services: postgres: image: postgres:18 container_name: procurement-postgres environment: POSTGRES_DB: procurement POSTGRES_USER: postgres POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres} ports: - "5433:5432" networks: - default - shared volumes: - postgres_data:/var/lib/postgresql - ./sql/migration.sql:/docker-entrypoint-initdb.d/01-migration.sql:ro - ./sql/02-casdoor-db.sql:/docker-entrypoint-initdb.d/02-casdoor-db.sql:ro healthcheck: test: ["CMD-SHELL", "pg_isready -U postgres -d procurement"] interval: 5s timeout: 5s retries: 10 restart: unless-stopped mem_limit: 1g traefik: image: traefik:v3.6 container_name: procurement-traefik restart: unless-stopped mem_limit: 128m command: - --providers.docker=true - --providers.docker.exposedbydefault=false - --providers.docker.network=traefik_network - --providers.file.filename=/etc/traefik/dynamic.yml - --entrypoints.web.address=:80 - --entrypoints.websecure.address=:443 - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL:-admin@example.com} - --certificatesresolvers.letsencrypt.acme.storage=/certs/acme.json - --certificatesresolvers.letsencrypt.acme.httpchallenge=true - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web - --log.level=INFO ports: - "80:80" - "443:443" volumes: - /var/run/docker.sock:/var/run/docker.sock - ./infra/traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro - traefik_certs:/certs networks: - traefik_network minio: image: minio/minio:latest container_name: procurement-minio command: server /data --console-address ":9001" environment: MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin} MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin} ports: - "9000:9000" - "9001:9001" volumes: - minio_data:/data labels: - "traefik.enable=true" - "traefik.http.routers.minio-api.rule=Host(`${S3_HOST:-s3.localhost}`)" - "traefik.http.routers.minio-api.entrypoints=web" - "traefik.http.services.minio-api-svc.loadbalancer.server.port=9000" - "traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:-storage.localhost}`)" - "traefik.http.routers.minio-console.entrypoints=web" - "traefik.http.routers.minio-console.service=minio-console-svc" - "traefik.http.services.minio-console-svc.loadbalancer.server.port=9001" networks: - traefik_network - default restart: unless-stopped mem_limit: 512m minio-init: image: minio/mc:latest container_name: procurement-minio-init depends_on: minio: condition: service_started environment: MINIO_ENDPOINT: minio:9000 MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin} MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin} MINIO_BUCKET: procurement-files entrypoint: ["/bin/sh", "-c", "until mc alias set local http://$${MINIO_ENDPOINT}$${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD}; do echo 'waiting for minio server...'; sleep 2; done; mc mb --ignore-existing local/$${MINIO_BUCKET}; echo bucket ready;"] restart: "no" db-backup: image: postgres:18 container_name: procurement-db-backup depends_on: postgres: condition: service_healthy environment: PGPASSWORD: ${POSTGRES_PASSWORD:-postgres} BACKUP_INTERVAL_SECONDS: ${BACKUP_INTERVAL_SECONDS:-86400} BACKUP_KEEP_DAYS: ${BACKUP_KEEP_DAYS:-14} volumes: - ${BACKUP_DIR:-./backups}:/backups entrypoint: ["/bin/sh", "-c", "while true; do STAMP=$$(date +%Y%m%d-%H%M%S); pg_dump -h postgres -U postgres -d procurement -Fc -f /backups/procurement-$${STAMP}.dump; pg_dump -h postgres -U postgres -d casdoor -Fc -f /backups/casdoor-$${STAMP}.dump; find /backups -name '*.dump' -mtime +$${BACKUP_KEEP_DAYS} -delete; sleep $${BACKUP_INTERVAL_SECONDS}; done"] restart: