halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(deploy): Docker Compose stack for the instance
Some checks failed
Analyze / analyze (push) Has been cancelled
Details
Format / format (push) Has been cancelled
Details
Tests / test (push) Has been cancelled
Details

Browse source 
Caddy, the Serverpod server and PostgreSQL 16 in deploy/. Only Caddy publishes ports; the server and Postgres are reachable only inside the Compose network (Docker bypasses ufw, and the server listens on every interface). Secrets come from deploy/.env as environment variables; there is no production passwords.yaml, and .dockerignore keeps local secrets out of the build context.

The server image builds on Serverpod's template with an Ubuntu 24.04 runtime: complete glibc incl. libgcc_s for the SQLite libraries Serverpod 4 bundles, CA certificates, a non-root user, and exec so SIGTERM reaches the server. The scaffold's dev-only docker-compose.yaml is removed.

Verified locally: image builds, all native libraries resolve, no passwords.yaml in the image, migrations apply at start, Caddy serves 200, port 8080 unreachable from the host, Postgres in UTC.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-09-27 17:18:31 +02:00
commit af3a01907e
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 172 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

16
halkyon_learn_server/config/production.yaml
View file

@ -16,16 +16,16 @@ apiServer:
#
# No webServer: there is no web app.
# This is the database setup for your servers. The default for the Google Cloud
# Engine Terraform configuration is to connect on a private IP address.
# If you are connecting on a public IP (e.g. on AWS or Google Cloud Run), you
# connect on the public IP of the database e.g. database.examplepod.com.
# The database: the `postgres` service of deploy/compose.yaml, reachable only inside
# the Compose network (it publishes no port), so no TLS between server and database.
# The password comes from the environment (SERVERPOD_DATABASE_PASSWORD, set in
# deploy/.env); there is no production passwords.yaml.
database:
host: database.private-production.examplepod.com
host: postgres
port: 5432
name: serverpod
user: postgres
requireSsl: true
name: halkyon_learn
user: halkyon_learn
requireSsl: false
#isUnixSocket: true # defaults to false
#maxConnectionCount: 10 # Defaults to 10, a negative or null value removes the limit