shellius/docker-compose.deploy.yml at main · YavLabs/shellius · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
# =============================================================================
# Shellius — single-host deployment (builds from source)
#
# Tailored for 10.1.100.24: external Postgres + AWS S3 (no bundled pg/minio),
# bundled redis + guacd, served on host port 8100 behind an external reverse
# proxy (nginx proxy manager terminates TLS for https://shellius.ithena.app).
#
# Usage:
#   docker compose -f docker-compose.deploy.yml up -d --build
#
# The backend entrypoint runs `prisma migrate deploy` + the idempotent seed on
# start, so the external DB is migrated and the super admin is created
# automatically. Config comes from .env.prod.
# =============================================================================

services:
  redis:
    image: redis:7-alpine
    container_name: shellius-redis
    restart: unless-stopped
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  guacd:
    # Custom guacd build with H.264 (OpenH264) enabled so the RDP Graphics
    # Pipeline used by modern Windows hosts decodes instead of rendering black.
    # See docker/Dockerfile.guacd.
    build:
      context: .
      dockerfile: docker/Dockerfile.guacd
    image: shellius-guacd:h264
    container_name: shellius-guacd
    restart: unless-stopped
    # guacd writes RDP session recordings here and the backend reads them back
    # out. It has to be a shared volume: the recording is produced by guacd's
    # process on guacd's filesystem, so Node never sees those bytes until the
    # file is finished and readable from both sides.
    volumes:
      - rdp_recordings:/var/lib/shellius/rdp-recordings
  backend:
    build:
      context: .
      dockerfile: docker/Dockerfile.backend
      args:
        APP_VERSION: ${APP_VERSION:-dev}
        GIT_SHA: ${GIT_SHA:-local}
    image: shellius-backend:local
    container_name: shellius-api
    restart: unless-stopped
    env_file: .env.prod
    # The external DB is behind a transaction-mode connection pooler (PgBouncer),
    # which the Prisma *schema/migrate* engine cannot use. The schema is managed
    # out-of-band (prisma db push + baselined migrations), so we skip
    # `migrate deploy` here and run the idempotent seed + server directly. The
    # runtime query engine works through the pooler via ?pgbouncer=true.
    entrypoint: ["sh", "-c", "node prisma/seed.js || echo '[entrypoint] seed warning (continuing)'; exec node src/server.js"]
    environment:
      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
      GUACD_HOST: guacd
      RDP_RECORDINGS_DIR: /var/lib/shellius/rdp-recordings
      GUACD_RDP_RECORDINGS_DIR: /var/lib/shellius/rdp-recordings
      GUACD_PORT: "4822"
    depends_on:
      redis:
        condition: service_healthy
      guacd:
        condition: service_started
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3001/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 40s
    # guacd writes RDP session recordings here and the backend reads them back
    # out. It has to be a shared volume: the recording is produced by guacd's
    # process on guacd's filesystem, so Node never sees those bytes until the
    # file is finished and readable from both sides.
    volumes:
      - rdp_recordings:/var/lib/shellius/rdp-recordings
  frontend:
    build:
      context: .
      dockerfile: docker/Dockerfile.frontend
      args:
        APP_VERSION: ${APP_VERSION:-dev}
        GIT_SHA: ${GIT_SHA:-local}
    image: shellius-frontend:local
    container_name: shellius-web
    restart: unless-stopped

  nginx:
    image: nginx:alpine
    container_name: shellius-nginx
    restart: unless-stopped
    ports:
      - "8100:80"
    volumes:
      - ./docker/nginx-deploy.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - backend
      - frontend

volumes:
  rdp_recordings:
  redis_data: