datadunia
31707cfaef
- docker-compose.yml: server-core uses host network (no bridge isolation) - docker-compose.yml: postgres/redis expose ports on 127.0.0.1 only - docker-compose.dev.yml: also uses host network - WireGuard now runs on host network stack (wg show works on host) - nftables rules apply directly to host (proper peer isolation)
83 lines
1.7 KiB
YAML
83 lines
1.7 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: nexusguard
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD:-nexusguard}
|
|
POSTGRES_DB: nexusguard
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
ports:
|
|
- "127.0.0.1:5432:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U nexusguard"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
networks:
|
|
- nexusnet
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
volumes:
|
|
- redisdata:/data
|
|
ports:
|
|
- "127.0.0.1:6379:6379"
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
networks:
|
|
- nexusnet
|
|
|
|
server-core:
|
|
build:
|
|
context: ./apps/server-core
|
|
dockerfile: Dockerfile
|
|
network_mode: host
|
|
environment:
|
|
- DB_HOST=127.0.0.1
|
|
- DB_PORT=5432
|
|
- DB_USER=nexusguard
|
|
- DB_PASSWORD=${DB_PASSWORD:-nexusguard}
|
|
- DB_NAME=nexusguard
|
|
- REDIS_ADDR=127.0.0.1:6379
|
|
- JWT_SECRET=${JWT_SECRET:-changeme}
|
|
- SERVER_SALT=${SERVER_SALT:-changeme}
|
|
- NFTABLES_TABLE=nexusguard
|
|
- IPAM_POOL=10.8.0.0/16
|
|
- GIN_MODE=release
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
restart: unless-stopped
|
|
|
|
dashboard-ui:
|
|
build:
|
|
context: ./apps/dashboard-ui
|
|
dockerfile: Dockerfile
|
|
args:
|
|
VITE_API_BASE_URL: ${VITE_API_BASE_URL}
|
|
ports:
|
|
- "${WEB_PORT:-80}:80"
|
|
depends_on:
|
|
- server-core
|
|
restart: unless-stopped
|
|
networks:
|
|
- nexusnet
|
|
|
|
volumes:
|
|
pgdata:
|
|
redisdata:
|
|
|
|
networks:
|
|
nexusnet:
|
|
driver: bridge |