build: docker image and compose

Dockerfile on oven/bun:1.3 with ffmpeg, git, unzip and python3-pymupdf, a production install, non-root user, /data volume and a health check; docker-compose.yml (project stc) with an optional postgres:17 profile and read-only course and import mounts; docs/operations.md with configuration, mounts, security headers and the measured idle memory (101.4 MiB for app plus Postgres after 5 minutes idle). Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-30 15:17:58 +01:00
parent d71a95dbc1
commit 69aaedcb43
5 changed files with 206 additions and 0 deletions
@@ -0,0 +1,51 @@
+# STCourses with Docker Compose. Project name "stc", so containers are stc-app-1 and stc-postgres-1.
+#
+#   SQLite (default):   STC_SECRET=... docker compose up -d
+#   Postgres:           STC_SECRET=... STC_DATABASE_URL=postgres://stc:stc@postgres:5432/stc \
+#                         docker compose --profile postgres up -d
+#
+# Course repos go in ./courses (or set STC_COURSES_HOST); files to import go in ./import-inbox (or STC_IMPORT_HOST).
+# Both are mounted read-only: originals are never changed. See docs/operations.md.
+name: stc
+
+services:
+  app:
+    build: .
+    image: stc-app
+    restart: unless-stopped
+    ports:
+      - "${STC_HOST_PORT:-3000}:3000"
+    environment:
+      STC_SECRET: ${STC_SECRET:?set STC_SECRET to a long random string}
+      STC_PUBLIC_URL: ${STC_PUBLIC_URL:-http://localhost:3000}
+      STC_DATABASE_URL: ${STC_DATABASE_URL:-sqlite:///data/stcourses.db}
+      STC_UPLOAD_MAX_MB: ${STC_UPLOAD_MAX_MB:-100}
+      STC_AI_ALLOWED_BASE_URLS: ${STC_AI_ALLOWED_BASE_URLS:-}
+      STC_TRANSCRIBE_URL: ${STC_TRANSCRIBE_URL:-}
+    depends_on:
+      postgres:
+        condition: service_healthy
+        required: false   # only with --profile postgres
+    volumes:
+      - stc-data:/data
+      - ${STC_COURSES_HOST:-./courses}:/courses:ro
+      - ${STC_IMPORT_HOST:-./import-inbox}:/import:ro
+
+  postgres:
+    image: postgres:17
+    profiles: ["postgres"]
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: stc
+      POSTGRES_PASSWORD: ${STC_PG_PASSWORD:-stc}
+      POSTGRES_DB: stc
+    volumes:
+      - stc-pg:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U stc -d stc"]
+      interval: 5s
+      retries: 20
+
+volumes:
+  stc-data:
+  stc-pg: