ultimate-ca-manager/docker-compose.prod.yml at main · NeySlim/ultimate-ca-manager · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
# ============================================================================
# UCM - Docker Compose Production Configuration
# ============================================================================
# Production-ready setup with security hardening and performance optimization
#
# Usage:
#   docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d
# ============================================================================


services:
  ucm:
    image: neyslim/ultimate-ca-manager:latest  # Use pre-built image

    # Production environment overrides
    environment:
      # Security
      - UCM_DEBUG=false
      - UCM_LOG_LEVEL=WARNING

      # Performance
      - UCM_CACHE_ENABLED=true
      - UCM_CACHE_DEFAULT_TIMEOUT=600

      # Backups
      - UCM_BACKUP_ENABLED=true
      - UCM_BACKUP_RETENTION_DAYS=90

    # Stricter resource limits for production
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 4G
        reservations:
          cpus: '1'
          memory: 1G

      # Restart policy
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s

    # Production logging
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "10"
        compress: "true"

    # Additional security
    read_only: false
    tmpfs:
      - /tmp:noexec,nosuid,size=100m

    labels:
      - "com.ultimate-ca-manager.environment=production"

# Production with reverse proxy (Nginx example)
  nginx:
    image: nginx:alpine
    container_name: ucm-nginx
    restart: unless-stopped

    ports:
      - "443:443"
      - "80:80"

    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - nginx-cache:/var/cache/nginx

    depends_on:
      ucm:
        condition: service_healthy

    networks:
      - ucm-network

    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:80/"]
      interval: 30s
      timeout: 5s
      retries: 3

    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"

volumes:
  nginx-cache:
    driver: local