Files
Meal-Planner/docker-compose.yml
T
admin 7838c49721
CI / backend (pytest + alembic) (push) Has been cancelled
CI / frontend (build) (push) Has been cancelled
feat(auth): harden sessions + HA Ingress support
- backend: settings SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH,
  require_session uses secrets.compare_digest and respects trusted-network
  opt-in, main.py adds require_family_session middleware gating all /api/
  routes except auth/admin/email-vote-token paths
- docker-compose: pass SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH
  through to backend + scheduler (fixes env-file changes not reaching runtime)
- frontend: Ingress path-prefix support (APP_BASE_PATH, BrowserRouter basename,
  vite base './'), Login redirect honors APP_BASE_PATH
- nginx: no-cache headers on root + /assets/
- docs: Home Assistant Ingress install/troubleshooting + plan file
- tests: test_auth expects 401 on no-session GET

Defaults: SESSION_COOKIE_SECURE=false, TRUSTED_NETWORK_AUTO_AUTH=true
(HA is the auth boundary; MealPlanner must not be port-forwarded directly).
2026-06-30 16:11:33 -07:00

121 lines
3.9 KiB
YAML

version: "3.8"
services:
backend:
build:
context: ./backend
dockerfile: Dockerfile
expose:
- "8000"
environment:
- DATABASE_URL=postgresql://mealplanner:${POSTGRES_PASSWORD}@db:5432/mealplanner
- SENDGRID_API_KEY=${SENDGRID_API_KEY}
- SPOONACULAR_API_KEY=${SPOONACULAR_API_KEY}
- OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-https://ollama.com/v1}
- OLLAMA_API_KEY=${OLLAMA_API_KEY}
- OLLAMA_MODEL=${OLLAMA_MODEL:-kimi-k2.6:cloud}
- LUCKY_CA_URL=${LUCKY_CA_URL:-https://luckysupermarkets.com}
- LUCKY_STORE_ID=${LUCKY_STORE_ID:-757}
- SWIFTLY_API_BASE=${SWIFTLY_API_BASE:-https://prod.swiftlyapi.net}
- SWIFTLY_CATEGORIES_URL=${SWIFTLY_CATEGORIES_URL:-https://luckysupermarkets.com/categories}
- AI_IMAGE_ENABLED=${AI_IMAGE_ENABLED:-false}
- AI_IMAGE_API_KEY=${OPENAI_API_KEY:-}
- OPENAI_API_KEY=${OPENAI_API_KEY:-}
- LOG_LEVEL=${LOG_LEVEL:-INFO}
- SECRET_KEY=${SECRET_KEY}
- ADMIN_TOKEN=${ADMIN_TOKEN}
- SESSION_PASSWORD=${SESSION_PASSWORD}
- SESSION_COOKIE_SECURE=${SESSION_COOKIE_SECURE:-false}
- TRUSTED_NETWORK_AUTO_AUTH=${TRUSTED_NETWORK_AUTO_AUTH:-true}
- EMAIL_BACKEND=${EMAIL_BACKEND:-console}
- ADMIN_EMAIL=${ADMIN_EMAIL:-}
- APP_BASE_URL=${APP_BASE_URL:-http://localhost}
depends_on:
db:
condition: service_healthy
restart: unless-stopped
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
interval: 30s
timeout: 10s
retries: 3
volumes:
- ./backend/static:/app/static:rw
scheduler:
build:
context: ./backend
dockerfile: Dockerfile
command: python -m app.scheduler
environment:
- DATABASE_URL=postgresql://mealplanner:${POSTGRES_PASSWORD}@db:5432/mealplanner
- SENDGRID_API_KEY=${SENDGRID_API_KEY}
- SPOONACULAR_API_KEY=${SPOONACULAR_API_KEY}
- OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-https://ollama.com/v1}
- OLLAMA_API_KEY=${OLLAMA_API_KEY}
- OLLAMA_MODEL=${OLLAMA_MODEL:-kimi-k2.6:cloud}
- LUCKY_CA_URL=${LUCKY_CA_URL:-https://luckysupermarkets.com}
- LUCKY_STORE_ID=${LUCKY_STORE_ID:-757}
- SWIFTLY_API_BASE=${SWIFTLY_API_BASE:-https://prod.swiftlyapi.net}
- SWIFTLY_CATEGORIES_URL=${SWIFTLY_CATEGORIES_URL:-https://luckysupermarkets.com/categories}
- AI_IMAGE_ENABLED=${AI_IMAGE_ENABLED:-false}
- AI_IMAGE_API_KEY=${OPENAI_API_KEY:-}
- OPENAI_API_KEY=${OPENAI_API_KEY:-}
- LOG_LEVEL=${LOG_LEVEL:-INFO}
- SECRET_KEY=${SECRET_KEY}
- ADMIN_TOKEN=${ADMIN_TOKEN}
- SESSION_PASSWORD=${SESSION_PASSWORD}
- SESSION_COOKIE_SECURE=${SESSION_COOKIE_SECURE:-false}
- TRUSTED_NETWORK_AUTO_AUTH=${TRUSTED_NETWORK_AUTO_AUTH:-true}
- EMAIL_BACKEND=${EMAIL_BACKEND:-console}
- ADMIN_EMAIL=${ADMIN_EMAIL:-}
- APP_BASE_URL=${APP_BASE_URL:-http://localhost}
depends_on:
db:
condition: service_healthy
restart: unless-stopped
volumes:
- ./backend/static:/app/static:rw
frontend:
build:
context: ./frontend
dockerfile: Dockerfile
expose:
- "80"
depends_on:
- backend
restart: unless-stopped
db:
image: postgres:15-alpine
volumes:
- postgres_data:/var/lib/postgresql/data
environment:
- POSTGRES_USER=mealplanner
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
- POSTGRES_DB=mealplanner
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "pg_isready -U mealplanner -d mealplanner"]
interval: 10s
timeout: 5s
retries: 5
nginx:
image: nginx:alpine
ports:
- "8082:80"
- "8444:443"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./nginx/ssl:/etc/nginx/ssl:ro
- ./backend/static:/app/static:ro
depends_on:
- frontend
- backend
restart: unless-stopped
volumes:
postgres_data: