413 lines
14 KiB
YAML
Executable File
413 lines
14 KiB
YAML
Executable File
---
|
|
services:
|
|
postgres:
|
|
restart: always
|
|
image: "postgres:15.1-alpine"
|
|
container_name: phoenixDB # Hostname
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phx-postgres,env=prod"
|
|
networks:
|
|
- backend
|
|
environment:
|
|
DEBUG: true
|
|
POSTGRES_DB: ${DB_NAME}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
volumes:
|
|
- "./database:/var/lib/postgresql/data"
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "pg_isready -U postgres" ]
|
|
interval: 5s # Time between each health check
|
|
timeout: 2s # Number of failures before marking as unhealthy
|
|
retries: 5 # Grace period before health checks start
|
|
pgadmin:
|
|
restart: always
|
|
image: dpage/pgadmin4
|
|
container_name: pgAdmin4-ui
|
|
user: "5050:5050"
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phx-pgadmin,env=prod"
|
|
networks:
|
|
- backend
|
|
- frontend
|
|
environment:
|
|
PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
|
|
PGADMIN_DEFAULT_PASSWORD: ${SUPER_ADMIN_USER_PASSWORD}
|
|
PGADMIN_CONFIG_SERVER_MODE: 'True'
|
|
PGADMIN_CONFIG_WSGI_SCRIPT_NAME: "'/pgadmin4'"
|
|
PGADMIN_CONFIG_PROXY_X_PROTO_COUNT: 1
|
|
PGADMIN_SERVER_JSON_FILE: '/var/lib/pgadmin/servers.json'
|
|
PGADMIN_REPLACE_SERVERS_ON_STARTUP: 'True'
|
|
PGADMIN_CONFIG_DATA_DIR: "'/var/lib/pgadmin'"
|
|
PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: 'False'
|
|
|
|
# pgpass dynamic vars
|
|
PGPASSFILE: /var/lib/pgadmin/pgpass
|
|
PGPASS_HOST: ${DB_HOST}
|
|
PGPASS_PORT: ${DB_PORT}
|
|
PGPASS_DB: ${DB_NAME}
|
|
PGPASS_USER: ${DB_USERNAME}
|
|
PGPASS_PASSWORD: ${POSTGRES_PASSWORD}
|
|
|
|
# Other config
|
|
ALLOW_SAVE_PASSWORD: 'False'
|
|
MFA_ENABLED: 'True'
|
|
MFA_FORCE_REGISTRATION: 'False'
|
|
MFA_SUPPORTED_METHODS: 'email'
|
|
MFA_EMAIL_SUBJECT: 'Your MFA code by PHX-ERP'
|
|
MAX_LOGIN_ATTEMPTS: 5
|
|
ENHANCED_COOKIE_PROTECTION: 'True'
|
|
SHOW_GRAVATAR_IMAGE: 'True'
|
|
SECURITY_EMAIL_SENDER: ${SECURITY_EMAIL_SENDER}
|
|
MAIL_SERVER: ${MAIL_SERVER}
|
|
MAIL_PORT: ${MAIL_PORT}
|
|
MAIL_USE_SSL: 'False'
|
|
MAIL_USE_TLS: 'False'
|
|
MAIL_USERNAME: ${MAIL_USERNAME}
|
|
MAIL_PASSWORD: ${MAIL_PASSWORD}
|
|
MAIL_DEBUG: 'False'
|
|
volumes:
|
|
- ./pgadmin/data:/var/lib/pgadmin
|
|
- ./pgadmin/pgadmin-entrypoint.sh:/docker-entrypoint.sh:ro
|
|
entrypoint: ["/bin/sh", "/docker-entrypoint.sh"]
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-O", "-", "http://localhost:80/misc/ping"]
|
|
interval: 15s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 60s
|
|
phoenix-app:
|
|
restart: always
|
|
image: "phxerp/phoenix-app:beta"
|
|
container_name: phoenix-app
|
|
ports:
|
|
- "3000:3000" # Restrict to only allow access from Grafana Server IP
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phx-app,env=prod,project=phoenix"
|
|
volumes:
|
|
- ./app_custom:/usr/share/nginx/html/assets/custom
|
|
- ./nginx/nginx.conf:/etc/nginx/nginx.conf
|
|
- ./nginx/includes:/etc/nginx/includes:ro
|
|
networks:
|
|
- backend
|
|
- frontend
|
|
depends_on:
|
|
pgadmin:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--spider", "-q", "http://phoenix-app/login"] # localhost checks that the NGINX server inside the container is serving something at the root
|
|
interval: 10s # check every 10 seconds
|
|
timeout: 5s # allow 5 seconds per check
|
|
retries: 5 # mark as unhealthy after 5 failures
|
|
start_period: 15s # wait 15 seconds after container start before checking
|
|
phoenix-system:
|
|
restart: always
|
|
image: "phxerp/phoenix-system:beta"
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phoenix-system,env=prod"
|
|
environment:
|
|
- "DB_HOST=phoenixDB"
|
|
- "DB_NAME=${DB_NAME}"
|
|
- "DB_PASSWORD=${POSTGRES_PASSWORD}"
|
|
