ultimate-ca-manager/docker-compose.dev.yml at main · NeySlim/ultimate-ca-manager · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# ============================================================================
# UCM - Docker Compose Development Configuration
# ============================================================================
# Development setup with hot-reload, debugging, and verbose logging
#
# Usage:
#   docker-compose -f docker-compose.yml -f docker-compose.dev.yml up
#
# REQUIRES Docker Compose >= 2.24: the `ports: !override` below is a hard
# parse error on older releases ("!override" is reported as an unknown YAML
# tag). Upgrade Compose rather than removing the tag — without it the base
# file's all-interfaces port publishes silently survive the merge.
#
# ############################################################################
# # NEVER EXPOSE THIS CONFIGURATION TO AN UNTRUSTED NETWORK.                ##
# # FLASK_DEBUG=true enables the Werkzeug debug middleware: its traceback   ##
# # pages disclose source code and variable contents to ANY client with no  ##
# # authentication, and its PIN-gated console is remote code execution.     ##
# # The debugpy port is an unauthenticated Python debugger. ALL published   ##
# # ports (8443, 8080, 5678, mailhog) are therefore bound to 127.0.0.1 by   ##
# # default so they stay on the developer's machine. If Docker runs inside  ##
# # a VM and you need the app from outside it, set UCM_DEV_BIND to the      ##
# # VM-internal interface — that re-exposes the Werkzeug debugger to        ##
# # whatever can reach it, so only do so on a trusted, isolated network.    ##
# # Never use this file in production.                                      ##
# ############################################################################
# ============================================================================


services:
  ucm:
    build:
      context: .
      dockerfile: Dockerfile

    # Mount source code for hot-reload
    volumes:
      - ./backend:/opt/ucm/backend:rw
      - ./frontend:/opt/ucm/frontend:rw
      - ucm-data:/opt/ucm/data

      # Don't mount these (keep container versions)
      # - ./backend/__pycache__
      # - ./backend/.pytest_cache

    # Development environment
    environment:
      # Debug mode
      - UCM_DEBUG=true
      - UCM_LOG_LEVEL=DEBUG

      # Flask debug mode (hot-reload)
      - FLASK_DEBUG=true

      # Disable caching for development
      - UCM_CACHE_ENABLED=false

      # Disable backups for development
      - UCM_BACKUP_ENABLED=false

      # Verbose SQL logging
      - SQL_DEBUG=false  # Set true if needed (very verbose!)

      # Test SMTP (use Mailhog or similar)
      - UCM_SMTP_ENABLED=false
      - UCM_SMTP_SERVER=mailhog
      - UCM_SMTP_PORT=1025
      - UCM_SMTP_TLS=false

    # Override command to use Flask dev server with auto-reload
    command: python3 -m flask run --host=0.0.0.0 --port=8443 --cert=data/https_cert.pem --key=data/https_key.pem --reload

    # Expose the dev server and debugger, loopback-only by default.
    # `!override` REPLACES the base file's port list instead of merging with
    # it: Compose merges `ports` entries by (host_ip, published, protocol),
    # so a bare `127.0.0.1:` prefix here would silently APPEND to the base
    # file's 0.0.0.0 publishes and leave the Werkzeug debugger reachable
    # from the network. Requires Docker Compose >= 2.24.
    # Docker-in-a-VM escape hatch: set UCM_DEV_BIND to the VM-internal
    # interface (see the banner above before doing so).
    ports: !override
      - "${UCM_DEV_BIND:-127.0.0.1}:${UCM_HTTPS_PORT:-8443}:8443"
      - "${UCM_DEV_BIND:-127.0.0.1}:${UCM_HTTP_PORT:-8080}:8080"
      # The unauthenticated Python debugger stays loopback-only
      # unconditionally — tunnel (`ssh -L 5678:127.0.0.1:5678 <vm>`) if you
      # need it from another machine.
      - "127.0.0.1:5678:5678"  # Python debugger (debugpy)

    # Relaxed resource limits for development
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G

    # Development logging (more verbose)
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

    labels:
      - "com.ultimate-ca-manager.environment=development"

  # Optional: Mailhog for testing email notifications
  mailhog:
    image: mailhog/mailhog:latest
    container_name: ucm-mailhog
    restart: unless-stopped

    # Loopback-only like the app ports (the banner's containment claim covers
    # every published port); UCM_DEV_BIND is the same VM escape hatch.
    ports:
      - "${UCM_DEV_BIND:-127.0.0.1}:8025:8025"  # Web UI
      - "${UCM_DEV_BIND:-127.0.0.1}:1025:1025"  # SMTP

    networks:
      - ucm-network

    labels:
      - "com.ultimate-ca-manager.service=mailhog"

  # Optional: Redis for testing caching
  # redis:
  #   image: redis:alpine
  #   container_name: ucm-redis
  #   restart: unless-stopped
  #
  #   ports:
  #     - "6379:6379"
  #
  #   networks:
  #     - ucm-network