Initial commit: InviteMe production redesign

2026-09-01 10:52:35 +03:00
commit 0d0868d998
71 changed files with 6912 additions and 0 deletions
@@ -0,0 +1,123 @@
+services:
+  inviteme:
+    build: .
+    restart: unless-stopped
+    command: ["sh", "-c", "SKIP_DB_BOOTSTRAP=true flask --app run.py db upgrade && python run_waitress.py"]
+    environment: &inviteme_environment
+      APP_ENV: production
+      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required}
+      CREDENTIAL_ENCRYPTION_KEY: ${CREDENTIAL_ENCRYPTION_KEY:?CREDENTIAL_ENCRYPTION_KEY is required}
+      BASE_URL: https://${DOMAIN:?DOMAIN is required}
+      TRUSTED_HOSTS: ${DOMAIN:?DOMAIN is required}
+      DATABASE_URL: postgresql+psycopg://inviteme:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@database:5432/inviteme
+      RATELIMIT_STORAGE_URI: redis://redis:6379/0
+      TASK_QUEUE_REDIS_URL: redis://redis:6379/1
+      TRUST_PROXY_HEADERS: "true"
+      ENFORCE_HTTPS: "true"
+      ALLOW_WEB_SETUP: "false"
+      TIMEZONE: ${TIMEZONE:-Europe/Moscow}
+      MAIL_SERVER: ${MAIL_SERVER:-smtp.yandex.ru}
+      MAIL_PORT: ${MAIL_PORT:-465}
+      MAIL_USE_SSL: ${MAIL_USE_SSL:-true}
+      MAIL_USERNAME: ${MAIL_USERNAME:-}
+      MAIL_PASSWORD: ${MAIL_PASSWORD:-}
+      MAIL_DEFAULT_SENDER: ${MAIL_DEFAULT_SENDER:-InviteMe}
+    expose:
+      - "8888"
+    volumes:
+      - inviteme_data:/app/instance
+    depends_on:
+      database:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,noexec,nosuid
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - backend
+
+  worker:
+    build: .
+    restart: unless-stopped
+    command: ["rq", "worker", "--url", "redis://redis:6379/1", "inviteme"]
+    environment: *inviteme_environment
+    volumes:
+      - inviteme_data:/app/instance
+    depends_on:
+      inviteme:
+        condition: service_healthy
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,noexec,nosuid
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - backend
+
+  database:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: inviteme
+      POSTGRES_USER: inviteme
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U inviteme -d inviteme"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    networks:
+      - backend
+
+  redis:
+    image: redis:8-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes", "--appendfsync", "everysec"]
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+    networks:
+      - backend
+
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    environment:
+      DOMAIN: ${DOMAIN:?DOMAIN is required}
+    ports:
+      - "80:80"
+      - "443:443"
+      - "443:443/udp"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      inviteme:
+        condition: service_healthy
+    networks:
+      - backend
+
+volumes:
+  inviteme_data:
+  postgres_data:
+  redis_data:
+  caddy_data:
+  caddy_config:
+
+networks:
+  backend:
+    driver: bridge