- "DB_USERNAME=postgres"
|
|
- "SUPER_ADMIN_USER_PASSWORD=${SUPER_ADMIN_USER_PASSWORD}"
|
|
- "REDIS_PASSWORD=${REDIS_PASSWORD}"
|
|
- RUN_JOB_QUEUE=${RUN_JOB_QUEUE}
|
|
- NODE_ENV=${NODE_ENV}
|
|
- PHX_HOST_NAME=${PHX_HOST_NAME}
|
|
command: ["npm", "run", "start:server"]
|
|
deploy:
|
|
replicas: ${PHOENIX_SYSTEM_REPLICAS} #change here if u want to have more replicas. Cant find a way to set via variable right now
|
|
networks:
|
|
backend:
|
|
aliases:
|
|
- phoenix-system
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
phoenix-redis:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -s http://phoenix-system:3000/health | grep -q '\"admin-api\":{\"status\":\"up\"}' && curl -s http://phoenix-system:3000/health | grep -q '\"database\":{\"status\":\"up\"}'"] # Checks both admin-api and database status
|
|
interval: 10s # Time between each health check
|
|
timeout: 6s # Max time to wait for each check
|
|
retries: 10 # Number of failures before marking as unhealthy
|
|
start_period: 40s # Grace period before health checks start
|
|
volumes:
|
|
- "./assets:/usr/src/app/packages/dev-server/assets"
|
|
- "./server_custom:/usr/src/app/packages/dev-server/custom"
|
|
# - "./logs:/usr/src/app/packages/dev-server/logs"
|
|
phoenix-worker:
|
|
restart: always
|
|
image: "phxerp/phoenix-system:beta"
|
|
container_name: "phoenix-worker"
|
|
ports:
|
|
- "3001:3001" # Restrict to only allow access from Grafana Server IP
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phx-worker,env=prod"
|
|
networks:
|
|
- backend
|
|
environment:
|
|
- DB_HOST=phoenixDB
|
|
- "DB_NAME=${DB_NAME}"
|
|
- "DB_PASSWORD=${POSTGRES_PASSWORD}"
|
|
- DB_USERNAME=postgres
|
|
- "SUPER_ADMIN_USER_PASSWORD=${SUPER_ADMIN_USER_PASSWORD}"
|
|
- REDIS_PASSWORD=${REDIS_PASSWORD}
|
|
- NODE_ENV=${NODE_ENV}
|
|
- PHX_HOST_NAME=${PHX_HOST_NAME}
|
|
command: ['npm', 'run', 'start:worker']
|
|
depends_on:
|
|
phoenix-system:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "curl -s http://phoenix-worker:3001/health | grep -q '\"status\":\"ok\"'" ] # Check if worker responds with status ok
|
|
interval: 10s # Time between each health check
|
|
timeout: 6s # Max time to wait for each check
|
|
retries: 20 # Grace period before health checks start
|
|
start_period: 30s # Grace period before health checks start
|
|
volumes:
|
|
- "./assets:/usr/src/app/packages/dev-server/assets"
|
|
- "./server_custom:/usr/src/app/packages/dev-server/custom"
|
|
# - "./logs:/usr/src/app/packages/dev-server/logs"
|
|
phoenix-redis:
|
|
image: 'bitnami/redis:latest'
|
|
container_name: redis
|
|
command: /opt/bitnami/scripts/redis/run.sh --maxmemory 100mb
|
|
user: root
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phx-redis,env=prod"
|
|
networks:
|
|
- backend
|
|
restart: always
|
|
environment:
|
|
ALLOW_EMPTY_PASSWORD: "no"
|
|
REDIS_PASSWORD: ${REDIS_PASSWORD}
|
|
healthcheck:
|
|
test: [ "CMD", "redis-cli", "--raw", "incr", "ping" ]
|
|
interval: 5s
|
|
retries: 10 # Increase retries if Redis takes a while to start
|
|
timeout: 5s # Increase timeout if needed
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
volumes:
|
|
- "./redis/data:/bitnami/redis/data"
|
|
phoenix-health-exporter:
|
|
image: phxerp/phoenix-health-exporter:alpha
|
|
container_name: health_exporter
|
|
restart: unless-stopped
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phx-health-exporter,env=prod"
|
|
ports:
|
|
- "9800:9800"
|
|
environment:
|
|
DB_HOST: ${DB_HOST}
|
|
DB_NAME: ${DB_NAME}
|
|
DB_PASSWORD: ${POSTGRES_PASSWORD}
|
|
DB_USERNAME: ${DB_USERNAME}
|
|
networks:
|
|
- frontend
|
|
- backend
|
|
volumes:
|
|
- /etc/hostname:/etc/host_hostname:ro # This ensures the container always uses the real machine hostname, even if restarted or recreated.
