feat: add versioned deployment bundle

2026-09-20 18:48:55 +03:00
commit 6f85fcb0f6
7 changed files with 811 additions and 0 deletions
@@ -0,0 +1,58 @@
+name: wealthledger
+
+x-backend: &backend
+  image: ${BACKEND_IMAGE:?Set versioned backend image in release.env}
+  environment:
+    NODE_ENV: production
+    PORT: '3000'
+    DATABASE_URL: file:/data/wealthledger.db
+    TBANK_CA_CERT_PATH: ${TBANK_CA_CERT_PATH:-/certs/tbank-ca.pem}
+    FRONTEND_ORIGIN: ${FRONTEND_ORIGIN:?Set browser-visible HTTPS origin}
+    JWT_SECRET: ${JWT_SECRET:?Keep the existing JWT secret}
+    TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY:?Keep the existing encryption key}
+    LOG_LEVEL: ${LOG_LEVEL:-info}
+  volumes:
+    - type: bind
+      source: ${DATA_DIRECTORY:?Set existing absolute data directory}
+      target: /data
+      bind:
+        create_host_path: false
+    - type: bind
+      source: ${TBANK_CA_CERT_FILE:?Set existing absolute CA certificate filename}
+      target: ${TBANK_CA_CERT_PATH:-/certs/tbank-ca.pem}
+      read_only: true
+      bind:
+        create_host_path: false
+  read_only: true
+  init: true
+  security_opt: [no-new-privileges:true]
+  cap_drop: [ALL]
+
+services:
+  migration:
+    <<: *backend
+    command: [node, node_modules/prisma/build/index.js, migrate, deploy]
+    restart: 'no'
+    healthcheck:
+      disable: true
+
+  backend:
+    <<: *backend
+    scale: 1
+    restart: unless-stopped
+    depends_on:
+      migration:
+        condition: service_completed_successfully
+
+  frontend:
+    image: ${FRONTEND_IMAGE:?Set versioned frontend image in release.env}
+    ports:
+      - '127.0.0.1:${FRONTEND_PORT:-8080}:8080'
+    read_only: true
+    tmpfs: [/tmp]
+    security_opt: [no-new-privileges:true]
+    cap_drop: [ALL]
+    restart: unless-stopped
+    depends_on:
+      backend:
+        condition: service_healthy