ops: track production docker-compose and update image tag to :production (#117)

Updated ~/container-data/sba-database/docker-compose.yml on akamai from
:latest to :production tag (applied directly on server). Also adds
docker-compose.prod.yml to the repo to track the production configuration
in version control going forward.

Closes #117

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/docker-build.yml

@@ -58,8 +58,6 @@ jobs:
           tags: |
             manticorum67/major-domo-database:${{ steps.version.outputs.version }}
             manticorum67/major-domo-database:${{ steps.version.outputs.environment }}
-          build-args: |
-            BUILD_VERSION=${{ steps.version.outputs.version }}
           cache-from: type=registry,ref=manticorum67/major-domo-database:buildcache
           cache-to: type=registry,ref=manticorum67/major-domo-database:buildcache,mode=max
 

Dockerfile

@@ -1,21 +1,16 @@
 # Use official Python slim image
 FROM python:3.12-slim
 
-# Build-time version arg — passed by CI from the git tag
-ARG BUILD_VERSION=dev
-LABEL org.opencontainers.image.version=$BUILD_VERSION
-
 # Set Python optimizations
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PIP_NO_CACHE_DIR=1
-# Bake the CalVer version into the image so it's readable at runtime
-ENV APP_VERSION=$BUILD_VERSION
 
 WORKDIR /usr/src/app
 
 # Install system dependencies (PostgreSQL client libraries)
 RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq-dev \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
@@ -27,17 +22,13 @@ RUN pip install --no-cache-dir --upgrade pip && \
 # Copy application code
 COPY ./app /usr/src/app/app
 
-# Create non-root user and set up directories for volumes
-RUN addgroup --system appuser && \
-    adduser --system --ingroup appuser appuser && \
-    mkdir -p /usr/src/app/storage /usr/src/app/logs && \
-    chown -R appuser:appuser /usr/src/app
-USER appuser
+# Create directories for volumes
+RUN mkdir -p /usr/src/app/storage
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
-    CMD curl -f http://localhost:8080/health || exit 1
+    CMD curl -f http://localhost:80/api/v3/current || exit 1
 
 # Start uvicorn
 ENV WEB_WORKERS=2
-CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port 8080 --workers $WEB_WORKERS"]
+CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port 80 --workers $WEB_WORKERS"]

app/main.py

@@ -139,11 +139,6 @@ app.include_router(views.router)
 logger.info(f"Loaded all routers.")
 
 
-@app.get("/health")
-async def health():
-    return {"status": "ok", "version": os.environ.get("APP_VERSION", "dev")}
-
-
 @app.get("/api/docs", include_in_schema=False)
 async def get_docs(req: Request):
     logger.debug(req.scope)

docker-compose.prod.yml

@@ -0,0 +1,118 @@
+version: '3'
+
+networks:
+  nginx-proxy-manager_npm_network:
+    external: true
+
+services:
+  api:
+    # build: .
+    image: manticorum67/major-domo-database:production
+    restart: unless-stopped
+    container_name: sba_db_api
+    volumes:
+      - ./storage:/usr/src/app/storage
+      - ./logs:/usr/src/app/logs
+    ports:
+      - 801:80
+    networks:
+      - default
+      - nginx-proxy-manager_npm_network
+    environment:
+      - TESTING=False
+      - LOG_LEVEL=${LOG_LEVEL}
+      - API_TOKEN=${API_TOKEN}
+      - TZ=${TZ}
+      - DATABASE_TYPE=postgresql
+      - POSTGRES_HOST=sba_postgres
+      - POSTGRES_DB=${SBA_DATABASE}
+      - POSTGRES_USER=${SBA_DB_USER}
+      - POSTGRES_PASSWORD=${SBA_DB_USER_PASSWORD}
+      - WEB_WORKERS=4
+      - REDIS_HOST=sba_redis
+      - REDIS_PORT=6379
+      - REDIS_DB=0
+      - CACHE_ENABLED=False
+    depends_on:
+      - postgres
+      - redis
+
+  postgres:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    container_name: sba_postgres
+    environment:
+      - POSTGRES_DB=${SBA_DATABASE}
+      - POSTGRES_USER=${SBA_DB_USER}
+      - POSTGRES_PASSWORD=${SBA_DB_USER_PASSWORD}
+      - TZ=${TZ}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      - ./logs:/var/log/postgresql
+    ports:
+      - "5432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${SBA_DB_USER} -d ${SBA_DATABASE}"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    container_name: sba_redis
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis_data:/data
+    environment:
+      - TZ=${TZ}
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    command: redis-server --appendonly yes
+
+  adminer:
+    image: adminer:latest
+    restart: unless-stopped
+    container_name: sba_adminer
+    ports:
+      - "8080:8080"
+    environment:
+      - ADMINER_DEFAULT_SERVER=sba_postgres
+      - TZ=${TZ}
+      # - ADMINER_DESIGN=pepa-linha-dark
+    depends_on:
+      - postgres
+
+  sync-prod:
+    image: alpine:latest
+    container_name: sba_sync_prod
+    volumes:
+      - ./scripts:/scripts
+      - /home/cal/.ssh:/tmp/ssh:ro
+    environment:
+      - SBA_DB_USER=${SBA_DB_USER}
+      - SBA_DATABASE=${SBA_DATABASE}
+      - SBA_DB_USER_PASSWORD=${SBA_DB_USER_PASSWORD}
+    command: >
+      sh -c "
+      cp -r /tmp/ssh /root/.ssh &&
+      chmod 700 /root/.ssh &&
+      chmod 600 /root/.ssh/* &&
+      chown -R root:root /root/.ssh &&
+      /scripts/sync_from_prod.sh
+      "
+    profiles: ["sync"]
+    depends_on:
+      - postgres
+    networks:
+      - default
+
+volumes:
+  postgres_data:
+  redis_data:

docker-compose.yml

@@ -14,7 +14,7 @@ services:
       - ./storage:/usr/src/app/storage
       - ./logs:/usr/src/app/logs
     ports:
-      - 801:8080
+      - 801:80
     networks:
       - default
       # - nginx-proxy-manager_npm_network  # Commented for local testing
@@ -23,6 +23,9 @@ services:
       - LOG_LEVEL=${LOG_LEVEL}
       - API_TOKEN=${API_TOKEN}
       - TZ=${TZ}
+      - WORKERS_PER_CORE=1.5
+      - TIMEOUT=120
+      - GRACEFUL_TIMEOUT=120
       - DATABASE_TYPE=postgresql
       - POSTGRES_HOST=sba_postgres
       - POSTGRES_DB=${SBA_DATABASE}