feat: optimize compression and production deployment

docker/docker-compose.prod.yml

@@ -0,0 +1,128 @@
+name: imageforge
+
+x-imageforge-environment: &imageforge-environment
+  DATABASE_URL: postgres://imageforge:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/imageforge
+  DATABASE_MAX_CONNECTIONS: ${DATABASE_MAX_CONNECTIONS:-10}
+  REDIS_URL: redis://redis:6379
+  JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
+  JWT_EXPIRY_HOURS: ${JWT_EXPIRY_HOURS:-168}
+  API_KEY_PEPPER: ${API_KEY_PEPPER:?API_KEY_PEPPER is required}
+  BILLING_PROVIDER: ${BILLING_PROVIDER:-stripe}
+  STORAGE_TYPE: local
+  STORAGE_PATH: /app/uploads
+  PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:8080}
+  WORKER_CONCURRENCY: ${WORKER_CONCURRENCY:-2}
+  IMAGE_PROCESSING_CONCURRENCY: ${IMAGE_PROCESSING_CONCURRENCY:-2}
+  ALLOW_ANONYMOUS_UPLOAD: ${ALLOW_ANONYMOUS_UPLOAD:-true}
+  ANON_MAX_FILE_SIZE_MB: ${ANON_MAX_FILE_SIZE_MB:-5}
+  ANON_MAX_FILES_PER_BATCH: ${ANON_MAX_FILES_PER_BATCH:-5}
+  ANON_DAILY_UNITS: ${ANON_DAILY_UNITS:-10}
+  ANON_RETENTION_HOURS: ${ANON_RETENTION_HOURS:-24}
+  MAX_IMAGE_PIXELS: ${MAX_IMAGE_PIXELS:-40000000}
+  IDEMPOTENCY_TTL_HOURS: ${IDEMPOTENCY_TTL_HOURS:-24}
+  TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
+  RUST_LOG: ${RUST_LOG:-info,tower_http=info,imageforge=info}
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: imageforge
+      POSTGRES_USER: imageforge
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U imageforge -d imageforge"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    command: ["redis-server", "--appendonly", "yes", "--maxmemory-policy", "noeviction"]
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    restart: unless-stopped
+
+  api:
+    image: imageforge:${IMAGEFORGE_TAG:-local}
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+    init: true
+    environment:
+      <<: *imageforge-environment
+      IMAGEFORGE_ROLE: api
+      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
+      ADMIN_USERNAME: ${ADMIN_USERNAME:-}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
+      STRIPE_SECRET_KEY: "${STRIPE_SECRET_KEY:-}"
+      STRIPE_WEBHOOK_SECRET: "${STRIPE_WEBHOOK_SECRET:-}"
+      MAIL_ENABLED: ${MAIL_ENABLED:-false}
+      MAIL_LOG_LINKS_WHEN_DISABLED: ${MAIL_LOG_LINKS_WHEN_DISABLED:-false}
+      MAIL_PROVIDER: ${MAIL_PROVIDER:-qq}
+      MAIL_FROM: ${MAIL_FROM:-noreply@example.com}
+      MAIL_PASSWORD: "${MAIL_PASSWORD:-}"
+      MAIL_FROM_NAME: ${MAIL_FROM_NAME:-ImageForge}
+      MAIL_SMTP_HOST: "${MAIL_SMTP_HOST:-}"
+      MAIL_SMTP_PORT: "${MAIL_SMTP_PORT:-}"
+      MAIL_SMTP_ENCRYPTION: "${MAIL_SMTP_ENCRYPTION:-}"
+    ports:
+      - "${IMAGEFORGE_BIND_ADDRESS:-0.0.0.0}:${IMAGEFORGE_PORT:-8080}:8080"
+    volumes:
+      - uploads:/app/uploads
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:8080/health"]
+      interval: 10s
+      timeout: 3s
+      retries: 12
+      start_period: 20s
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    restart: unless-stopped
+
+  worker:
+    image: imageforge:${IMAGEFORGE_TAG:-local}
+    init: true
+    environment:
+      <<: *imageforge-environment
+      IMAGEFORGE_ROLE: worker
+    volumes:
+      - uploads:/app/uploads
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      api:
+        condition: service_healthy
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    restart: unless-stopped
+
+volumes:
+  postgres_data:
+  redis_data:
+  uploads: