Agent Zero
7d3007b6c4
- deploy.py: UUIDs from env vars or Coolify API lookup by name - fast-deploy.sh: No hardcoded UUIDs, APP_DOMAIN from env - docker-compose.yml: All secrets from env vars, no hardcoded values - .env.example: All required vars documented - Deleted obsolete fast-frontend-deploy.sh with hardcoded container name
209 lines
8.0 KiB
YAML
209 lines
8.0 KiB
YAML
# =============================================================================
|
|
# docker-compose.yml — LeoCRM Multi-Container Setup
|
|
#
|
|
# Full stack: PostgreSQL + Redis + App + Worker, all with persistent volumes.
|
|
#
|
|
# This file serves two purposes:
|
|
# 1. Local development / testing: `docker compose up --build`
|
|
# 2. Reference for the production multi-container architecture
|
|
#
|
|
# Production deploys via Coolify use scripts/deploy.py which automates:
|
|
# - Coolify API build & deploy
|
|
# - Persistent volume mounting (patched into Coolify's generated compose)
|
|
# - Worker container startup
|
|
# - RLS policy enforcement
|
|
# - Health & domain verification
|
|
#
|
|
# No hardcoded secrets, UUIDs, or domains — everything from environment.
|
|
#
|
|
# Usage (local testing):
|
|
# cp .env.example .env
|
|
# $EDITOR .env # fill SECRET_KEY, DB_PASSWORD, REDIS_PASSWORD, ...
|
|
# docker compose up --build
|
|
# curl http://localhost:8000/api/v1/health
|
|
# =============================================================================
|
|
|
|
services:
|
|
# ── PostgreSQL 16 with pgvector ─────────────────────────────────────
|
|
postgres:
|
|
image: pgvector/pgvector:pg16
|
|
container_name: ${POSTGRES_CONTAINER_NAME:-crm-postgres}
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-crm_user}
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required}
|
|
POSTGRES_DB: ${POSTGRES_DB:-crm_db}
|
|
PGDATA: /var/lib/postgresql/data/pgdata
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
# No exposed ports — only internal Docker network access
|
|
# For local debugging, uncomment: ports: ["127.0.0.1:5432:5432"]
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-crm_user} -d ${POSTGRES_DB:-crm_db}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 10s
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 1G
|
|
cpus: "2.0"
|
|
networks:
|
|
- crm-net
|
|
|
|
# ── Redis 7 (sessions, rate limiting, ARQ queue) ────────────────────
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: ${REDIS_CONTAINER_NAME:-crm-redis}
|
|
restart: unless-stopped
|
|
command: redis-server --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
|
|
volumes:
|
|
- redisdata:/data
|
|
# No exposed ports — only internal Docker network access
|
|
# For local debugging, uncomment: ports: ["127.0.0.1:6379:6379"]
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "redis-cli ping || exit 1"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- crm-net
|
|
|
|
# ── CRM API (FastAPI + Uvicorn) ─────────────────────────────────────
|
|
crm-app:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: ${APP_CONTAINER_NAME:-crm-app}
|
|
restart: unless-stopped
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.crm.rule=Host(`${APP_HOST:-crm.media-on.de}`)
|
|
- traefik.http.routers.crm.entryPoints=http,https
|
|
- traefik.http.routers.crm.tls=true
|
|
- traefik.http.routers.crm.tls.certresolver=letsencrypt
|
|
- traefik.http.services.crm.loadbalancer.server.port=${APP_PORT:-8000}
|
|
networks:
|
|
- crm-net
|
|
- coolify
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
environment:
|
|
# API uses crm_api (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
|
|
DATABASE_URL: ${DATABASE_URL:-postgresql+asyncpg://crm_api:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
|
|
# Auth uses crm_auth (NOSUPERUSER, NOBYPASSRLS) — identity tables only
|
|
AUTH_DATABASE_URL: ${AUTH_DATABASE_URL:-postgresql+asyncpg://crm_auth:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
|
|
# Migration/DDL uses crm_migration (owner, NOBYPASSRLS)
|
