halkyon/deploy/compose.todo.yaml

# Halkyon Todo's server beside the instance (ADR 0033, step 5). Switched on in .env,
# with Todo's domain and secrets:
#
#   COMPOSE_FILE=compose.learn.yaml:compose.todo.yaml
#   TODO_DOMAIN=todo.halkyon.eu
#
# Todo is a member of the instance's register, which Learn's server holds (ADR 0016),
# as Train is: one account a person, signing in through the register, the shared
# INSTANCE_SECRET on every call between them, which reach each other on the instance's
# own networks alone. Its database is `halkyon_todo` in the instance's PostgreSQL, under
# a role of its own that can't connect to Learn's or Train's. Its server reads no task:
# every row is sealed on the person's devices (ADR 0033, D5). Setting it up:
# sidecars/README.md, Todo.

services:
  todo-server:
    build:
      context: ..
      dockerfile: apps/todo/halkyon_todo_server/Dockerfile
    image: halkyon-todo-server
    restart: unless-stopped
    # As Learn's: migrations at every start (redeploy.sh has applied them before).
    command: ["--apply-migrations"]
    environment:
      SERVERPOD_DATABASE_PASSWORD: ${TODO_POSTGRES_PASSWORD:?set TODO_POSTGRES_PASSWORD in deploy/.env}
      SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper: ${TODO_SESSION_KEY_HASH_PEPPER:?set TODO_SESSION_KEY_HASH_PEPPER in deploy/.env}
      # Its public address, which config/production.yaml names otherwise: the
      # instance's own domain.
      SERVERPOD_API_SERVER_PUBLIC_HOST: ${TODO_DOMAIN:?set TODO_DOMAIN in deploy/.env}
      SERVERPOD_WEB_SERVER_PUBLIC_HOST: ${TODO_DOMAIN:?set TODO_DOMAIN in deploy/.env}
      # The register (ADR 0016): Learn's web server, on the instance's own network,
      # and the secret every call between them carries.
      ACCOUNT_REGISTER_URL: http://server:8082/
      SERVERPOD_PASSWORD_instanceSecret: ${INSTANCE_SECRET:?set INSTANCE_SECRET in deploy/.env}
      # Caddy, as for Learn's server (compose.learn.yaml).
      TRUSTED_PROXIES: 172.30.80.2 fd4a:6c6b:7e80::2
      SOURCE_URL: ${SOURCE_URL:-}
      DATA_LOCATION: ${DATA_LOCATION:-}
      BACKUP_LOCATION: ${BACKUP_LOCATION:-}
    networks:
      - default
      - edge
    depends_on:
      postgres:
        condition: service_healthy
    logging:
      driver: journald

  caddy:
    environment:
      TODO_DOMAIN: ${TODO_DOMAIN:?set TODO_DOMAIN in deploy/.env}
    volumes:
      - ./sidecars/todo.caddy:/etc/caddy/sidecars/todo.caddy:ro

  server:
    environment:
      # Todo's web server, told when an account goes (ADR 0016), beside the members
      # the other compose files and INSTANCE_MEMBERS name.
      INSTANCE_MEMBER_TODO: http://todo-server:8082/