Initial commit (unpacked platform)
This commit is contained in:
Sven (AAMOS AI)
@@ -0,0 +1,17 @@
|
||||
# Admin – byggs statiskt och serveras av nginx
|
||||
FROM node:22-alpine AS builder
|
||||
WORKDIR /build
|
||||
RUN corepack enable
|
||||
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml .npmrc ./
|
||||
COPY tsconfig.base.json turbo.json ./
|
||||
COPY packages ./packages
|
||||
COPY apps/admin ./apps/admin
|
||||
ARG VITE_API_BASE_URL=http://localhost:4000
|
||||
ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
|
||||
RUN pnpm install --frozen-lockfile --filter @app/admin...
|
||||
RUN pnpm --filter @app/admin build
|
||||
|
||||
FROM nginx:alpine AS runtime
|
||||
COPY --from=builder /build/apps/admin/dist /usr/share/nginx/html
|
||||
COPY infrastructure/docker/nginx-admin.conf /etc/nginx/conf.d/default.conf
|
||||
EXPOSE 80
|
||||
@@ -0,0 +1,24 @@
|
||||
# Food API – multi-stage build (spec §50–51)
|
||||
FROM node:22-alpine AS builder
|
||||
WORKDIR /build
|
||||
RUN corepack enable
|
||||
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml .npmrc ./
|
||||
COPY tsconfig.base.json turbo.json ./
|
||||
COPY packages ./packages
|
||||
COPY apps/api ./apps/api
|
||||
RUN pnpm install --frozen-lockfile --filter @app/api...
|
||||
RUN pnpm --filter @app/api build
|
||||
|
||||
FROM node:22-alpine AS runtime
|
||||
RUN addgroup -S app && adduser -S app -G app
|
||||
WORKDIR /app
|
||||
ENV NODE_ENV=production
|
||||
# tsup bundlar workspace-paketen; externa deps installeras separat
|
||||
COPY --from=builder /build/apps/api/dist ./dist
|
||||
COPY --from=builder /build/apps/api/package.json ./package.json
|
||||
COPY --from=builder /build/node_modules ./node_modules
|
||||
USER app
|
||||
EXPOSE 4000
|
||||
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
||||
CMD wget -qO- http://127.0.0.1:4000/healthz || exit 1
|
||||
CMD ["node", "dist/index.js"]
|
||||
@@ -0,0 +1,20 @@
|
||||
# Worker – multi-stage build (spec §50–51)
|
||||
FROM node:22-alpine AS builder
|
||||
WORKDIR /build
|
||||
RUN corepack enable
|
||||
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml .npmrc ./
|
||||
COPY tsconfig.base.json turbo.json ./
|
||||
COPY packages ./packages
|
||||
COPY apps/worker ./apps/worker
|
||||
RUN pnpm install --frozen-lockfile --filter @app/worker...
|
||||
RUN pnpm --filter @app/worker build
|
||||
|
||||
FROM node:22-alpine AS runtime
|
||||
RUN addgroup -S app && adduser -S app -G app
|
||||
WORKDIR /app
|
||||
ENV NODE_ENV=production
|
||||
COPY --from=builder /build/apps/worker/dist ./dist
|
||||
COPY --from=builder /build/apps/worker/package.json ./package.json
|
||||
COPY --from=builder /build/node_modules ./node_modules
|
||||
USER app
|
||||
CMD ["node", "dist/index.js"]
|
||||
@@ -0,0 +1,32 @@
|
||||
# Lokal utvecklingsmiljö: Postgres + Redis.
|
||||
# API/worker/admin körs med pnpm dev på värddatorn.
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:16-alpine
|
||||
container_name: app-postgres-dev
|
||||
environment:
|
||||
POSTGRES_DB: app
|
||||
POSTGRES_USER: app_user
|
||||
POSTGRES_PASSWORD: app_dev_password
|
||||
ports:
|
||||
- "5432:5432"
|
||||
volumes:
|
||||
- app_pg_dev:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U app_user -d app"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 10
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
container_name: app-redis-dev
|
||||
command: ["redis-server", "--maxmemory", "256mb", "--maxmemory-policy", "noeviction"]
|
||||
ports:
|
||||
- "6379:6379"
|
||||
volumes:
|
||||
- app_redis_dev:/data
|
||||
|
||||
volumes:
|
||||
app_pg_dev:
|
||||
app_redis_dev:
|
||||
@@ -0,0 +1,103 @@
|
||||
# Produktionskomposition för befintlig server (spec §51, steg 1 i skalningsplanen).
|
||||
# Placeras under /opt/app-platform/. Secrets injiceras via .env-fil som
|
||||
# ägs av appens dedikerade användare (chmod 600) tills SSM-integration (steg 2).
|
||||
#
|
||||
# Krav enligt spec §51: egen Linux-user, egna secrets, egna loggar, egna larm,
|
||||
# egen domän, egen S3-bucket, egen IAM-roll, CPU/RAM-limits. Se docs/infrastruktur.md.
|
||||
services:
|
||||
app-api:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: infrastructure/docker/Dockerfile.api
|
||||
image: app-api:latest
|
||||
container_name: app-api
|
||||
env_file: /opt/app-platform/secrets/api.env
|
||||
ports:
|
||||
- "127.0.0.1:4100:4000" # bakom befintlig reverse proxy
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
app-redis:
|
||||
condition: service_healthy
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "1.0"
|
||||
memory: 768M
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "20m"
|
||||
max-file: "5"
|
||||
|
||||
app-worker:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: infrastructure/docker/Dockerfile.worker
|
||||
image: app-worker:latest
|
||||
container_name: app-worker
|
||||
env_file: /opt/app-platform/secrets/worker.env
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
app-redis:
|
||||
condition: service_healthy
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "1.0"
|
||||
memory: 768M
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "20m"
|
||||
max-file: "5"
|
||||
|
||||
app-admin:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: infrastructure/docker/Dockerfile.admin
|
||||
args:
|
||||
VITE_API_BASE_URL: https://api.example.invalid # sätt via brand/.env
|
||||
image: app-admin:latest
|
||||
container_name: app-admin
|
||||
ports:
|
||||
- "127.0.0.1:4180:80"
|
||||
restart: unless-stopped
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.25"
|
||||
memory: 128M
|
||||
|
||||
app-redis:
|
||||
image: redis:7-alpine
|
||||
container_name: app-redis
|
||||
command:
|
||||
[
|
||||
"redis-server",
|
||||
"--appendonly",
|
||||
"yes",
|
||||
"--maxmemory",
|
||||
"512mb",
|
||||
"--maxmemory-policy",
|
||||
"noeviction",
|
||||
]
|
||||
volumes:
|
||||
- app_redis_data:/data
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 5
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.5"
|
||||
memory: 640M
|
||||
|
||||
# PostgreSQL: befintlig RDS-instans med separat separat databas och
|
||||
# användaren app-användaren med minsta möjliga privilegier (spec §52).
|
||||
# Se infrastructure/deployment/create-database.sql.
|
||||
|
||||
volumes:
|
||||
app_redis_data:
|
||||
@@ -0,0 +1,19 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
root /usr/share/nginx/html;
|
||||
index index.html;
|
||||
|
||||
# SPA-routing
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
|
||||
# Säkerhetsheaders
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
|
||||
gzip on;
|
||||
gzip_types text/css application/javascript application/json;
|
||||
}
|
||||
Reference in New Issue
Block a user