tajniak81andClaude Opus 4.8
2d20f6f29c
The combined stack now includes PocketBase as a first-class service instead of assuming an external one: a Docker/pocketbase image built from the release binary that bundles the pb_migrations and upserts the superuser on boot, so a fresh stack checks/creates its collections and super-admin the same way DriverVault does. Add production compose variants (registry images) and .env(.prod).example files for both Docker/ and Docker AIO/, a top-level compose name, a PocketBase healthcheck with a service_healthy dependency, and env-driven ports. Move the containerized PocketBase to :8070 (the live remote PB stays 10.2.1.10:8026). Add a root .dockerignore to trim the repo-root build context used by the pocketbase and AIO images. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
71 lines
2.7 KiB
YAML
71 lines
2.7 KiB
YAML
name: pilotvault
|
|
|
|
# Production PilotVault stack — pulls prebuilt images from the registry instead of
|
|
# building from source. Everything an operator needs to set lives in .env.
|
|
#
|
|
# 1. cp .env.prod.example .env (then edit — secrets/ports/volumes/images)
|
|
# 2. docker compose -f docker-compose.prod.yml pull
|
|
# 3. docker compose -f docker-compose.prod.yml up -d
|
|
#
|
|
# Traffic flow (browser): Web App BFF --/api--> API Server --> PocketBase.
|
|
#
|
|
# On first boot PocketBase upserts its superuser from POCKETBASE_ADMIN_* and runs
|
|
# the bundled migrations (create/reconcile collections + seed the baseline org and
|
|
# the superadmin@pilotvault.local login). Idempotent, so restarts/upgrades are safe.
|
|
|
|
services:
|
|
pocketbase:
|
|
image: "${PB_IMAGE:-10.2.1.10:5500/admin/pilotvault-pocketbase:latest}"
|
|
container_name: pilotvault-pocketbase
|
|
restart: unless-stopped
|
|
environment:
|
|
POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL:?set POCKETBASE_ADMIN_EMAIL in .env}"
|
|
POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD:?set POCKETBASE_ADMIN_PASSWORD in .env}"
|
|
volumes:
|
|
# Named volume by default; set PB_DATA to a host path in .env for a bind mount.
|
|
- "${PB_DATA:-pb_data}:/pb/pb_data"
|
|
ports:
|
|
# Bound to localhost by default — the admin UI (/_/) is reachable only on the
|
|
# host. Set PB_BIND=0.0.0.0 in .env to expose it on the network.
|
|
- "${PB_BIND:-127.0.0.1}:${PB_PORT:-8070}:8070"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health || exit 1"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 12
|
|
start_period: 10s
|
|
|
|
api-server:
|
|
image: "${API_IMAGE:-10.2.1.10:5500/admin/pilotvault-api-server:latest}"
|
|
container_name: pilotvault-api-server
|
|
restart: unless-stopped
|
|
depends_on:
|
|
pocketbase:
|
|
condition: service_healthy
|
|
environment:
|
|
API_ADDR: ":8080"
|
|
POCKETBASE_URL: "http://pocketbase:8070"
|
|
POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
|
|
POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
|
|
CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
|
|
ports:
|
|
# Localhost-only by default (the Web App reaches it over the internal
|
|
# network). Set API_BIND=0.0.0.0 to expose the API panel on the network.
|
|
- "${API_BIND:-127.0.0.1}:${API_PORT:-8080}:8080"
|
|
|
|
web-app:
|
|
image: "${WEB_IMAGE:-10.2.1.10:5500/admin/pilotvault-web-app:latest}"
|
|
container_name: pilotvault-web-app
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- api-server
|
|
environment:
|
|
ADDR: ":8090"
|
|
API_BASE: "http://api-server:8080"
|
|
ports:
|
|
# The public front door. Bound on all interfaces so browsers can reach it.
|
|
- "${WEB_PORT:-8090}:8090"
|
|
|
|
volumes:
|
|
pb_data:
|