dev-pulse/docker-compose.fly-local.yml at main · NubeIO/dev-pulse · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# docker-compose.fly-local.yml — local HTTPS pre-flight harness.
#
# Runs the CANONICAL Fly image (Dockerfile.fly) behind a real TLS
# terminator (Caddy + mkcert) on https://localhost. Catches HTTPS-only
# regressions (OAuth callback, Secure cookies, mixed content) without
# burning a `fly deploy` cycle.
#
# See HTTPS-LOCAL-TEST.md for the full recipe.
#
# Usage:
#   make fly-local              # build + up
#   make fly-local-down         # stop, keep volumes
#   make fly-local-reset        # stop + wipe volumes
#
# Build context = parent dir (sibling `starter/` is referenced by the
# workspace path-deps). The Makefile cds up for you; if you run
# `docker compose` directly, do:
#     docker compose -f dev-pulse/docker-compose.fly-local.yml \
#                    --project-directory dev-pulse up -d --build
# from /home/user/code/rust/.

name: dev-pulse-fly-local

services:
  caddy-tls:
    # Outer TLS terminator. Trusts the mkcert root via the mounted
    # cert/key pair in ./certs (gitignored, generated by `mkcert localhost`).
    image: caddy:2-alpine
    container_name: dev-pulse-fly-local-caddy
    restart: unless-stopped
    depends_on:
      app:
        condition: service_healthy
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ./Caddyfile.local:/etc/caddy/Caddyfile:ro
      - ./certs:/certs:ro
      - caddy-data:/data
      - caddy-config:/config

  app:
    # The canonical Fly image. Identical to what `fly deploy` ships.
    build:
      context: ..
      dockerfile: dev-pulse/Dockerfile.fly
    image: dev-pulse-fly:local
    container_name: dev-pulse-fly-local-app
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # Public origin the outer Caddy is serving. Drives the OAuth
      # redirect_uri the backend hands to GitHub.
      DP_PUBLIC_BASE_URL: https://localhost

      # Postgres lives in the sibling service.
      DATABASE_URL: postgres://dev-pulse:devpass@postgres:5432/dev_pulse

      # Auth sidecar on the named volume.
      DP_AUTH_SQLITE_URL: sqlite:/data/auth.db?mode=rwc

      # Scheduler off in local — flip to true if you want to exercise
      # the reconciler tick path against real GitHub.
      DP_SCHEDULER_ENABLE: "false"

      RUST_LOG: info,dev_pulse=info,dp_server=debug,sqlx=warn

      # Secrets sourced from .env.fly-local (gitignored).
      DP_GITHUB_OAUTH_CLIENT_ID:  ${DP_GITHUB_OAUTH_CLIENT_ID:-}
      OAUTH_GITHUB_CLIENT_SECRET: ${OAUTH_GITHUB_CLIENT_SECRET:-}
      GITHUB_WEBHOOK_SECRET:      ${GITHUB_WEBHOOK_SECRET:-}
      GITHUB_PAT:                 ${GITHUB_PAT:-}
      DP_GITHUB_ALLOW_ORGS:       ${DP_GITHUB_ALLOW_ORGS:-[]}
    volumes:
      - app-data:/data
    healthcheck:
      # Hits the inner Caddy (which proxies to the backend's /health).
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/health"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 30s
    # No ports: published — only caddy-tls is reachable from the host.
    # This forces traffic through the TLS terminator like production.
    expose:
      - "8080"

  postgres:
    image: postgres:16-alpine
    container_name: dev-pulse-fly-local-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: dev-pulse
      POSTGRES_PASSWORD: devpass
      POSTGRES_DB: dev_pulse
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U dev-pulse -d dev_pulse"]
      interval: 5s
      timeout: 3s
      retries: 20

volumes:
  caddy-data:
    name: dev-pulse-fly-local-caddy-data
  caddy-config:
    name: dev-pulse-fly-local-caddy-config
  app-data:
    name: dev-pulse-fly-local-data
  pgdata:
    name: dev-pulse-fly-local-pgdata