|
MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://crm_migration:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
|
|
REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD}@redis:6379/0}
|
|
SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
|
|
CORS_ORIGINS: ${CORS_ORIGINS:-${APP_DOMAIN:-http://localhost:8000}}
|
|
FRONTEND_URL: ${FRONTEND_URL:-${APP_DOMAIN:-http://localhost:8000}}
|
|
ENVIRONMENT: ${ENVIRONMENT:-production}
|
|
LOG_LEVEL: ${LOG_LEVEL:-INFO}
|
|
SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-true}
|
|
STORAGE_PATH: ${STORAGE_PATH:-/data/storage}
|
|
# SMTP for password reset and notifications
|
|
SMTP_HOST: ${SMTP_HOST:-}
|
|
SMTP_PORT: ${SMTP_PORT:-587}
|
|
SMTP_USER: ${SMTP_USER:-}
|
|
SMTP_PASSWORD: ${SMTP_PASSWORD:-}
|
|
SMTP_FROM: ${SMTP_FROM:-no-reply@localhost}
|
|
SMTP_TLS: ${SMTP_TLS:-true}
|
|
BCRYPT_ROUNDS: ${BCRYPT_ROUNDS:-12}
|
|
# S3 Storage (optional — if STORAGE_BACKEND=s3)
|
|
STORAGE_BACKEND: ${STORAGE_BACKEND:-local}
|
|
S3_ENDPOINT: ${S3_ENDPOINT:-}
|
|
S3_BUCKET: ${S3_BUCKET:-}
|
|
S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
|
|
S3_SECRET_KEY: ${S3_SECRET_KEY:-}
|
|
S3_REGION: ${S3_REGION:-us-east-1}
|
|
S3_SECURE: ${S3_SECURE:-true}
|
|
# No exposed ports — accessed via reverse proxy
|
|
volumes:
|
|
- storage:/data/storage
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "http://localhost:${APP_PORT:-8000}/api/v1/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 15s
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 1G
|
|
cpus: "2.0"
|
|
|
|
# ── CRM Worker (ARQ background jobs, cron, outbox processor) ───────
|
|
crm-worker:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: ${WORKER_CONTAINER_NAME:-crm-worker}
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
entrypoint: ["/app/worker.sh"]
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python3 -c \"import redis,os; r=redis.from_url(os.environ.get('REDIS_URL','redis://localhost:6379/0')); print('ok' if r.ping() else 'fail')\" || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 15s
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 512M
|
|
cpus: "1.0"
|
|
environment:
|
|
# Worker uses crm_worker (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
|
|
DATABASE_URL: ${WORKER_DATABASE_URL:-postgresql+asyncpg://crm_worker:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
|
|
WORKER_DATABASE_URL: ${WORKER_DATABASE_URL:-postgresql+asyncpg://crm_worker:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
|
|
MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://crm_migration:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
|
|
REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD}@redis:6379/0}
|
|
SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
|
|
FRONTEND_URL: ${FRONTEND_URL:-${APP_DOMAIN:-http://localhost:8000}}
|
|
ENVIRONMENT: ${ENVIRONMENT:-production}
|
|
LOG_LEVEL: ${LOG_LEVEL:-INFO}
|
|
SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-true}
|
|
STORAGE_PATH: ${STORAGE_PATH:-/data/storage}
|
|
# SMTP for password reset and notifications
|
|
SMTP_HOST: ${SMTP_HOST:-}
|
|
SMTP_PORT: ${SMTP_PORT:-587}
|
|
SMTP_USER: ${SMTP_USER:-}
|
|
SMTP_PASSWORD: ${SMTP_PASSWORD:-}
|
|
SMTP_FROM: ${SMTP_FROM:-no-reply@localhost}
|
|
SMTP_TLS: ${SMTP_TLS:-true}
|
|
STORAGE_BACKEND: ${STORAGE_BACKEND:-local}
|
|
S3_ENDPOINT: ${S3_ENDPOINT:-}
|
|
S3_BUCKET: ${S3_BUCKET:-}
|
|
S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
|
|
S3_SECRET_KEY: ${S3_SECRET_KEY:-}
|
|
volumes:
|
|
- storage:/data/storage
|
|
networks:
|
|
- crm-net
|
|
|
|
volumes:
|
|
pgdata:
|
|
name: ${PGDATA_VOLUME_NAME:-crm_pgdata}
|
|
redisdata:
|
|
name: ${REDISDATA_VOLUME_NAME:-crm_redisdata}
|
|
storage:
|
|
name: ${STORAGE_VOLUME_NAME:-crm_storage}
|
|
|
|
networks:
|
|
crm-net:
|
|
name: ${CRM_NETWORK_NAME:-crm-net}
|
|
driver: bridge
|
|
coolify:
|
|
name: ${COOLIFY_NETWORK_NAME:-coolify}
|
|
external: true
|