olsch01
8e58d04568
APP_URL was never passed to the backend container, causing Stripe checkout success_url to redirect to http://localhost instead of the production domain. The prod overlay also completely replaced the base environment block, dropping all Stripe, SSO, WebAuthn, and invite token variables. - Add APP_URL to base docker-compose.yml (default: http://localhost) - Add all missing vars to docker-compose.prod.yml with production defaults (app.hoaledgeriq.com) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
112 lines
4.2 KiB
YAML
112 lines
4.2 KiB
YAML
# Production override — use with:
|
|
# docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
|
|
#
|
|
# What this changes from the base (dev) config:
|
|
# - Disables the Docker nginx container (host nginx handles routing + SSL)
|
|
# - Backend: production Dockerfile (compiled JS, no watch, no devDeps)
|
|
# - Frontend: production Dockerfile (static build served by nginx on port 3001)
|
|
# - Backend + Frontend bound to 127.0.0.1 only (host nginx proxies to them)
|
|
# - No source-code volume mounts (uses baked-in built code)
|
|
# - Memory limits and health checks on backend
|
|
# - Tuned PostgreSQL for production workloads
|
|
# - Restart policies for reliability
|
|
#
|
|
# SSL/TLS and request routing are handled by the host-level nginx.
|
|
# See nginx/host-production.conf for a ready-to-use reference config.
|
|
|
|
services:
|
|
nginx:
|
|
# Disabled in production — host nginx handles routing + SSL directly.
|
|
# The dev-only Docker nginx is still used by the base docker-compose.yml.
|
|
deploy:
|
|
replicas: 0
|
|
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile # production Dockerfile (compiled JS)
|
|
ports:
|
|
- "127.0.0.1:3000:3000" # loopback only — host nginx proxies here
|
|
volumes: [] # override: no source mounts in prod
|
|
environment:
|
|
- DATABASE_URL=${DATABASE_URL}
|
|
- REDIS_URL=${REDIS_URL}
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- NODE_ENV=production
|
|
- AI_API_URL=${AI_API_URL}
|
|
- AI_API_KEY=${AI_API_KEY}
|
|
- AI_MODEL=${AI_MODEL}
|
|
- AI_DEBUG=${AI_DEBUG:-false}
|
|
- NEW_RELIC_ENABLED=${NEW_RELIC_ENABLED:-false}
|
|
- NEW_RELIC_LICENSE_KEY=${NEW_RELIC_LICENSE_KEY:-}
|
|
- NEW_RELIC_APP_NAME=${NEW_RELIC_APP_NAME:-HOALedgerIQ_App}
|
|
- STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY:-}
|
|
- STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET:-}
|
|
- STRIPE_STARTER_PRICE_ID=${STRIPE_STARTER_PRICE_ID:-}
|
|
- STRIPE_PROFESSIONAL_PRICE_ID=${STRIPE_PROFESSIONAL_PRICE_ID:-}
|
|
- STRIPE_ENTERPRISE_PRICE_ID=${STRIPE_ENTERPRISE_PRICE_ID:-}
|
|
- GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
|
|
- GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
|
|
- GOOGLE_CALLBACK_URL=${GOOGLE_CALLBACK_URL:-https://app.hoaledgeriq.com/api/auth/google/callback}
|
|
- AZURE_CLIENT_ID=${AZURE_CLIENT_ID:-}
|
|
- AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET:-}
|
|
- AZURE_TENANT_ID=${AZURE_TENANT_ID:-}
|
|
- AZURE_CALLBACK_URL=${AZURE_CALLBACK_URL:-https://app.hoaledgeriq.com/api/auth/azure/callback}
|
|
- WEBAUTHN_RP_ID=${WEBAUTHN_RP_ID:-app.hoaledgeriq.com}
|
|
- WEBAUTHN_RP_ORIGIN=${WEBAUTHN_RP_ORIGIN:-https://app.hoaledgeriq.com}
|
|
- INVITE_TOKEN_SECRET=${INVITE_TOKEN_SECRET:-}
|
|
- APP_URL=${APP_URL:-https://app.hoaledgeriq.com}
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 1024M
|
|
reservations:
|
|
memory: 256M
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api || exit 1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
restart: unless-stopped
|
|
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile # production Dockerfile (static nginx)
|
|
ports:
|
|
- "127.0.0.1:3001:3001" # loopback only — host nginx proxies here
|
|
volumes: [] # override: no source mounts in prod
|
|
environment:
|
|
- NODE_ENV=production
|
|
restart: unless-stopped
|
|
|
|
postgres:
|
|
# Tune PostgreSQL for production workloads
|
|
command: >
|
|
postgres
|
|
-c max_connections=200
|
|
-c shared_buffers=256MB
|
|
-c effective_cache_size=512MB
|
|
-c work_mem=4MB
|
|
-c maintenance_work_mem=64MB
|
|
-c checkpoint_completion_target=0.9
|
|
-c wal_buffers=16MB
|
|
-c random_page_cost=1.1
|
|
# No host port mapping — backend reaches postgres via the Docker network.
|
|
# Removes 2 docker-proxy processes and closes 0.0.0.0:5432 to the internet.
|
|
ports: []
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 1024M
|
|
reservations:
|
|
memory: 512M
|
|
restart: unless-stopped
|
|
|
|
redis:
|
|
# No host port mapping — backend reaches redis via the Docker network.
|
|
# Removes 2 docker-proxy processes and closes 0.0.0.0:6379 to the internet.
|
|
ports: []
|
|
restart: unless-stopped
|