hamid
92 lines
3.7 KiB
YAML
92 lines
3.7 KiB
YAML
# Balinyaar — full stack for the balinyaar.ir deployment.
|
|
#
|
|
# Three containers, no published ports: everything is reached through the EXISTING Caddy on `caddy_net`,
|
|
# which terminates TLS for balinyaar.ir (→ web) and api.balinyaar.ir (→ api). See DEPLOY.md for the
|
|
# Caddyfile block to add, and deploy/Caddyfile for a copy of it.
|
|
#
|
|
# The database is NOT here — it is the remote SQL Server already configured in
|
|
# server/src/API/Baya.Web.Api/appsettings.Development.json.
|
|
#
|
|
# docker compose up -d --build
|
|
# docker compose logs -f api
|
|
|
|
services:
|
|
api:
|
|
build:
|
|
context: ./server
|
|
image: balinyaar-api
|
|
container_name: balinyaar-api
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- otp-relay
|
|
environment:
|
|
# Deliberate: the deployed API runs as Development so the demo + lifecycle seeders populate the
|
|
# shared database and the screens aren't empty. This also exposes the developer exception page and
|
|
# GET /api/v1/dev/last_otp/{phone} publicly — acceptable for a pre-launch demo, NOT for real users.
|
|
# Switch to Production (and supply non-placeholder crypto keys) before launch — see DEPLOY.md.
|
|
ASPNETCORE_ENVIRONMENT: Development
|
|
|
|
# The two values that genuinely differ between a laptop and this network. Everything else — crypto
|
|
# keys, connection strings, CORS origins, trusted proxy networks — lives in appsettings.Development.json.
|
|
Seams__Sms__Telegram__BaseUrl: http://balinyaar-otp-relay:5010
|
|
Seams__ObjectStorage__RootPath: /app/data/object-storage
|
|
volumes:
|
|
# Uploaded verification documents live on the local-disk object-storage seam; without this they are
|
|
# inside the container and vanish on the next `up --build`.
|
|
- api-object-storage:/app/data/object-storage
|
|
- api-logs:/app/logs
|
|
networks:
|
|
- caddy_net
|
|
|
|
web:
|
|
build:
|
|
context: ./client
|
|
image: balinyaar-web
|
|
container_name: balinyaar-web
|
|
restart: unless-stopped
|
|
# No environment here on purpose: every NEXT_PUBLIC_* value is compiled into the browser bundle at
|
|
# build time from client/.env.production. Setting one here would be silently ignored.
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
networks:
|
|
- caddy_net
|
|
|
|
otp-relay:
|
|
build:
|
|
context: ./telegram-otp-bot
|
|
image: balinyaar-otp-relay
|
|
container_name: balinyaar-otp-relay
|
|
restart: unless-stopped
|
|
environment:
|
|
TELEGRAM_BOT_TOKEN: "8968527151:AAFiCuNGkXjOiLZfT6urU8tkW8SCsWDM0ic"
|
|
# Every id here receives EVERY login code, for every phone number. Keep it to people you trust.
|
|
TELEGRAM_CHAT_IDS: "1277103616,110209855"
|
|
# Must equal Seams:Sms:Telegram:ApiKey in the API's appsettings.Development.json.
|
|
API_KEY: "6a8dfaeea1aa375eb61da7663cadf23a3ea245fd939264dd"
|
|
# api.telegram.org is filtered in Iran — this hop goes out through the proxy container that already
|
|
# sits on caddy_net. A wrong value fails at boot with a clear message rather than per-OTP.
|
|
TELEGRAM_PROXY_URL: http://hysteria-client:8081
|
|
# The code still arrives on Telegram; keeping it out of `docker logs` means a host-log reader can't
|
|
# harvest login codes.
|
|
REDACT_CODE_IN_LOGS: "true"
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:5010/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
networks:
|
|
- caddy_net
|
|
|
|
volumes:
|
|
api-object-storage:
|
|
api-logs:
|
|
|
|
networks:
|
|
caddy_net:
|
|
external: true
|