ehoandClaude Sonnet 5
8560746d15
The backend half of the sweep RD-18 did for the front end. git blame holds the provenance and stays correct when the code moves; the comment names a closed ticket and tells the reader nothing the sentence around it does not. public/letter.css and LetterHtml.golden.html change together, because the renderer inlines the CSS and the golden file snapshots the result. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
38 lines
1.8 KiB
YAML
38 lines
1.8 KiB
YAML
# Production overrides for docker-compose.openzaak.yml: real secrets, real DB auth,
|
|
# HTTPS-aware settings. Use ON TOP of the base file, never alone (it has no image/ports of its
|
|
# own to add — see backend/openzaak/README.md for the required env vars and full flow):
|
|
#
|
|
# ./render-prod-secrets.sh # renders setup_configuration/data.prod.yaml (gitignored)
|
|
# docker compose -f docker-compose.openzaak.yml -f docker-compose.openzaak.prod.yml up -d
|
|
#
|
|
# TLS is NOT terminated here — OpenZaak sits behind a reverse proxy/ingress that owns the
|
|
# certificate; this file only tells OpenZaak (via IS_HTTPS) that it's being served over HTTPS
|
|
# so it sets secure cookies / redirects correctly.
|
|
services:
|
|
db:
|
|
environment:
|
|
- POSTGRES_HOST_AUTH_METHOD=md5
|
|
- POSTGRES_PASSWORD=${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}
|
|
|
|
web-init:
|
|
environment:
|
|
SECRET_KEY: ${OPENZAAK_SECRET_KEY:?OPENZAAK_SECRET_KEY must be set}
|
|
DB_PASSWORD: ${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}
|
|
IS_HTTPS: 'yes'
|
|
SITE_DOMAIN: ${OPENZAAK_SITE_DOMAIN:?OPENZAAK_SITE_DOMAIN must be set}
|
|
ALLOWED_HOSTS: ${OPENZAAK_ALLOWED_HOSTS:?OPENZAAK_ALLOWED_HOSTS must be set}
|
|
DISABLE_2FA: 'false'
|
|
volumes:
|
|
# Shadows the dev data.yaml (still mounted read-only from the base file) with the
|
|
# secret-free template rendered by render-prod-secrets.sh.
|
|
- ./setup_configuration/data.prod.yaml:/app/setup_configuration/data.yaml:ro
|
|
|
|
web:
|
|
environment:
|
|
SECRET_KEY: ${OPENZAAK_SECRET_KEY:?OPENZAAK_SECRET_KEY must be set}
|
|
DB_PASSWORD: ${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}
|
|
IS_HTTPS: 'yes'
|
|
SITE_DOMAIN: ${OPENZAAK_SITE_DOMAIN:?OPENZAAK_SITE_DOMAIN must be set}
|
|
ALLOWED_HOSTS: ${OPENZAAK_ALLOWED_HOSTS:?OPENZAAK_ALLOWED_HOSTS must be set}
|
|
DISABLE_2FA: 'false'
|