00d3906fd2
- Add Dockerfile.prod for unionflow-server (backend) with production settings - Add Dockerfile.prod for unionflow-client (frontend) with production settings - Add unionflow-realm-production.json with SUPER_ADMIN role and unionflow-client - Configure for deployment on https://unionflow.lions.dev Database: unionflow on postgresql.postgresql.svc.cluster.local Keycloak: https://security.lions.dev/realms/unionflow Backend: Port 8085, https://api.lions.dev/unionflow Frontend: Port 8086, https://unionflow.lions.dev
92 lines
3.0 KiB
Docker
92 lines
3.0 KiB
Docker
####
|
|
# Dockerfile de production pour UnionFlow Server (Backend)
|
|
# Multi-stage build optimisé avec sécurité renforcée
|
|
####
|
|
|
|
## Stage 1 : Build avec Maven
|
|
FROM maven:3.9.6-eclipse-temurin-17 AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Copier les fichiers de configuration Maven
|
|
COPY pom.xml .
|
|
COPY ../unionflow-server-api/pom.xml ../unionflow-server-api/
|
|
|
|
# Télécharger les dépendances (cache Docker)
|
|
RUN mvn dependency:go-offline -B -pl unionflow-server-impl-quarkus -am
|
|
|
|
# Copier le code source
|
|
COPY src ./src
|
|
|
|
# Construire l'application avec profil production
|
|
RUN mvn clean package -DskipTests -B -Dquarkus.profile=prod -pl unionflow-server-impl-quarkus
|
|
|
|
## Stage 2 : Image de production optimisée
|
|
FROM registry.access.redhat.com/ubi8/openjdk-17:1.18
|
|
|
|
ENV LANGUAGE='en_US:en'
|
|
|
|
# Configuration des variables d'environnement pour production
|
|
ENV QUARKUS_PROFILE=prod
|
|
ENV QUARKUS_HTTP_PORT=8085
|
|
ENV QUARKUS_HTTP_HOST=0.0.0.0
|
|
|
|
# Configuration Base de données (à surcharger via variables d'environnement)
|
|
ENV DB_URL=jdbc:postgresql://postgresql:5432/unionflow
|
|
ENV DB_USERNAME=unionflow
|
|
ENV DB_PASSWORD=changeme
|
|
|
|
# Configuration Keycloak/OIDC (production)
|
|
ENV QUARKUS_OIDC_AUTH_SERVER_URL=https://security.lions.dev/realms/unionflow
|
|
ENV QUARKUS_OIDC_CLIENT_ID=unionflow-server
|
|
ENV KEYCLOAK_CLIENT_SECRET=changeme
|
|
ENV QUARKUS_OIDC_TLS_VERIFICATION=required
|
|
|
|
# Configuration CORS pour production
|
|
ENV CORS_ORIGINS=https://unionflow.lions.dev,https://security.lions.dev
|
|
ENV QUARKUS_HTTP_CORS_ORIGINS=${CORS_ORIGINS}
|
|
|
|
# Configuration Wave Money (optionnel)
|
|
ENV WAVE_API_KEY=
|
|
ENV WAVE_API_SECRET=
|
|
ENV WAVE_API_BASE_URL=https://api.wave.com/v1
|
|
ENV WAVE_ENVIRONMENT=production
|
|
ENV WAVE_WEBHOOK_SECRET=
|
|
|
|
# Installer curl pour les health checks
|
|
USER root
|
|
RUN microdnf install curl -y && microdnf clean all
|
|
RUN mkdir -p /app/logs && chown -R 185:185 /app/logs
|
|
USER 185
|
|
|
|
# Copier l'application depuis le builder
|
|
COPY --from=builder --chown=185 /app/target/quarkus-app/lib/ /deployments/lib/
|
|
COPY --from=builder --chown=185 /app/target/quarkus-app/*.jar /deployments/
|
|
COPY --from=builder --chown=185 /app/target/quarkus-app/app/ /deployments/app/
|
|
COPY --from=builder --chown=185 /app/target/quarkus-app/quarkus/ /deployments/quarkus/
|
|
|
|
# Exposer le port
|
|
EXPOSE 8085
|
|
|
|
# Variables JVM optimisées pour production avec sécurité
|
|
ENV JAVA_OPTS="-Xmx1g -Xms512m \
|
|
-XX:+UseG1GC \
|
|
-XX:MaxGCPauseMillis=200 \
|
|
-XX:+UseStringDeduplication \
|
|
-XX:+ParallelRefProcEnabled \
|
|
-XX:+HeapDumpOnOutOfMemoryError \
|
|
-XX:HeapDumpPath=/app/logs/heapdump.hprof \
|
|
-Djava.security.egd=file:/dev/./urandom \
|
|
-Djava.awt.headless=true \
|
|
-Dfile.encoding=UTF-8 \
|
|
-Djava.util.logging.manager=org.jboss.logmanager.LogManager \
|
|
-Dquarkus.profile=${QUARKUS_PROFILE}"
|
|
|
|
# Point d'entrée avec profil production
|
|
ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /deployments/quarkus-run.jar"]
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
|
|
CMD curl -f http://localhost:8085/q/health/ready || exit 1
|
|
|