ixgadmin
243d4eefcd
DEBUG was on in production, so an error rendered a full traceback and the DEBUG-only media route served /media/ixg-documents/... publicly, bypassing the document permission checks. Set DJANGO_DEBUG=False in the env files (untracked) and add friendly 500/404/403 templates. With DEBUG off Django no longer serves /static/, so nginx does: the static root moves to /var/www/ixg-platform-static (mounted into the app container) because /root is not traversable by www-data. HSTS (max-age 1y, includeSubDomains) is added to every HTTPS host, and a pragmatic CSP to the app/ops/portal locations. 'unsafe-inline' is required by the inline scripts/styles; self-hosting the CDN assets and nonces is a follow-up.
102 lines
2.2 KiB
YAML
102 lines
2.2 KiB
YAML
services:
|
|
ixg-postgres:
|
|
image: postgres:15-alpine
|
|
container_name: ixg-platform-db
|
|
restart: unless-stopped
|
|
networks:
|
|
- client-infra
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
environment:
|
|
POSTGRES_DB: ixg_platform
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: GYV9G8IuEbcTr39k2NxGbcLpYilD1mvhSmkPFuCs2fM=
|
|
ports:
|
|
- "127.0.0.1:5433:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
ixg-redis:
|
|
image: redis:7-alpine
|
|
container_name: ixg-platform-redis
|
|
restart: unless-stopped
|
|
networks:
|
|
- client-infra
|
|
ports:
|
|
- "127.0.0.1:6379:6379"
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
app:
|
|
build: .
|
|
container_name: ixg-platform-app
|
|
restart: unless-stopped
|
|
networks:
|
|
- client-infra
|
|
depends_on:
|
|
ixg-postgres:
|
|
condition: service_healthy
|
|
ixg-redis:
|
|
condition: service_healthy
|
|
volumes:
|
|
- .:/app
|
|
- /var/www/ixg-platform-static:/app/staticfiles
|
|
- ./media:/app/media
|
|
- ./documents:/data/ixg-documents
|
|
env_file:
|
|
- ./config/secrets/env.production
|
|
environment:
|
|
DB_HOST: ixg-postgres
|
|
DB_PORT: 5432
|
|
ports:
|
|
- "127.0.0.1:8000:8000"
|
|
|
|
celery_worker:
|
|
build: .
|
|
container_name: ixg-platform-celery-worker
|
|
restart: unless-stopped
|
|
networks:
|
|
- client-infra
|
|
depends_on:
|
|
- ixg-postgres
|
|
- ixg-redis
|
|
volumes:
|
|
- .:/app
|
|
- ./documents:/data/ixg-documents
|
|
env_file:
|
|
- ./config/secrets/env.production
|
|
environment:
|
|
DB_HOST: ixg-postgres
|
|
DB_PORT: 5432
|
|
command: celery -A dsp_platform worker -l info
|
|
|
|
celery_beat:
|
|
build: .
|
|
container_name: ixg-platform-celery-beat
|
|
restart: unless-stopped
|
|
networks:
|
|
- client-infra
|
|
depends_on:
|
|
- ixg-postgres
|
|
- ixg-redis
|
|
volumes:
|
|
- .:/app
|
|
env_file:
|
|
- ./config/secrets/env.production
|
|
environment:
|
|
DB_HOST: ixg-postgres
|
|
DB_PORT: 5432
|
|
command: celery -A dsp_platform beat -l info
|
|
|
|
volumes:
|
|
postgres_data:
|
|
|
|
networks:
|
|
client-infra:
|
|
external: true
|