watermaps/deploy/compose.production.yml

name: watermaps-production

services:
  watermaps:
    image: ${WATERMAPS_APP_IMAGE:?WATERMAPS_APP_IMAGE fehlt}
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: 5174
      DATABASE_URL: postgresql://seacompass@postgres:5432/seacompass
      PGPASSWORD: ${WATERMAPS_POSTGRES_PASSWORD:?WATERMAPS_POSTGRES_PASSWORD fehlt}
      REDIS_URL: ""
      WATERMAPS_WEB_DIST_PATH: /app/apps/web/dist
      WATERMAPS_LOCAL_FAIRWAYS_PATH: /data/germany-netherlands-fairways.json
      WATERMAPS_LIVE_FAIRWAYS: "false"
      WATERMAPS_DEMO_DATA: "false"
    expose:
      - "5174"
    volumes:
      - type: bind
        source: ${WATERMAPS_DATA_DIR:-/srv/watermaps-data}/local
        target: /data
        read_only: true
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped
    init: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - >-
          fetch('http://127.0.0.1:5174/ready')
          .then(response => { if (!response.ok) process.exit(1) })
          .catch(() => process.exit(1))
      interval: 15s
      timeout: 5s
      start_period: 15s
      retries: 5

  postgres:
    image: ${WATERMAPS_POSTGRES_IMAGE:-postgis/postgis:16-3.4}
    environment:
      POSTGRES_DB: seacompass
      POSTGRES_USER: seacompass
      POSTGRES_PASSWORD: ${WATERMAPS_POSTGRES_PASSWORD:?WATERMAPS_POSTGRES_PASSWORD fehlt}
    expose:
      - "5432"
    volumes:
      - type: bind
        source: ${WATERMAPS_DATA_DIR:-/srv/watermaps-data}/postgres
        target: /var/lib/postgresql/data
        bind:
          create_host_path: false
      - type: bind
        source: ./database/schema.sql
        target: /docker-entrypoint-initdb.d/01-schema.sql
        read_only: true
      - type: bind
        source: ./database/migrations
        target: /docker-entrypoint-initdb.d/migrations
        read_only: true
    restart: unless-stopped
    init: true
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready --username "$$POSTGRES_USER" --dbname "$$POSTGRES_DB"
      interval: 10s
      timeout: 5s
      start_period: 30s
      retries: 10
    stop_grace_period: 60s

  nginx:
    image: ${WATERMAPS_NGINX_IMAGE:-nginx:1.30.4-alpine}
    depends_on:
      watermaps:
        condition: service_healthy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - type: bind
        source: ${WATERMAPS_RUNTIME_DIR:-/srv/watermaps-runtime}/nginx/conf.d
        target: /etc/nginx/conf.d
        read_only: true
      - type: bind
        source: ${WATERMAPS_DATA_DIR:-/srv/watermaps-data}/certbot/www
        target: /var/www/certbot
        read_only: true
      - type: bind
        source: ${WATERMAPS_DATA_DIR:-/srv/watermaps-data}/certbot/letsencrypt
        target: /etc/letsencrypt
        read_only: true
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 5s
      retries: 3

  certbot:
    image: ${WATERMAPS_CERTBOT_IMAGE:-certbot/certbot:v5.7.0}
    profiles: ["maintenance"]
    volumes:
      - type: bind
        source: ${WATERMAPS_DATA_DIR:-/srv/watermaps-data}/certbot/www
        target: /var/www/certbot
      - type: bind
        source: ${WATERMAPS_DATA_DIR:-/srv/watermaps-data}/certbot/letsencrypt
        target: /etc/letsencrypt

  route-data:
    image: ${WATERMAPS_ROUTE_DATA_IMAGE:?WATERMAPS_ROUTE_DATA_IMAGE fehlt}
    profiles: ["maintenance"]
    environment:
      WATERMAPS_GEOFABRIK_DIR: /workspace/data/geofabrik
      WATERMAPS_LOCAL_FAIRWAYS_PATH: /workspace/data/local/germany-netherlands-fairways.json
    volumes:
      - type: bind
        source: ${WATERMAPS_DATA_DIR:-/srv/watermaps-data}
        target: /workspace/data
    restart: "no"

  marine-data:
    image: ${WATERMAPS_ROUTE_DATA_IMAGE:?WATERMAPS_ROUTE_DATA_IMAGE fehlt}
    profiles: ["maintenance"]
    entrypoint: ["/workspace/deploy/scripts/prepare-marine-features.sh"]
    environment:
      DATABASE_URL: postgresql://seacompass@postgres:5432/seacompass
      PGPASSWORD: ${WATERMAPS_POSTGRES_PASSWORD:?WATERMAPS_POSTGRES_PASSWORD fehlt}
      TMPDIR: /workspace/data/tmp
      WATERMAPS_GEOFABRIK_DIR: /workspace/data/geofabrik
      WATERMAPS_MARINE_MARKER_PATH: /workspace/data/local/.marine-features.ready
    volumes:
      - type: bind
        source: ${WATERMAPS_DATA_DIR:-/srv/watermaps-data}
        target: /workspace/data
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"