38 lines
2.0 KiB
YAML
38 lines
2.0 KiB
YAML
# =============================================================================
|
|
# prod-smoke — a production-shaped runtime, for evidence, on a laptop.
|
|
#
|
|
# Not "production Compose". What it is for is proving that the prod profile's fail-closed validators
|
|
# can be satisfied at all: TLS on the JDBC URL, a schema Flyway owns, JSON logging, secret
|
|
# references rather than values. A prod lane that only ever gets as far as `config` proves the file
|
|
# parses, which was never the thing in doubt.
|
|
#
|
|
# The credentials here are generated per run by the lane wrapper. Nothing local is reused: a
|
|
# prod-smoke that borrows the local MinIO password is a prod-smoke that tests the local setup.
|
|
# =============================================================================
|
|
|
|
services:
|
|
app:
|
|
environment:
|
|
# Explicit, not inherited. A Compose profile selects services and says nothing about which
|
|
# environment the application believes it is in.
|
|
SPRING_PROFILES_ACTIVE: "prod"
|
|
TZ: "UTC"
|
|
# verify-full, which is the point: PostgreSqlTransportSecurityValidator refuses anything less,
|
|
# and that refusal is the behaviour this lane exists to satisfy rather than bypass.
|
|
APP_DATASOURCE_URL: "jdbc:postgresql://db:5432/${POSTGRES_DB:-ca_skeleton}?sslmode=verify-full&sslrootcert=/run/secrets/postgres-ca"
|
|
APP_DATASOURCE_USERNAME: "${APP_DATASOURCE_USERNAME:-ca_skeleton}"
|
|
# The password is deliberately absent here. An `environment:` entry beats `env_file:`, so
|
|
# declaring it as "${APP_DATASOURCE_PASSWORD:-}" read the host shell rather than the lane's
|
|
# generated file and injected an empty string — which the prod env validator then refused, for
|
|
# the right reason, about a value the lane had actually supplied.
|
|
APP_DATASOURCE_DDL_AUTO: "validate"
|
|
APP_LOG_JSON_ENABLED: "true"
|
|
APP_SECURITY_JWT_ISSUER: "http://keycloak:8080/realms/ca-skeleton"
|
|
APP_SECURITY_JWT_AUDIENCE: "ca-skeleton-api"
|
|
networks:
|
|
- caskeleton-infra
|
|
|
|
networks:
|
|
caskeleton-infra:
|
|
external: false
|