docker for prod

docker-compose.prod.yml

@@ -0,0 +1,49 @@
+# ---------------------------------------------------------------------------
+# Chicken Babies R Us — production compose file.
+#
+# Meant for the Debian 12 VM behind Caddy. Unlike docker-compose.yml (which
+# builds the image from source for local dev), this file pulls the pre-built
+# image from the Gitea container registry so the VM stays a thin runner.
+#
+# Ansible responsibilities (not this file):
+#   - render /opt/chicken-babies/.env with real secrets
+#   - ensure data/ exists and is owned by uid:gid 10001:10001
+#       sudo install -d -o 10001 -g 10001 /opt/chicken-babies/data/media
+#       sudo install -d -o 10001 -g 10001 /opt/chicken-babies/data/backups
+#   - `docker login git.sneakygeek.net -u <user> -p <REGISTRY_TOKEN>`
+#   - copy this file as /opt/chicken-babies/docker-compose.yml
+#   - run `docker compose pull && docker compose up -d`
+#
+# Update flow on the VM (after a CI build publishes a new :latest):
+#   docker compose pull
+#   docker compose up -d      # restarts only if the image SHA changed
+#   docker image prune -f     # reclaim space from the old layers
+# ---------------------------------------------------------------------------
+
+services:
+  web:
+    image: git.sneakygeek.net/ptarrant/chicken_babies_site:latest
+    # Docker pulls :latest on `docker compose pull`; no build context needed.
+    pull_policy: always
+    env_file:
+      - .env
+    ports:
+      # Bind to loopback only. Caddy (on the host) proxies inbound 443 here.
+      # Exposing on 0.0.0.0 would let anything on the LAN hit uvicorn
+      # directly and bypass TLS termination + rate limits.
+      - "127.0.0.1:8080:8080"
+    volumes:
+      # SQLite DB + media uploads live on the host so container rebuilds /
+      # image rolls don't wipe content. The container runs as uid 10001;
+      # the host dir must be chown'd to match (see Ansible notes above).
+      - ./data:/app/data
+    restart: unless-stopped
+    # Docker picks up the HEALTHCHECK baked into the image. `docker compose
+    # ps` surfaces health status; systemd / Ansible tasks can gate on it.
+    # Container-level logging caps so a chatty bot run doesn't fill the
+    # VM disk before the host-side logrotate catches it.
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"