Files

T

Arnaud 68f0f490b9 chore: move docker/ compose files and infra to repo root

Moved compose.yml, compose.prod.yml, DEPLOY.md, traefik/, and cron/ out
of docker/ into the repo root (docker/ removed). Updated every reference:

- Dockerfile: COPY paths for the cron stage
- .dockerignore: dropped the now-unneeded docker/!docker-cron
  exclude+exception pair (cron/ is just a normal top-level dir now, no
  special-casing needed)
- compose.prod.yml: build context ".." -> "." (Dockerfile and compose
  files are now siblings, not one level apart)
- CLAUDE.md, DEPLOY.md, compose.yml, traefik/epicure.yml,
  cron/run-digest.sh, weekly-digest route.ts: path references in comments/
  docs

Verified: both compose files validate, and all three Dockerfile targets
(runner/cron/migrator) build clean via a local --no-cache docker build
from the new layout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-11 20:25:38 +02:00

3.2 KiB

Raw Permalink Blame History

Deploy: Portainer (git stack) + external Traefik LXC

Portainer

Stacks → Add stack → Repository
Repository URL: this repo. Reference: branch to track (e.g. main)
Compose path: compose.prod.yml
Environment variables (Portainer stack env, not committed):

POSTGRES_DB=epicure
POSTGRES_USER=epicure
POSTGRES_PASSWORD=<generate>
REDIS_PASSWORD=<generate>
MINIO_ROOT_USER=<generate>
MINIO_ROOT_PASSWORD=<generate>
BETTER_AUTH_SECRET=<openssl rand -base64 32>
BETTER_AUTH_URL=https://HOST_DOMAIN
ENCRYPTION_SECRET=<openssl rand -base64 32>
NEXT_PUBLIC_VAPID_PUBLIC_KEY=<npx web-push generate-vapid-keys>
VAPID_PRIVATE_KEY=<from same command>
WEB_PORT=3000
# optional
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
NEXT_PUBLIC_GITHUB_ENABLED=
DISCORD_CLIENT_ID=
DISCORD_CLIENT_SECRET=
NEXT_PUBLIC_DISCORD_ENABLED=
AUTHENTIK_CLIENT_ID=
AUTHENTIK_CLIENT_SECRET=
AUTHENTIK_BASE_URL=
NEXT_PUBLIC_AUTHENTIK_ENABLED=
SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=
SMTP_PASS=
SMTP_FROM=Epicure <noreply@epicure.app>
STRIPE_WEBHOOK_SECRET=
OPENROUTER_API_KEY=
OPENROUTER_DEFAULT_MODEL=
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
OLLAMA_BASE_URL=

Every var listed here must exist in compose.prod.yml's web.environment block to actually reach the container — Portainer stack env alone isn't enough, it only fills in ${...} refs the compose file declares.

NEXT_PUBLIC_* vars (NEXT_PUBLIC_VAPID_PUBLIC_KEY, NEXT_PUBLIC_GITHUB_ENABLED, NEXT_PUBLIC_DISCORD_ENABLED, NEXT_PUBLIC_AUTHENTIK_ENABLED) are baked into the client JS bundle at build time, not read at container startup — they're wired as Docker build.args in compose.prod.yml, not just environment. Changing one of these requires Portainer to actually rebuild the image (redeploy with "re-pull image and rebuild"), a plain container restart won't pick up the new value.

Deploy the stack. Portainer builds web from the repo's root Dockerfile (see build: in compose.prod.yml) — no separate image push needed.
Enable GitOps updates (webhook or polling) on the stack if you want redeploy-on-push.

Migrations + seed

Handled automatically. The migrate service builds from the migrator Dockerfile target, runs drizzle-kit migrate then the tier-definitions seed, and exits; web waits for it to complete successfully before starting (depends_on: migrate: condition: service_completed_successfully). Both are idempotent — safe to re-run on every stack redeploy, not just the first one.

Traefik (separate LXC, file provider)

Copy traefik/epicure.yml into the traefik LXC's dynamic config directory.
Replace HOST_DOMAIN with the public hostname and PORTAINER_LXC_IP with the portainer LXC's network IP (must match WEB_PORT published in compose.prod.yml).
Confirm certResolver name matches what's set in traefik's static config.
Traefik picks it up automatically (file provider watches for changes) — no restart needed.

Notes

web connects to postgres/redis/minio over the compose-internal network; only web's port is published to the LXC host for traefik to reach.
apps/web/next.config.ts has output: "standalone" — required for the Dockerfile's slim runtime stage.