feat: optimize compression and production deployment
This commit is contained in:
237899745
45
docker/.env.production.example
Normal file
45
docker/.env.production.example
Normal file
@@ -0,0 +1,45 @@
|
||||
# Image tag built by docker/docker-compose.prod.yml
|
||||
IMAGEFORGE_TAG=local
|
||||
|
||||
# Public listener and URL
|
||||
IMAGEFORGE_BIND_ADDRESS=0.0.0.0
|
||||
IMAGEFORGE_PORT=8080
|
||||
PUBLIC_BASE_URL=http://192.0.2.10:8080
|
||||
|
||||
# Replace every secret before starting the stack.
|
||||
POSTGRES_PASSWORD=replace-with-a-long-random-password
|
||||
JWT_SECRET=replace-with-at-least-32-random-bytes
|
||||
API_KEY_PEPPER=replace-with-an-independent-random-secret
|
||||
|
||||
# Initial administrator created on first startup.
|
||||
ADMIN_EMAIL=admin@example.com
|
||||
ADMIN_USERNAME=admin
|
||||
ADMIN_PASSWORD=replace-with-a-strong-admin-password
|
||||
|
||||
# A four-core host should start with two image jobs per process.
|
||||
DATABASE_MAX_CONNECTIONS=10
|
||||
WORKER_CONCURRENCY=2
|
||||
IMAGE_PROCESSING_CONCURRENCY=2
|
||||
|
||||
ALLOW_ANONYMOUS_UPLOAD=true
|
||||
ANON_MAX_FILE_SIZE_MB=5
|
||||
ANON_MAX_FILES_PER_BATCH=5
|
||||
ANON_DAILY_UNITS=10
|
||||
ANON_RETENTION_HOURS=24
|
||||
MAX_IMAGE_PIXELS=40000000
|
||||
IDEMPOTENCY_TTL_HOURS=24
|
||||
|
||||
# Enable only when the API port is reachable exclusively through a trusted proxy.
|
||||
TRUST_PROXY_HEADERS=false
|
||||
MAIL_ENABLED=false
|
||||
MAIL_LOG_LINKS_WHEN_DISABLED=false
|
||||
# STRIPE_SECRET_KEY=sk_live_replace_me
|
||||
# STRIPE_WEBHOOK_SECRET=whsec_replace_me
|
||||
# MAIL_PROVIDER=custom
|
||||
# MAIL_FROM=noreply@example.com
|
||||
# MAIL_PASSWORD=replace-with-smtp-authorization-code
|
||||
# MAIL_FROM_NAME=ImageForge
|
||||
# MAIL_SMTP_HOST=smtp.example.com
|
||||
# MAIL_SMTP_PORT=465
|
||||
# MAIL_SMTP_ENCRYPTION=ssl
|
||||
RUST_LOG=info,tower_http=info,imageforge=info
|
||||
@@ -1,4 +1,6 @@
|
||||
FROM rust:1.92-bookworm AS builder
|
||||
# syntax=docker/dockerfile:1.7
|
||||
|
||||
FROM rust:1.92-trixie AS builder
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
@@ -14,35 +16,45 @@ COPY src ./src
|
||||
COPY migrations ./migrations
|
||||
COPY templates ./templates
|
||||
|
||||
RUN cargo build --release
|
||||
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
|
||||
--mount=type=cache,target=/app/target,sharing=locked \
|
||||
cargo build --release --locked \
|
||||
&& cp /app/target/release/imageforge /app/imageforge
|
||||
|
||||
FROM node:20-alpine AS frontend-builder
|
||||
FROM node:22-alpine AS frontend-builder
|
||||
|
||||
WORKDIR /app/frontend
|
||||
COPY frontend/package*.json ./
|
||||
RUN npm ci
|
||||
RUN --mount=type=cache,target=/root/.npm,sharing=locked npm ci
|
||||
COPY frontend ./
|
||||
RUN npm run build
|
||||
|
||||
FROM debian:bookworm-slim
|
||||
FROM debian:trixie-slim
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
ca-certificates \
|
||||
libdav1d6 \
|
||||
curl \
|
||||
libdav1d7 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN groupadd --system --gid 10001 imageforge \
|
||||
&& useradd --system --uid 10001 --gid imageforge --home-dir /app --shell /usr/sbin/nologin imageforge
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
COPY --from=builder /app/target/release/imageforge ./imageforge
|
||||
COPY --from=builder /app/imageforge ./imageforge
|
||||
COPY --from=frontend-builder /app/frontend/dist ./static
|
||||
COPY migrations ./migrations
|
||||
|
||||
RUN mkdir -p uploads
|
||||
RUN mkdir -p uploads \
|
||||
&& chown imageforge:imageforge uploads
|
||||
|
||||
ENV HOST=0.0.0.0
|
||||
ENV PORT=8080
|
||||
|
||||
EXPOSE 8080
|
||||
|
||||
USER 10001:10001
|
||||
|
||||
CMD ["./imageforge"]
|
||||
|
||||
|
||||
128
docker/docker-compose.prod.yml
Normal file
128
docker/docker-compose.prod.yml
Normal file
@@ -0,0 +1,128 @@
|
||||
name: imageforge
|
||||
|
||||
