Files
pwa/docker-compose.yml
T
rootandCursor 4ac0c16665 Harden production Docker stack for MySQL, API proxy, and builds.
Keep MySQL internal-only with env-based credentials, proxy /api/backend through nginx with Docker DNS refresh, and support host SOCKS/HTTP proxy during image builds.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-08 12:50:40 +00:00

68 lines
1.8 KiB
YAML

services:
mysql:
# Host CPU lacks x86-64-v2 (no SSE4.2); MySQL 8.x official images crash with glibc fatal.
image: mysql:5.7
container_name: badi-pwa-mysql
restart: unless-stopped
env_file:
- .env.mysql
# Do NOT publish 3306 — public MySQL is a common ransomware target (RECOVER_YOUR_DATA).
# Backend reaches MySQL via the internal Docker network only.
volumes:
- badi_pwa_mysql_data:/var/lib/mysql
healthcheck:
test: ["CMD-SHELL", "mysqladmin ping -h127.0.0.1 -uroot -p$$MYSQL_ROOT_PASSWORD || exit 1"]
interval: 5s
timeout: 5s
retries: 20
backend:
build:
context: ./backend
dockerfile: Dockerfile
network: host
args:
# HTTP forwarder (gost) → host SOCKS 127.0.0.1:1081 — Prisma needs HTTP proxy
HTTP_PROXY: http://127.0.0.1:8118
HTTPS_PROXY: http://127.0.0.1:8118
ALL_PROXY: http://127.0.0.1:8118
image: badi-pwa-backend:latest
container_name: badi-pwa-backend
ports:
- "3001:3001"
restart: unless-stopped
env_file:
- ./backend/.env
environment:
- NODE_ENV=production
- PORT=3001
- HOST=0.0.0.0
# DATABASE_URL comes from backend/.env (do not hardcode credentials here)
- CORS_ORIGIN=https://pwa.feep.ir,https://novya.ir
- TRUST_PROXY=true
depends_on:
mysql:
condition: service_healthy
app:
build:
context: .
dockerfile: Dockerfile
network: host
args:
HTTP_PROXY: http://127.0.0.1:8118
HTTPS_PROXY: http://127.0.0.1:8118
ALL_PROXY: http://127.0.0.1:8118
image: badi-pwa-app:latest
container_name: badi-pwa-app
ports:
- "3020:80"
restart: unless-stopped
environment:
- NODE_ENV=production
depends_on:
- backend
volumes:
badi_pwa_mysql_data: