Проект разделен на два репозитория

2026-08-14 15:42:45 +03:00
parent e06a77ee1d
commit bbef7a30c9
521 changed files with 2597 additions and 2302 deletions
@@ -0,0 +1,77 @@
+services:
+  nginx:
+    build:
+      context: .
+    image: han-chat-nginx:${RELEASE_VERSION:-local}
+    environment:
+      APP_ENV: ${APP_ENV:-production-like}
+      PUBLIC_HOST: ${PUBLIC_HOST}
+      NGINX_TLS_ENABLED: ${NGINX_TLS_ENABLED:-true}
+      NGINX_TLS_CERTIFICATE: ${NGINX_TLS_CERTIFICATE}
+      NGINX_TLS_CERTIFICATE_KEY: ${NGINX_TLS_CERTIFICATE_KEY}
+      NGINX_HSTS_MAX_AGE: ${NGINX_HSTS_MAX_AGE:-31536000}
+      NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-8m}
+      NGINX_RATE_LIMIT_API: ${NGINX_RATE_LIMIT_API:-60r/m}
+      NGINX_RATE_LIMIT_AUTH: ${NGINX_RATE_LIMIT_AUTH:-60r/m}
+      NGINX_RATE_LIMIT_PUBLIC: ${NGINX_RATE_LIMIT_PUBLIC:-60r/m}
+      NGINX_RATE_LIMIT_POLLING: ${NGINX_RATE_LIMIT_POLLING:-60r/m}
+      NGINX_RATE_LIMIT_DOWNLOADS: ${NGINX_RATE_LIMIT_DOWNLOADS:-30r/m}
+      NGINX_RATE_LIMIT_NOTIFICATIONS_READ: ${NGINX_RATE_LIMIT_NOTIFICATIONS_READ:-120r/m}
+      NGINX_RATE_LIMIT_NOTIFICATIONS_ACTION: ${NGINX_RATE_LIMIT_NOTIFICATIONS_ACTION:-60r/m}
+      NGINX_RATE_LIMIT_NOTIFICATION_UPLOAD: ${NGINX_RATE_LIMIT_NOTIFICATION_UPLOAD:-20r/m}
+      NGINX_RATE_LIMIT_NOTIFICATIONS_PUBLIC: ${NGINX_RATE_LIMIT_NOTIFICATIONS_PUBLIC:-60r/m}
+      NGINX_RATE_LIMIT_BITRIX: ${NGINX_RATE_LIMIT_BITRIX:-120r/m}
+      NGINX_RATE_LIMIT_SMS_CALLBACK: ${NGINX_RATE_LIMIT_SMS_CALLBACK:-120r/m}
+      NGINX_RATE_LIMIT_WS: ${NGINX_RATE_LIMIT_WS:-30r/m}
+      NGINX_MESSAGE_READ_TIMEOUT_SEC: ${NGINX_MESSAGE_READ_TIMEOUT_SEC:-330}
+      FRONTEND_DEV_PROXY_ENABLED: ${FRONTEND_DEV_PROXY_ENABLED:-false}
+      EXPO_DEV_SERVER_URL: ${EXPO_DEV_SERVER_URL:-http://host.docker.internal:8081}
+      BITRIX_FRAME_ANCESTORS: ${BITRIX_FRAME_ANCESTORS:-https://*.bitrix24.ru}
+      S3_CONNECT_SRC: ${S3_CONNECT_SRC:-https://s3.storage.selcloud.ru}
+    ports:
+      - "${NGINX_HTTP_PORT:-80}:80"
+      - "${NGINX_HTTPS_PORT:-443}:443"
+    expose: ["8080"]
+    volumes:
+      - nginx-certs:/etc/letsencrypt:ro
+      - nginx-acme-webroot:/var/www/certbot:ro
+      - frontend-static:/usr/share/nginx/html:ro
+      - nginx-cache:/var/cache/nginx
+    networks: [public, backend]
+    depends_on:
+      frontend-static: {condition: service_completed_successfully}
+      api-backend: {condition: service_healthy}
+      keycloak: {condition: service_healthy}
+      sms-service: {condition: service_healthy}
+      bitrix-local-app: {condition: service_healthy}
+      bitrix-sync: {condition: service_healthy}
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/nginx-health/live || curl -fsS http://127.0.0.1/nginx-health/live"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp:size=128m,mode=1777
+      - /etc/nginx/generated:size=4m,mode=0755,uid=0,gid=0
+    cap_drop: ["ALL"]
+    cap_add: ["CHOWN", "NET_BIND_SERVICE", "SETUID", "SETGID"]
+    security_opt: ["no-new-privileges:true"]
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    ulimits:
+      nofile: {soft: 65536, hard: 65536}
+    logging:
+      driver: json-file
+      options: {max-size: "50m", max-file: "5"}
+
+  certbot:
+    image: certbot/certbot:v3.1.0
+    profiles: ["certbot"]
+    volumes:
+      - nginx-certs:/etc/letsencrypt
+      - nginx-acme-webroot:/var/www/certbot
+    networks: [public]
+    security_opt: ["no-new-privileges:true"]
+    cap_drop: ["ALL"]