52 lines
1.7 KiB
Markdown
52 lines
1.7 KiB
Markdown
# Server deployment
|
|
|
|
The production image builds the Webpack site with Node and serves the generated `dist/` directory with an unprivileged Nginx process on port `8080`. The container does not publish a host port; Traefik reaches it over an external Docker network.
|
|
|
|
The runtime is read-only, drops every Linux capability, cannot gain new privileges, uses a bounded in-memory `/tmp`, and has CPU, memory, process, and log limits. Browser security headers are set by Nginx, and the site makes no third-party font, icon, or script requests.
|
|
|
|
## Defaults
|
|
|
|
| Setting | Default |
|
|
| --- | --- |
|
|
| Domain | `fiwlabs.dev` |
|
|
| Traefik network | `proxy` |
|
|
| HTTPS entrypoint | `websecure` |
|
|
| Certificate resolver | `porkbun` |
|
|
|
|
Compose reads overrides from `.env`. The available keys and defaults are documented in `.env.example`.
|
|
|
|
## Prerequisites
|
|
|
|
1. Point the `A` and optional `AAAA` records for `fiwlabs.dev` to the server.
|
|
2. Ensure Traefik has its Docker provider enabled.
|
|
3. Attach Traefik to the same external network configured by `TRAEFIK_NETWORK`.
|
|
4. Ensure the configured certificate resolver exists in Traefik.
|
|
|
|
Create the default shared network once if the Traefik stack has not already created it:
|
|
|
|
```sh
|
|
docker network create proxy
|
|
```
|
|
|
|
## Deploy
|
|
|
|
Validate the resolved Compose configuration:
|
|
|
|
```sh
|
|
docker compose -f docker-compose.yml config
|
|
```
|
|
|
|
Build and start the site:
|
|
|
|
```sh
|
|
docker compose -f docker-compose.yml up --build -d
|
|
```
|
|
|
|
Check container health and logs:
|
|
|
|
```sh
|
|
docker compose -f docker-compose.yml ps
|
|
docker compose -f docker-compose.yml logs -f fiws-page
|
|
```
|
|
|
|
The container exposes `/healthz` internally for Docker health checks. Traefik serves the site at `https://fiwlabs.dev`; the server's `web` entrypoint redirects HTTP requests to HTTPS globally.
|