Vault/docker-compose.yml

version: '3.9'

services:
  cms:
    # Image from Local Docker Registry
    # Running on 192.168.0.107:5000
    image: 192.168.0.107:5000/owi-cms:latest
    container_name: college-cms
    restart: unless-stopped
    ports:
      - "3000:3000"

    # Hardening: the app can't modify its own files, gain privileges, or use
    # Linux capabilities. Only /tmp, the Next.js cache and /uploads are writable.
    read_only: true
    tmpfs:
      - /tmp
      - /app/.next/cache:uid=1000,gid=1000
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    # Environment variables required for production
    environment:
      # Database connection (must match PostgreSQL service)
      DATABASE_URL: postgresql://cms_user:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@postgres:5432/cms_db

      # NextAuth configuration
      NEXTAUTH_URL: http://localhost:3000  # Update to your production domain
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}  # Set via .env file

      # Google OAuth (from .env)
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}

      # Admin email whitelist (comma-separated)
      ALLOWED_ADMINS: ${ALLOWED_ADMINS:-admin@university.edu}

      # Shared secret for the remote transcoder API
      TRANSCODER_SECRET: ${TRANSCODER_SECRET}

      # Upload directory (external to Next.js public folder)
      UPLOADS_DIR: /uploads

    # Mounted volumes for persistent data
    volumes:
      # Mount uploads directory as bind mount for real-time file sync
      # Must be writable by uid 1000: chown -R 1000:1000 /mnt/lab/configs/owicms/uploads
      - /mnt/lab/configs/owicms/uploads:/uploads

    # Wait for database to be ready before starting
    depends_on:
      postgres:
        condition: service_healthy

    # Health check
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  postgres:
    image: postgres:16-alpine
    container_name: college-postgres
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true

    environment:
      POSTGRES_USER: cms_user
      # Only applied when the data volume is first created. To change the
      # password of an existing database, also run ALTER USER cms_user PASSWORD '...'
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
      POSTGRES_DB: cms_db

    # Mounted volume for database persistence
    volumes:
      - postgres_data:/var/lib/postgresql/data

    # Health check
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U cms_user"]
      interval: 10s
      timeout: 5s
      retries: 5

  transcoder:
    build:
      context: .
      dockerfile: Dockerfile.transcoder
    container_name: college-transcoder
    restart: on-failure
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    # Environment variables
    environment:
      # Database connection (must match PostgreSQL service)
      DATABASE_URL: postgresql://cms_user:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@postgres:5432/cms_db

      # Transcoder configuration
      UPLOADS_DIR: /uploads
      NODE_ENV: production

    # Mounted volumes for access to uploads
    volumes:
      # Mount uploads directory using bind mount for real-time file sync
      - /mnt/lab/configs/owicms/uploads:/uploads

    # Wait for database and CMS to be ready
    depends_on:
      postgres:
        condition: service_healthy
      cms:
        condition: service_healthy

    # Note: This transcoder runs as a batch job.
    # It processes all 'uploaded' videos and exits.
    # With restart: on-failure, it will restart and process new videos.
    # For scheduled transcoding, consider using cron or a task scheduler.