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.25'
|
|
memory: 128M
|
|
depends_on:
|
|
phoenix-system:
|
|
condition: service_healthy
|
|
phoenix-worker:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -sf http://localhost:9800/healthz || exit 1"]
|
|
interval: 1m
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
node-exporter:
|
|
image: quay.io/prometheus/node-exporter:latest
|
|
container_name: node_exporter
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phx-node-exporter,env=prod"
|
|
networks:
|
|
- metrics
|
|
- frontend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "9100:9100" # Restrict to only allow access from Grafana Server IP
|
|
command:
|
|
- "--path.procfs=/host/proc"
|
|
- "--path.sysfs=/host/sys"
|
|
- "--path.rootfs=/host"
|
|
- "--collector.filesystem.ignored-mount-points=^/(sys|proc|dev)($$|/)"
|
|
volumes:
|
|
- "/proc:/host/proc:ro"
|
|
- "/sys:/host/sys:ro"
|
|
- "/:/host:ro,rslave"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.25'
|
|
memory: 128M
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:9100/metrics"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
# nginx-exporter:
|
|
# image: nginx/nginx-prometheus-exporter:1.4.2
|
|
# container_name: nginx_exporter
|
|
# restart: unless-stopped
|
|
# # logging:
|
|
# # driver: loki
|
|
# # options:
|
|
# # loki-url: "${LOKI_URL}"
|
|
# # loki-retries: "${LOKI_RETRIES}"
|
|
# # loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# # loki-external-labels: "service=phx-nginx-exporter,env=prod"
|
|
# ports:
|
|
# - "9113:9113" # Restrict to only allow access from Grafana Server IP
|
|
# command:
|
|
# - '--nginx.scrape-uri=http://phoenix-app/stub_status'
|
|
# security_opt:
|
|
# - no-new-privileges:true
|
|
# deploy:
|
|
# resources:
|
|
# limits:
|
|
# cpus: '0.25'
|
|
# memory: 128M
|
|
# depends_on:
|
|
# phoenix-app:
|
|
# condition: service_healthy
|
|
# networks:
|
|
# - frontend
|
|
# - metrics
|
|
# healthcheck:
|
|
# test: ["CMD", "wget", "-qO-", "http://localhost:9113/metrics"] # Not working as expected
|
|
# interval: 15s
|
|
# timeout: 5s
|
|
# retries: 3
|
|
# start_period: 10s
|
|
https_portal:
|
|
container_name: https_portal
|
|
image: "steveltn/https-portal:1.21"
|
|
restart: unless-stopped
|
|
# logging:
|
|
# driver: loki
|
|
# options:
|
|
# loki-url: "${LOKI_URL}"
|
|
# loki-retries: "${LOKI_RETRIES}"
|
|
# loki-batch-size: "${LOKI_BATCH_SIZE}"
|
|
# loki-external-labels: "service=phx-https-portal,env=prod"
|
|
networks:
|
|
- frontend # [ PgAdmin, Phoenix-App ]
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
# - host:container
|
|
environment:
|
|
STAGE: "production" # Use Let's Encrypt production server
|
|
WEBSOCKET: "true" # Enable websocket support
|
|
DEBUG: "true"
|
|
RENEW_MARGIN_DAYS: 30
|
|
CLIENT_MAX_BODY_SIZE: 0
|
|
SERVER_NAMES_HASH_BUCKET_SIZE: 128 # Increase hash bucket size for server names - good for bigger domains names, if not set correctly, it will throw an error, break the container.
|
|
# FORCE_RENEW: 'true'
|
|
DOMAINS: "${HTTPS_PORTAL_DOMAINS}"
|
|
volumes:
|
|
- ./https_portal/data:/var/lib/https-portal # ssl_certs, vhost.d, htdocs
|
|
- ./https_portal/log:/var/log/nginx # nginx logs
|
|
# - ./https_portal/config/custom_nginx.conf:/opt/custom_nginx.conf:ro # ✅ Mount file in a safe path
|
|
depends_on:
|
|
pgadmin:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
fail2ban:
|
|
image: crazymax/fail2ban:latest
|
|
container_name: fail2ban
|
|
network_mode: 'host'
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
volumes:
|
|
- ./fail2ban/data:/data
|
|
- ./fail2ban/jail.d:/etc/fail2ban/jail.d
|
|
- /var/log:/var/log:ro
|
|
restart: always
|
|
|
|
networks:
|
|
backend:
|
|
driver: bridge
|
|
external: false
|
|
ipam:
|
|
config:
|
|
- subnet: 172.19.0.0/16
|
|
|
|
frontend:
|
|
driver: bridge
|
|
external: false
|
|
ipam:
|
|
config:
|
|
- subnet: 172.20.0.0/16
|
|
|
|
metrics:
|
|
driver: bridge
|
|
external: false
|
|
ipam:
|
|
config:
|
|
- subnet: 172.22.0.0/16 |