59 lines
2.8 KiB
YAML
59 lines
2.8 KiB
YAML
# Production override: join an existing Traefik network and let Traefik route
|
|
# bookmark-api.<domain> -> this service with TLS. No host port published.
|
|
#
|
|
# docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
|
|
#
|
|
# Set in .env:
|
|
# BOOKMARK_API_HOST=bookmark-api.example.com # your subdomain (required)
|
|
# BOOKMARK_WEB_HOST=bookmark.example.com # browser UI subdomain, same container (required)
|
|
# PROXY_NETWORK=proxy # Traefik's network name, if not "proxy"
|
|
# TRAEFIK_ENTRYPOINT=websecure # your HTTPS entrypoint name
|
|
# TRAEFIK_CERTRESOLVER=le # your ACME/cert resolver name
|
|
#
|
|
# The network must already exist and Traefik must watch it:
|
|
# docker network create proxy # if it doesn't yet
|
|
|
|
services:
|
|
bookmark-api:
|
|
# Traffic arrives over the Traefik network, not a published port.
|
|
ports: !reset []
|
|
environment:
|
|
# Must be an IP, not the DNS name — see the base file's comment on this
|
|
# same key: Chrome's DevTools HTTP handler 500s any Host header that
|
|
# isn't an IP or "localhost".
|
|
BROWSER_WS_URL: ${BROWSER_WS_URL:-ws://172.28.0.10:9222}
|
|
depends_on:
|
|
- headless-shell
|
|
# `networks:` here replaces the base file's list entirely, so both must be
|
|
# named: `proxy` for Traefik routing, `browser` (defined in the base file)
|
|
# to keep reaching headless-shell without putting it on `proxy` too.
|
|
networks:
|
|
- proxy
|
|
- browser
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=${PROXY_NETWORK:-proxy}"
|
|
- "traefik.http.routers.bmapi.rule=Host(`${BOOKMARK_API_HOST:?set BOOKMARK_API_HOST in .env}`)"
|
|
- "traefik.http.routers.bmapi.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
|
|
- "traefik.http.routers.bmapi.tls=true"
|
|
- "traefik.http.routers.bmapi.tls.certresolver=${TRAEFIK_CERTRESOLVER:-le}"
|
|
- "traefik.http.services.bmapi.loadbalancer.server.port=8080"
|
|
# Second hostname for the browser UI, same container. Traefik needs the
|
|
# service named explicitly once more than one router targets it.
|
|
- "traefik.http.routers.bmapi.service=bmapi"
|
|
- "traefik.http.routers.bmweb.rule=Host(`${BOOKMARK_WEB_HOST:?set BOOKMARK_WEB_HOST in .env}`)"
|
|
- "traefik.http.routers.bmweb.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
|
|
- "traefik.http.routers.bmweb.tls=true"
|
|
- "traefik.http.routers.bmweb.tls.certresolver=${TRAEFIK_CERTRESOLVER:-le}"
|
|
- "traefik.http.routers.bmweb.service=bmapi"
|
|
|
|
# headless-shell is untouched here: it keeps its `browser` network membership
|
|
# from the base file and must never join `proxy` — that network is shared
|
|
# with whatever else sits behind Traefik on this host, and an exposed
|
|
# CDP endpoint on it would be remote code execution for any of them.
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
name: ${PROXY_NETWORK:-proxy}
|