORD_TOKEN_DURATION: ${RESET_PASSWORD_TOKEN_DURATION:-900}
    secrets:
      - postgres_password
      - redis_password
      - user_password
      - smtp_password
      - jwt_secret
      - google_client_id
      - google_client_secret
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "curl",
          "-f",
          "http://localhost:${API_PORT:-8080}/actuator/health",
        ]
      start_period: 60s
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - web
    labels:
      - traefik.enable=true
      - traefik.http.routers.bugzkit-api.rule=Host(`api.bugzkit.com`)
      - traefik.http.routers.bugzkit-api.entrypoints=websecure
      - traefik.http.routers.bugzkit-api.tls=true
      - traefik.http.services.bugzkit-api.loadbalancer.server.port=8080
      - traefik.http.routers.bugzkit-api.tls.certresolver=myresolver
      - traefik.http.routers.bugzkit-api.middlewares=security-headers

  postgres:
    image: postgres:17.9-alpine
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
      - /var/run/postgresql
    environment:
      PGPORT: ${POSTGRES_PORT:-5432}
      POSTGRES_DB: ${POSTGRES_DATABASE:-bugzkit}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_password
    healthcheck:
      test:
        [
          "CMD",
          "pg_isready",
          "-U",
          "${POSTGRES_USER:-postgres}",
          "-d",
          "${POSTGRES_DATABASE:-bugzkit}",
        ]
      start_period: 10s
      interval: 30s
      timeout: 10s
      retries: 3
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - web

  redis:
    image: valkey/valkey:9.0.3-alpine
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    environment:
      REDIS_PORT: ${REDIS_PORT:-6379}
    command:
      [
        "sh",
        "-c",
        "redis-server --port $$REDIS_PORT --requirepass $$(cat /run/secrets/redis_password)",
      ]
    secrets:
      - redis_password
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "redis-cli -h localhost -p $$REDIS_PORT -a $$(cat /run/secrets/redis_password) ping",
        ]
      start_period: 10s
      interval: 30s
      timeout: 10s
      retries: 3
    volumes:
      - redis_data:/data
    networks:
      - web

  bugzkit-ui:
    image: while1618/bugzkit-ui:1.0.0
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    environment:
      PORT: ${UI_PORT:-5173}
      ORIGIN: ${UI_URL:-https://bugzkit.com}
      PROTOCOL_HEADER: x-forwarded-proto
      HOST_HEADER: x-forwarded-host
      PUBLIC_APP_NAME: ${APP_NAME:-bugzkit}
      PUBLIC_API_URL: http://bugzkit-api:${API_PORT:-8080}
      DOMAIN_NAME: ${DOMAIN_NAME:-.bugzkit.com}
    secrets:
      - jwt_secret
    command:
      - sh
      - -c
      - |
        export JWT_SECRET="$$(cat /run/secrets/jwt_secret)" && \
        exec node build
    depends_on:
      bugzkit-api:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:${UI_PORT:-5173}"]
      start_period: 10s
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - web
    labels:
      - traefik.enable=true
      - traefik.http.routers.bugzkit-ui.rule=Host(`bugzkit.com`) || Host(`www.bugzkit.com`)
      - traefik.http.routers.bugzkit-ui.entrypoints=websecure
      - traefik.http.routers.bugzkit-ui.tls=true
      - traefik.http.services.bugzkit-ui.loadbalancer.server.port=5173
      - traefik.http.routers.bugzkit-ui.tls.certresolver=myresolver
      - traefik.http.routers.bugzkit-ui.middlewares=security-headers
      - traefik.http.middlewares.security-headers.headers.frameDeny=true
      - traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true

  socket-proxy:
    image: tecnativa/docker-socket-proxy:v0.4.2
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /run
      - /tmp
    environment:
      CONTAINERS: 1
      NETWORKS: 1
      POST: 0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:2375/version"]
      start_period: 5s
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - socket-proxy

  traefik:
    image: traefik:v3.6.1
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - letsencrypt:/letsencrypt
    depends_on:
      socket-proxy:
        condition: service_healthy
    command:
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --providers.docker=true
      - --providers.docker.endpoint=tcp://socket-proxy:2375
      - --providers.docker.network=web
      - --providers.docker.exposedbydefault=false
      - --certificatesresolvers.myresolver.acme.email=office@bugzkit.com
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web
    networks:
      - web
      - socket-proxy

volumes:
  postgres_data:
  redis_data:
  letsencrypt:

networks:
  web:
  socket-proxy:
    internal: true

secrets:
  postgres_password:
    file: ./secrets/postgres_password
  redis_password:
    file: ./secrets/redis_password
  jwt_secret:
    file: ./secrets/jwt_secret
  smtp_password:
    file: ./secrets/smtp_password
  user_password:
    file: ./secrets/user_password
  google_client_id:
    file: ./secrets/google_client_id
  google_client_secret:
    file: ./secrets/google_client_secret