unless-stopped mem_limit: 256m casdoor: image: casbin/casdoor:latest container_name: procurement-casdoor depends_on: postgres: condition: service_healthy environment: RUNNING_IN_DOCKER: "true" driverName: postgres dataSourceName: "user=casdoor password=casdoor host=postgres port=5432 sslmode=disable dbname=casdoor" dbName: casdoor origin: "http://localhost:8080" ports: - "8080:8000" labels: - "traefik.enable=true" - "traefik.http.routers.casdoor.rule=Host(`${AUTH_HOST:-auth.localhost}`)" - "traefik.http.routers.casdoor.entrypoints=web" - "traefik.http.services.casdoor.loadbalancer.server.port=8000" networks: - traefik_network - default restart: unless-stopped mem_limit: 768m api: build: context: ./backend dockerfile: Dockerfile container_name: procurement-api environment: PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/procurement PROCUREMENT_MINIO_ENDPOINT: minio:9000 PROCUREMENT_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin} PROCUREMENT_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin} PROCUREMENT_MINIO_BUCKET: procurement-files PROCUREMENT_MINIO_SECURE: "false" PROCUREMENT_ENVIRONMENT: ${ENVIRONMENT:-dev} PROCUREMENT_DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false} PROCUREMENT_CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost,http://localhost:3000,http://localhost:5173,http://192.168.1.104} PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000 PROCUREMENT_CASDOOR_ISSUER: ${CASDOOR_ISSUER:-http://localhost:8080} PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client PROCUREMENT_CASDOOR_CLIENT_SECRET: ${CASDOOR_CLIENT_SECRET:-inventory-app-secret-2026} PROCUREMENT_CASDOOR_ORGANIZATION: inventory PROCUREMENT_CASDOOR_APP_NAME: inventory-app PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client PROCUREMENT_CASDOOR_ADMIN_USER: admin PROCUREMENT_CASDOOR_ADMIN_PASSWORD: ${CASDOOR_ADMIN_PASSWORD:-123} PROCUREMENT_LOG_FORMAT: ${LOG_FORMAT:-text} PROCUREMENT_SENTRY_DSN: ${SENTRY_DSN_BACKEND:-} PROCUREMENT_OPENPANEL_API_URL: ${OPENPANEL_API_URL:-} PROCUREMENT_OPENPANEL_CLIENT_ID: ${OPENPANEL_CLIENT_ID:-} PROCUREMENT_OPENPANEL_CLIENT_SECRET: ${OPENPANEL_CLIENT_SECRET:-} ports: - "8000:8000" networks: - traefik_network - default - shared healthcheck: test: ["CMD-SHELL", "python -c \"import urllib.request as u; u.urlopen('http://127.0.0.1:8000/health', timeout=3)\""] interval: 30s timeout: 5s retries: 5 start_period: 40s labels: - "traefik.enable=true" - "traefik.http.routers.api.rule=Host(`${API_HOST:-api.localhost}`)" - "traefik.http.routers.api.entrypoints=web" - "traefik.http.services.api.loadbalancer.server.port=8000" depends_on: postgres: condition: service_healthy minio-init: condition: service_completed_successfully restart: unless-stopped mem_limit: 768m frontend: build: context: ./frontend args: DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false} NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com} VITE_OPENPANEL_URL: ${OPENPANEL_PUBLIC_URL:-} VITE_OPENPANEL_CLIENT_ID: ${OPENPANEL_CLIENT_ID:-} VITE_SENTRY_DSN: ${SENTRY_DSN_FRONTEND:-} container_name: procurement-frontend entrypoint: ["nginx", "-g", "daemon off;"] labels: - "traefik.enable=true" - "traefik.http.routers.frontend.rule=PathPrefix(`/`)" - "traefik.http.routers.frontend.entrypoints=web" - "traefik.http.services.frontend.loadbalancer.server.port=80" networks: - traefik_network - default depends_on: - api restart: unless-stopped mem_limit: 128m networks: traefik_network: name: traefik_network driver: bridge shared: name: erp_shared driver: bridge volumes: postgres_data: minio_data: traefik_certs: