Alexandre
5e51fab6bd
- docker-compose.prod.yml : image registry.maisongrondin.fr/alexandre/mkv2avi:latest (plus de build local) - workflow : etape 'Redeployer sur TrueNAS' (app.redeploy, pattern Hooplab) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
92 lines
3.3 KiB
YAML
92 lines
3.3 KiB
YAML
# Variante PRODUCTION : PostgreSQL + Keycloak (mode production) + app,
|
|
# derrière Nginx Proxy Manager (TLS terminé par NPM).
|
|
#
|
|
# cp .env.prod.example .env.prod # puis renseigner les secrets
|
|
# docker compose --env-file .env.prod -f docker-compose.prod.yml pull
|
|
# docker compose --env-file .env.prod -f docker-compose.prod.yml up -d
|
|
#
|
|
# NPM (2 Proxy Hosts, forward en http vers l'IP de l'hôte) :
|
|
# auth.mkv2avi.maisongrondin.fr -> http://<IP_HOTE>:8080
|
|
# mkv2avi.maisongrondin.fr -> http://<IP_HOTE>:8090
|
|
# → SSL Let's Encrypt + Force SSL + Websockets Support activés sur les deux.
|
|
|
|
name: mkv2avi
|
|
|
|
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
container_name: mkv2avi-db
|
|
environment:
|
|
POSTGRES_DB: keycloak
|
|
POSTGRES_USER: keycloak
|
|
POSTGRES_PASSWORD: ${KC_DB_PASSWORD:?KC_DB_PASSWORD manquant}
|
|
volumes:
|
|
- kc-db:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 12
|
|
restart: unless-stopped
|
|
|
|
keycloak:
|
|
image: quay.io/keycloak/keycloak:26.0
|
|
container_name: mkv2avi-keycloak
|
|
command: ["start", "--import-realm"]
|
|
environment:
|
|
KC_DB: postgres
|
|
KC_DB_URL: jdbc:postgresql://db:5432/keycloak
|
|
KC_DB_USERNAME: keycloak
|
|
KC_DB_PASSWORD: ${KC_DB_PASSWORD:?KC_DB_PASSWORD manquant}
|
|
KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_ADMIN:-admin}
|
|
KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD:?KC_ADMIN_PASSWORD manquant}
|
|
# URL publique (issuer) — NPM termine le TLS, Keycloak sert en HTTP en interne
|
|
KC_HOSTNAME: https://auth.mkv2avi.maisongrondin.fr
|
|
KC_HTTP_ENABLED: "true"
|
|
KC_PROXY_HEADERS: xforwarded
|
|
KC_HEALTH_ENABLED: "true"
|
|
volumes:
|
|
- ./keycloak/realm-mkv2avi.json:/opt/keycloak/data/import/realm-mkv2avi.json:ro
|
|
ports:
|
|
- "${KC_HTTP_PORT:-8080}:8080"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '200 OK'"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 30
|
|
start_period: 60s
|
|
restart: unless-stopped
|
|
|
|
mkv2avi:
|
|
# Image livrée par la CI (tag → build + push). Voir .gitea/workflows/release.yml.
|
|
image: registry.maisongrondin.fr/alexandre/mkv2avi:latest
|
|
container_name: mkv2avi
|
|
environment:
|
|
- MAX_WORKERS=${MAX_WORKERS:-1}
|
|
- OIDC_ISSUER=https://auth.mkv2avi.maisongrondin.fr/realms/mkv2avi
|
|
- OIDC_CLIENT_ID=mkv2avi
|
|
- OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:?OIDC_CLIENT_SECRET manquant}
|
|
- OIDC_REDIRECT_URI=https://mkv2avi.maisongrondin.fr/auth/callback
|
|
- OIDC_POST_LOGOUT_REDIRECT_URI=https://mkv2avi.maisongrondin.fr/
|
|
- SESSION_SECRET=${SESSION_SECRET:?SESSION_SECRET manquant}
|
|
- SESSION_HTTPS_ONLY=true
|
|
volumes:
|
|
- ${MEDIA_DIR:?MEDIA_DIR manquant}:/media:ro
|
|
- ${OUTPUT_DIR:-./output}:/output
|
|
ports:
|
|
- "${APP_HTTP_PORT:-8090}:8000"
|
|
depends_on:
|
|
keycloak:
|
|
condition: service_healthy
|
|
# Repli si le conteneur ne résout pas le domaine public (hairpin NAT) :
|
|
# décommente en remplaçant par l'IP de NPM/hôte.
|
|
# extra_hosts:
|
|
# - "auth.mkv2avi.maisongrondin.fr:192.168.1.200"
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
kc-db:
|