delpoyment with fully dockerized project on wixur.ir, dyolink docker hub created beside backend and frontend image is uploaded.

infrastructure/docker-compose.prod.yml

@@ -1,16 +1,24 @@
+# Production stack — pull images from Docker Hub, HTTPS via Let's Encrypt (certbot).
+#
+# Server setup (minimal):
+#   1. Copy deploy.prod.env.example → .env  (DOMAIN, DOCKER_USERNAME, LETSENCRYPT_EMAIL)
+#   2. Copy secrets/*.example → ../secrets/ (database.env, backend.env) — outside git
+#   3. docker login   (private Docker Hub images)
+#   4. ./scripts/init-letsencrypt.sh   (first time only)
+#   5. docker compose -f docker-compose.prod.yml --env-file .env up -d
+#
+# Updates: docker compose pull && docker compose up -d
+
+name: dyolink-prod
+
 services:
   postgres:
     image: postgres:15-alpine
     container_name: dyolink_db_prod
     env_file:
-      - database.env
+      - ${DEPLOY_SECRETS_DIR:-./secrets}/database.env
     environment:
-      - POSTGRES_USER=${POSTGRES_USER}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
-      - POSTGRES_DB=${POSTGRES_DB:-dyolink_db}
-      - TZ=UTC
-    ports:
-      - "5433:5432"
+      TZ: UTC
     volumes:
       - postgres_data_prod:/var/lib/postgresql/data
       - ./database/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
@@ -19,12 +27,12 @@ services:
       - dyolink_network
     restart: unless-stopped
     logging:
-      driver: "json-file"
+      driver: json-file
       options:
         max-size: "10m"
         max-file: "3"
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -37,18 +45,18 @@ services:
       postgres:
         condition: service_healthy
     env_file:
-      - backend.env
+      - ${DEPLOY_SECRETS_DIR:-./secrets}/backend.env
     environment:
-      - NODE_ENV=production
-      - TZ=UTC
-      - PORT=3000
-    ports:
-      - "4001:3000"
+      NODE_ENV: production
+      TZ: UTC
+      PORT: "3000"
+    expose:
+      - "3000"
     networks:
       - dyolink_network
     restart: unless-stopped
     logging:
-      driver: "json-file"
+      driver: json-file
       options:
         max-size: "10m"
         max-file: "3"
@@ -57,26 +65,25 @@ services:
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 40s
+      start_period: 60s
 
   frontend:
     image: ${DOCKER_USERNAME}/dyolink-frontend:${TAG:-latest}
     container_name: dyolink_frontend_prod
     depends_on:
       - backend
-    env_file:
-      - frontend.env
     environment:
-      - NODE_ENV=production
-      - TZ=UTC
-      - PORT=3000
-    ports:
-      - "4000:3000"
+      NODE_ENV: production
+      TZ: UTC
+      PORT: "3000"
+      HOSTNAME: "0.0.0.0"
+    expose:
+      - "3000"
     networks:
       - dyolink_network
     restart: unless-stopped
     logging:
-      driver: "json-file"
+      driver: json-file
       options:
         max-size: "10m"
         max-file: "3"
@@ -85,34 +92,47 @@ services:
       interval: 30s
       timeout: 10s
       retries: 3
+      start_period: 60s
 
   nginx:
     image: nginx:alpine
     container_name: dyolink_nginx_prod
-    depends_on:
-      - backend
-      - frontend
     ports:
       - "80:80"
       - "443:443"
     volumes:
-      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
-      - ./ssl:/etc/nginx/ssl:ro
+      - ./nginx/generated/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - certbot_conf:/etc/letsencrypt:ro
+      - certbot_www:/var/www/certbot:ro
       - ./logs/nginx:/var/log/nginx
     networks:
       - dyolink_network
     restart: unless-stopped
     logging:
-      driver: "json-file"
+      driver: json-file
       options:
         max-size: "10m"
         max-file: "3"
 
+  certbot:
+    image: certbot/certbot:latest
+    container_name: dyolink_certbot_prod
+    volumes:
+      - certbot_conf:/etc/letsencrypt
+      - certbot_www:/var/www/certbot
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+    networks:
+      - dyolink_network
+    restart: unless-stopped
+
 networks:
   dyolink_network:
-    driver: bridge
     name: dyolink_network
 
 volumes:
   postgres_data_prod:
-    name: dyolink_postgres_data_prod
+    name: dyolink_postgres_data_prod
+  certbot_conf:
+    name: dyolink_certbot_conf
+  certbot_www:
+    name: dyolink_certbot_www