59 lines
2.0 KiB
YAML
59 lines
2.0 KiB
YAML
services:
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: apps/api/Dockerfile
|
|
target: production
|
|
environment:
|
|
NODE_ENV: production
|
|
DB_HOST: mariadb
|
|
DB_PORT: 3306
|
|
DB_USER: familysync
|
|
DB_PASSWORD: ${DB_PASSWORD}
|
|
DB_NAME: familysync
|
|
OIDC_AUTH_SECRET: ${OIDC_AUTH_SECRET:-placeholder_change_me}
|
|
OIDC_ISSUER: ${OIDC_ISSUER:-}
|
|
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-familysync}
|
|
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
|
|
OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
|
|
OIDC_AUTH_EXTERNAL_URL: ${OIDC_AUTH_EXTERNAL_URL:-}
|
|
# Constrain requested scopes — @hono/oidc-auth requests ALL of the IdP's
|
|
# scopes_supported when OIDC_SCOPES is empty (Authelia then rejects with
|
|
# invalid_scope). offline_access is required for refresh-token session
|
|
# persistence (D-12/AUTH-02) and must also be allowed on the Authelia client.
|
|
OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email offline_access}
|
|
APP_PASSWORD_ENCRYPTION_KEY: ${APP_PASSWORD_ENCRYPTION_KEY:-}
|
|
# VAPID keys for Web Push notifications (Phase 5).
|
|
# Generate with: npx web-push generate-vapid-keys --json
|
|
# Private key must only live in the gitignored .env — never commit it.
|
|
VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
|
|
VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
|
|
VAPID_SUBJECT: ${VAPID_SUBJECT:-}
|
|
depends_on:
|
|
mariadb:
|
|
condition: service_healthy
|
|
ports:
|
|
- "3000:3000"
|
|
|
|
mariadb:
|
|
image: mariadb:11
|
|
environment:
|
|
MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
|
|
MARIADB_DATABASE: familysync
|
|
MARIADB_USER: familysync
|
|
MARIADB_PASSWORD: ${DB_PASSWORD}
|
|
volumes:
|
|
- mariadb_data:/var/lib/mysql
|
|
healthcheck:
|
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
# Phase 1: present but unused; Phase 4 wires pub/sub for live list sync
|
|
|
|
volumes:
|
|
mariadb_data:
|