x-imageforge-environment: &imageforge-environment
|
||||
DATABASE_URL: postgres://imageforge:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/imageforge
|
||||
DATABASE_MAX_CONNECTIONS: ${DATABASE_MAX_CONNECTIONS:-10}
|
||||
REDIS_URL: redis://redis:6379
|
||||
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
|
||||
JWT_EXPIRY_HOURS: ${JWT_EXPIRY_HOURS:-168}
|
||||
API_KEY_PEPPER: ${API_KEY_PEPPER:?API_KEY_PEPPER is required}
|
||||
BILLING_PROVIDER: ${BILLING_PROVIDER:-stripe}
|
||||
STORAGE_TYPE: local
|
||||
STORAGE_PATH: /app/uploads
|
||||
PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:8080}
|
||||
WORKER_CONCURRENCY: ${WORKER_CONCURRENCY:-2}
|
||||
IMAGE_PROCESSING_CONCURRENCY: ${IMAGE_PROCESSING_CONCURRENCY:-2}
|
||||
ALLOW_ANONYMOUS_UPLOAD: ${ALLOW_ANONYMOUS_UPLOAD:-true}
|
||||
ANON_MAX_FILE_SIZE_MB: ${ANON_MAX_FILE_SIZE_MB:-5}
|
||||
ANON_MAX_FILES_PER_BATCH: ${ANON_MAX_FILES_PER_BATCH:-5}
|
||||
ANON_DAILY_UNITS: ${ANON_DAILY_UNITS:-10}
|
||||
ANON_RETENTION_HOURS: ${ANON_RETENTION_HOURS:-24}
|
||||
MAX_IMAGE_PIXELS: ${MAX_IMAGE_PIXELS:-40000000}
|
||||
IDEMPOTENCY_TTL_HOURS: ${IDEMPOTENCY_TTL_HOURS:-24}
|
||||
TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
|
||||
RUST_LOG: ${RUST_LOG:-info,tower_http=info,imageforge=info}
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:16-alpine
|
||||
environment:
|
||||
POSTGRES_DB: imageforge
|
||||
POSTGRES_USER: imageforge
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
volumes:
|
||||
- postgres_data:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U imageforge -d imageforge"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 20
|
||||
restart: unless-stopped
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
command: ["redis-server", "--appendonly", "yes", "--maxmemory-policy", "noeviction"]
|
||||
volumes:
|
||||
- redis_data:/data
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 20
|
||||
restart: unless-stopped
|
||||
|
||||
api:
|
||||
image: imageforge:${IMAGEFORGE_TAG:-local}
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile
|
||||
init: true
|
||||
environment:
|
||||
<<: *imageforge-environment
|
||||
IMAGEFORGE_ROLE: api
|
||||
ADMIN_EMAIL: ${ADMIN_EMAIL:-}
|
||||
ADMIN_USERNAME: ${ADMIN_USERNAME:-}
|
||||
ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
|
||||
STRIPE_SECRET_KEY: "${STRIPE_SECRET_KEY:-}"
|
||||
STRIPE_WEBHOOK_SECRET: "${STRIPE_WEBHOOK_SECRET:-}"
|
||||
MAIL_ENABLED: ${MAIL_ENABLED:-false}
|
||||
MAIL_LOG_LINKS_WHEN_DISABLED: ${MAIL_LOG_LINKS_WHEN_DISABLED:-false}
|
||||
MAIL_PROVIDER: ${MAIL_PROVIDER:-qq}
|
||||
MAIL_FROM: ${MAIL_FROM:-noreply@example.com}
|
||||
MAIL_PASSWORD: "${MAIL_PASSWORD:-}"
|
||||
MAIL_FROM_NAME: ${MAIL_FROM_NAME:-ImageForge}
|
||||
MAIL_SMTP_HOST: "${MAIL_SMTP_HOST:-}"
|
||||
MAIL_SMTP_PORT: "${MAIL_SMTP_PORT:-}"
|
||||
MAIL_SMTP_ENCRYPTION: "${MAIL_SMTP_ENCRYPTION:-}"
|
||||
ports:
|
||||
- "${IMAGEFORGE_BIND_ADDRESS:-0.0.0.0}:${IMAGEFORGE_PORT:-8080}:8080"
|
||||
volumes:
|
||||
- uploads:/app/uploads
|
||||
tmpfs:
|
||||
- /tmp:size=256m,mode=1777
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:8080/health"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 12
|
||||
start_period: 20s
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
read_only: true
|
||||
restart: unless-stopped
|
||||
|
||||
worker:
|
||||
image: imageforge:${IMAGEFORGE_TAG:-local}
|
||||
init: true
|
||||
environment:
|
||||
<<: *imageforge-environment
|
||||
IMAGEFORGE_ROLE: worker
|
||||
volumes:
|
||||
- uploads:/app/uploads
|
||||
tmpfs:
|
||||
- /tmp:size=256m,mode=1777
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
api:
|
||||
condition: service_healthy
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
read_only: true
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
postgres_data:
|
||||
redis_data:
|
||||
uploads:
|
||||
Reference in New Issue
Block a user