mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André BombeckandClaude Opus 4.7
75d142df25
Issue #88's biggest blocker was that docs and README pointed at ghcr.io/mbombeck/healthlog:latest, but no workflow ever pushed an image — every self-hoster trying to follow the docs hit "manifest unknown". This adds .github/workflows/docker-publish.yml. The workflow: - Triggers on push to main, on v* tags, on PRs (build only, no push), and via workflow_dispatch - Builds linux/amd64 + linux/arm64 multi-arch images via buildx - Tags with `latest` (main only), semver (`1.2.0`, `1.2`), branch name, PR number, and short SHA — using docker/metadata-action defaults - Attaches SLSA build provenance and an SBOM to every image - Caches build layers in GitHub Actions cache for fast iterations - Uses concurrency group + cancel-in-progress so superseded runs stop The bundled docker-compose.yml now references `ghcr.io/mbombeck/healthlog:latest` as the primary `image:` and keeps `build:` as a fallback so contributors can still `docker compose up --build` against their working tree. SECURITY.md gains a Supply Chain section explaining where images come from, how to verify provenance and SBOMs, and how to pin a specific version. README's Quick Start updated to reflect that no build is needed for self-hosters. The first run of this workflow on main will publish the image; until then `docker compose up` will fall back to the `build:` block. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
services:
|
|
app:
|
|
# Pre-built multi-arch images are published to GHCR by
|
|
# .github/workflows/docker-publish.yml on every push to main and on
|
|
# tagged releases. Pin to a specific version in production:
|
|
# e.g. ghcr.io/mbombeck/healthlog:1.2.0
|
|
image: ghcr.io/mbombeck/healthlog:latest
|
|
# Fallback build context: if the image is not yet in the registry,
|
|
# or you want to test local changes, run `docker compose up --build`.
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: healthlog-app
|
|
ports:
|
|
- "3000:3000"
|
|
environment:
|
|
DATABASE_URL: "postgresql://healthlog:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@db:5432/healthlog?schema=public"
|
|
NODE_ENV: production
|
|
SESSION_SECRET: "${SESSION_SECRET:?SESSION_SECRET is required}"
|
|
ENCRYPTION_KEY: "${ENCRYPTION_KEY:?ENCRYPTION_KEY is required}"
|
|
API_TOKEN_HMAC_KEY: "${API_TOKEN_HMAC_KEY:?API_TOKEN_HMAC_KEY is required}"
|
|
NEXT_PUBLIC_APP_URL: "${NEXT_PUBLIC_APP_URL:-http://localhost:3000}"
|
|
APP_URL: "${APP_URL:-http://localhost:3000}"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: postgres:16-alpine
|
|
container_name: healthlog-db
|
|
environment:
|
|
POSTGRES_USER: healthlog
|
|
POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}"
|
|
POSTGRES_DB: healthlog
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U healthlog"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
pgdata:
|