mi
78 lines
3.3 KiB
YAML
78 lines
3.3 KiB
YAML
services:
|
|
nginx:
|
|
build:
|
|
context: .
|
|
image: han-chat-nginx:${RELEASE_VERSION:-local}
|
|
environment:
|
|
APP_ENV: ${APP_ENV:-production-like}
|
|
PUBLIC_HOST: ${PUBLIC_HOST}
|
|
NGINX_TLS_ENABLED: ${NGINX_TLS_ENABLED:-true}
|
|
NGINX_TLS_CERTIFICATE: ${NGINX_TLS_CERTIFICATE}
|
|
NGINX_TLS_CERTIFICATE_KEY: ${NGINX_TLS_CERTIFICATE_KEY}
|
|
NGINX_HSTS_MAX_AGE: ${NGINX_HSTS_MAX_AGE:-31536000}
|
|
NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-8m}
|
|
NGINX_RATE_LIMIT_API: ${NGINX_RATE_LIMIT_API:-60r/m}
|
|
NGINX_RATE_LIMIT_AUTH: ${NGINX_RATE_LIMIT_AUTH:-60r/m}
|
|
NGINX_RATE_LIMIT_PUBLIC: ${NGINX_RATE_LIMIT_PUBLIC:-60r/m}
|
|
NGINX_RATE_LIMIT_POLLING: ${NGINX_RATE_LIMIT_POLLING:-60r/m}
|
|
NGINX_RATE_LIMIT_DOWNLOADS: ${NGINX_RATE_LIMIT_DOWNLOADS:-30r/m}
|
|
NGINX_RATE_LIMIT_NOTIFICATIONS_READ: ${NGINX_RATE_LIMIT_NOTIFICATIONS_READ:-120r/m}
|
|
NGINX_RATE_LIMIT_NOTIFICATIONS_ACTION: ${NGINX_RATE_LIMIT_NOTIFICATIONS_ACTION:-60r/m}
|
|
NGINX_RATE_LIMIT_NOTIFICATION_UPLOAD: ${NGINX_RATE_LIMIT_NOTIFICATION_UPLOAD:-20r/m}
|
|
NGINX_RATE_LIMIT_NOTIFICATIONS_PUBLIC: ${NGINX_RATE_LIMIT_NOTIFICATIONS_PUBLIC:-60r/m}
|
|
NGINX_RATE_LIMIT_BITRIX: ${NGINX_RATE_LIMIT_BITRIX:-120r/m}
|
|
NGINX_RATE_LIMIT_SMS_CALLBACK: ${NGINX_RATE_LIMIT_SMS_CALLBACK:-120r/m}
|
|
NGINX_RATE_LIMIT_WS: ${NGINX_RATE_LIMIT_WS:-30r/m}
|
|
NGINX_MESSAGE_READ_TIMEOUT_SEC: ${NGINX_MESSAGE_READ_TIMEOUT_SEC:-330}
|
|
FRONTEND_DEV_PROXY_ENABLED: ${FRONTEND_DEV_PROXY_ENABLED:-false}
|
|
EXPO_DEV_SERVER_URL: ${EXPO_DEV_SERVER_URL:-http://host.docker.internal:8081}
|
|
BITRIX_FRAME_ANCESTORS: ${BITRIX_FRAME_ANCESTORS:-https://*.bitrix24.ru}
|
|
S3_CONNECT_SRC: ${S3_CONNECT_SRC:-https://s3.storage.selcloud.ru}
|
|
ports:
|
|
- "${NGINX_HTTP_PORT:-80}:80"
|
|
- "${NGINX_HTTPS_PORT:-443}:443"
|
|
expose: ["8080"]
|
|
volumes:
|
|
- nginx-certs:/etc/letsencrypt:ro
|
|
- nginx-acme-webroot:/var/www/certbot:ro
|
|
- frontend-static:/usr/share/nginx/html:ro
|
|
- nginx-cache:/var/cache/nginx
|
|
networks: [public, backend]
|
|
depends_on:
|
|
frontend-static: {condition: service_completed_successfully}
|
|
api-backend: {condition: service_healthy}
|
|
keycloak: {condition: service_healthy}
|
|
sms-service: {condition: service_healthy}
|
|
bitrix-local-app: {condition: service_healthy}
|
|
bitrix-sync: {condition: service_healthy}
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/nginx-health/live || curl -fsS http://127.0.0.1/nginx-health/live"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=128m,mode=1777
|
|
- /etc/nginx/generated:size=4m,mode=0755,uid=0,gid=0
|
|
cap_drop: ["ALL"]
|
|
cap_add: ["CHOWN", "NET_BIND_SERVICE", "SETUID", "SETGID"]
|
|
security_opt: ["no-new-privileges:true"]
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
ulimits:
|
|
nofile: {soft: 65536, hard: 65536}
|
|
logging:
|
|
driver: json-file
|
|
options: {max-size: "50m", max-file: "5"}
|
|
|
|
certbot:
|
|
image: certbot/certbot:v3.1.0
|
|
profiles: ["certbot"]
|
|
volumes:
|
|
- nginx-certs:/etc/letsencrypt
|
|
- nginx-acme-webroot:/var/www/certbot
|
|
networks: [public]
|
|
security_opt: ["no-new-privileges:true"]
|
|
cap_drop: ["ALL"]
|