Initial Commit

ops/registry/docker-compose.yml

@@ -0,0 +1,56 @@
+# Single-service Docker Compose for ui.suaveplan.com.
+#
+# The Caddy container serves /srv/registry from the OVH host as
+# read-only. Cert state survives container restarts via the named
+# `caddy_data` and `caddy_config` volumes — restarting the container
+# does NOT trigger an ACME re-issuance.
+#
+# Usage on the OVH host:
+#   cp .env.example .env  # fill in placeholder values if any deploy
+#                         # script reads them; runtime needs none.
+#   docker compose up -d
+#
+# Verify:
+#   curl -fsSL https://ui.suaveplan.com/health  # → "ok"
+#   docker compose ps                            # status: healthy
+
+services:
+  registry:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: suaveplan/registry:latest
+    container_name: suaveplan-registry
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      # Static content tree — populated by the GitHub Actions deploy
+      # job via rsync. Read-only inside the container; Caddy never
+      # mutates the served files.
+      - /srv/registry:/srv/registry:ro
+      # Cert state and config cache. Persists across container
+      # rebuilds so Let's Encrypt isn't re-hit on every deploy.
+      - caddy_data:/data
+      - caddy_config:/config
+    environment:
+      # No secrets here. ACME contact email is baked into Caddyfile.
+      TZ: UTC
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O- --no-check-certificate https://127.0.0.1/health | grep -q '^ok$$' || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    logging:
+      driver: json-file
+      options:
+        max-size: "50m"
+        max-file: "5"
+
+volumes:
+  caddy_data:
+    name: suaveplan_registry_caddy_data
+  caddy_config:
+    name: suaveplan_registry_caddy_config