docs(README): добавлены инструкции по локальному запуску и развертыванию с Traefik

2026-07-18 18:56:37 +07:00
parent a4ece3d344
commit 638df5d679
3 changed files with 442 additions and 0 deletions
@@ -0,0 +1,67 @@
+# Auth Portal behind an existing Traefik (production).
+# Docs: docs/deploy-traefik.md
+#
+# Usage on server:
+#   cp deploy/docker-compose.traefik.yml /opt/auth-portal/docker-compose.yml
+#   # edit networks.proxy.name if your Traefik network is not "proxy"
+#   docker compose --env-file .env up -d
+
+services:
+  app:
+    image: git.shts.su/denozord/auth-portal:${AUTH_IMAGE_TAG:-latest}
+    pull_policy: always
+    container_name: auth-portal
+    restart: unless-stopped
+    # Do not publish ports — Traefik reaches the container on the shared network.
+    # ports:
+    #   - "8080:8080"
+    env_file:
+      - .env
+    environment:
+      DATABASE_URL: sqlite:/data/app.db
+      STATIC_DIR: /app/static
+      NODE_ENV: production
+      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env}
+      JWT_TTL_HOURS: ${JWT_TTL_HOURS:-1}
+      REFRESH_TTL_DAYS: ${REFRESH_TTL_DAYS:-14}
+      ISSUER: ${ISSUER:-https://auth.shnt.top}
+      ADMIN_EMAIL: ${ADMIN_EMAIL:[email protected]}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env}
+      ADMIN_NAME: ${ADMIN_NAME:-Admin}
+      RETURN_TO_ALLOWLIST: ${RETURN_TO_ALLOWLIST:-.shnt.top}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
+    volumes:
+      - ./data:/data
+    networks:
+      - proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=proxy
+      - traefik.http.routers.auth-portal.rule=Host(`${AUTH_DOMAIN:-auth.shnt.top}`)
+      - traefik.http.routers.auth-portal.entrypoints=websecure
+      - traefik.http.routers.auth-portal.tls=true
+      - traefik.http.routers.auth-portal.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}
+      - traefik.http.services.auth-portal.loadbalancer.server.port=8080
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
+        ]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+networks:
+  proxy:
+    external: true
+    # Rename if Traefik uses another network (traefik, web, edge, …):
+    name: proxy