WorkFlow/docker-compose.prod.yml at main · kasxcode/WorkFlow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
services:
  # ----------------------------------------------------
  # 1. WorkFlow Web Application Service (Apache + PHP 8.2)
  # ----------------------------------------------------
  app:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: workflow_app
    restart: unless-stopped
    ports:
      # Bound to localhost only -- nginx on the host is the public entry point
      # and reverse-proxies to this port (see nginx/workflow.example.com.conf).
      - "127.0.0.1:${WORKFLOW_APP_PORT}:80"
    depends_on:
      - db
    volumes:
      # Code comes from the image build (COPY in Dockerfile), not a bind mount --
      # unlike local dev, a prod redeploy should mean "rebuild the image", not
      # "reflect whatever's on disk right now". config.php and uploads need to
      # survive a rebuild/recreate though. config.php is a *host bind mount* of
      # a single file, not a named volume -- Docker named volumes don't reliably
      # mount onto a lone file, only directories (confirmed the hard way: "config.php
      # is not directory"). The host file must exist before first `up` (see deploy
      # notes) or Docker will create it as a directory instead, hitting the same
      # error in reverse.
      - ./config.php:/var/www/html/config.php
      - workflow_uploads:/var/www/html/uploads
    environment:
      - APACHE_DOCUMENT_ROOT=/var/www/html
      # Read by config.php via getenv() -- no DB password ever needs to be a
      # literal in a PHP file. Values come from .env.prod.
      - DB_HOST=db
      - DB_DATABASE=workflow_platform
      - DB_USERNAME=workflow
      - DB_PASSWORD=${WORKFLOW_DB_PASSWORD:?Set WORKFLOW_DB_PASSWORD in .env.prod}
      - WORKFLOW_ENCRYPTION_KEY=${WORKFLOW_ENCRYPTION_KEY:?Set WORKFLOW_ENCRYPTION_KEY in .env.prod -- back up its value outside this repo, losing it makes encrypted data unrecoverable}

  # ----------------------------------------------------
  # 2. Database Service (MariaDB 10.11 / MySQL compatible)
  # ----------------------------------------------------
  db:
    image: mariadb:10.11
    container_name: workflow_db
    restart: unless-stopped
    # No host port published -- only the app container needs to reach this,
    # over the compose-internal network. Matches how the other stacks already
    # running on this box (proto-db-1, straddle-db) keep their DBs off the host.
    environment:
      MYSQL_ROOT_PASSWORD: ${WORKFLOW_DB_ROOT_PASSWORD}
      MYSQL_DATABASE: workflow_platform
      MYSQL_USER: workflow
      MYSQL_PASSWORD: ${WORKFLOW_DB_PASSWORD}
    volumes:
      - workflow_db_data:/var/lib/mysql
    command: --default-authentication-plugin=mysql_native_password --character-set-server=utf8mb4 --collation-server=utf8mb4_general_ci

  # ----------------------------------------------------
  # 3. phpMyAdmin Service (Optional Database GUI)
  # ----------------------------------------------------
  phpmyadmin:
    image: phpmyadmin/phpmyadmin:latest
    container_name: workflow_pma
    restart: unless-stopped
    ports:
      # Localhost-only -- never exposed to nginx/public. Reach it via an SSH
      # tunnel: ssh -L 8096:127.0.0.1:8096 ubuntu@<ec2-ip>, then browse
      # http://127.0.0.1:8096 on your own machine.
      - "127.0.0.1:${WORKFLOW_PMA_PORT}:80"
    environment:
      PMA_HOST: db
      PMA_USER: workflow
      PMA_PASSWORD: ${WORKFLOW_DB_PASSWORD}
    depends_on:
      - db

volumes:
  workflow_db_data:
    driver: local
  workflow_uploads:
    driver: local