gortium/openconcho
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(docker): use compose profiles instead of a prod override file

Browse Source 
Collapse docker-compose.yml + docker-compose.prod.yml into one file with dev/prod
profiles sharing a YAML anchor: dev builds from source, prod pulls ghcr latest.
make up/prod select the profile; down passes both so it stops either. Drops the
separate prod file and the !reset hack.
This commit is contained in:
Offending Commit
2026-06-02 14:02:36 -05:00
parent 4e4843ce1a
commit 4ccf8f2746
5 changed files with 55 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Makefile
View File

@@ -51,14 +51,14 @@ ci-desktop: ## CI: cargo-check for @openconcho/desktop
smoke-docker: ## Local: build the image + smoke-test the /api proxy (Docker required) smoke-docker: ## Local: build the image + smoke-test the /api proxy (Docker required)
bash docker/smoke-test.sh bash docker/smoke-test.sh
up: ## Run the web container from source (dev-forward, builds) at :8080 up: ## Run the web container from source (dev profile, builds) at :8080
docker compose up -d --build docker compose --profile dev up -d --build
prod: ## Run the web container from the published image (pulls ghcr latest) prod: ## Run the web container from the published image (prod profile, pulls latest)
docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d docker compose --profile prod up -d
down: ## Stop + remove the web container (works for dev or prod) down: ## Stop + remove the web container (either profile)
docker compose down --remove-orphans docker compose --profile dev --profile prod down --remove-orphans
clean: down ## down + remove the locally built image clean: down ## down + remove the locally built image
-docker image rm openconcho-web:local -docker image rm openconcho-web:local

6
README.md
View File

@@ -107,9 +107,9 @@ make clean # down + drop the locally built image
# → http://localhost:8080 # → http://localhost:8080
``` ```
`make up` uses [`docker-compose.yml`](docker-compose.yml) (`build: .`); Both modes live in one [`docker-compose.yml`](docker-compose.yml) as Compose
`make prod` layers [`docker-compose.prod.yml`](docker-compose.prod.yml) profiles: `make up` runs the `dev` profile (`build: .`), `make prod` runs the
to pull `ghcr…:latest`. `OPENCONCHO_DEFAULT_HONCHO_URL` seeds the first instance `prod` profile (pulls `ghcr…:latest`). `OPENCONCHO_DEFAULT_HONCHO_URL` seeds the first instance
(absolute URL); `OPENCONCHO_UPSTREAM_ALLOWLIST` is an optional SSRF guard (absolute URL); `OPENCONCHO_UPSTREAM_ALLOWLIST` is an optional SSRF guard
(comma-separated host globs) for when you expose the proxy. Full details and env (comma-separated host globs) for when you expose the proxy. Full details and env
vars are in [`docs/docker.md`](docs/docker.md). vars are in [`docs/docker.md`](docs/docker.md).

11
docker-compose.prod.yml
View File

@@ -1,11 +0,0 @@
# Production override — pull the published image instead of building from source.
# Layer it on top of docker-compose.yml; it reuses every setting there (env, ports,
# extra_hosts) and only swaps the local build for the latest published image.
#
# make prod
# docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
services:
openconcho:
build: !reset null
image: ghcr.io/offendingcommit/openconcho-web:latest
pull_policy: always

57
docker-compose.yml
View File

@@ -1,8 +1,8 @@
# OpenConcho web UI — DEV-FORWARD compose (builds from THIS repo). # OpenConcho web UI — one file, two Compose profiles (dev builds, prod pulls).
# #
# make up # build from source + run → http://localhost:8080 # make up # profile dev: build from THIS repo + run → http://localhost:8080
# make prod # pull the published image instead (see docker-compose.prod.yml) # make prod # profile prod: pull ghcr…:latest instead of building
# make down # stop + remove (dev or prod) # make down # stop + remove (either profile)
# make clean # down + drop the locally built image # make clean # down + drop the locally built image
# #
# The SPA issues all Honcho calls same-origin to /api; nginx forwards each to the # The SPA issues all Honcho calls same-origin to /api; nginx forwards each to the
@@ -11,25 +11,38 @@
# #
# OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make up # OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make up
# #
# To fold into an existing Honcho Compose stack, set OPENCONCHO_DEFAULT_HONCHO_URL # To fold into an existing Honcho Compose stack, point the seed at the api service
# to the api service (e.g. http://api:8000 — nginx resolves it on the compose # (e.g. http://api:8000 — nginx resolves it on the compose network).
# network) and add `depends_on: { api: { condition: service_healthy } }`.
# Shared config (defined once); both profiles reference it via a YAML merge.
x-openconcho: &openconcho
environment:
# Absolute URL seeding the first instance; the browser sends it as the
# X-Honcho-Upstream header and nginx forwards there (no browser CORS).
OPENCONCHO_DEFAULT_HONCHO_URL: ${OPENCONCHO_DEFAULT_HONCHO_URL:-http://host.docker.internal:8000}
# Optional SSRF guard. Unset = forward anywhere (safe for the localhost-only
# binding below). Set comma-separated host globs before exposing the proxy:
# OPENCONCHO_UPSTREAM_ALLOWLIST: honcho.example.net,*.honcho.dev
OPENCONCHO_UPSTREAM_ALLOWLIST: ${OPENCONCHO_UPSTREAM_ALLOWLIST:-}
ports:
- "127.0.0.1:8080:8080"
# Lets the default host.docker.internal upstream resolve on Linux too
# (Docker Desktop / Colima provide it automatically).
extra_hosts:
- "host.docker.internal:host-gateway"
restart: unless-stopped
services: services:
# Dev-forward — builds from source so you run your local changes (`make up`).
openconcho: openconcho:
<<: *openconcho
profiles: ["dev"]
build: . build: .
image: openconcho-web:local image: openconcho-web:local
environment:
# Absolute URL seeding the first instance; the browser sends it as the # Production — pulls the published image instead of building (`make prod`).
# X-Honcho-Upstream header and nginx forwards there (no browser CORS). openconcho-prod:
OPENCONCHO_DEFAULT_HONCHO_URL: ${OPENCONCHO_DEFAULT_HONCHO_URL:-http://host.docker.internal:8000} <<: *openconcho
# Optional SSRF guard. Unset = forward anywhere (safe for the localhost-only profiles: ["prod"]
# binding below). Set comma-separated host globs before exposing the proxy: image: ghcr.io/offendingcommit/openconcho-web:latest
# OPENCONCHO_UPSTREAM_ALLOWLIST: honcho.example.net,*.honcho.dev pull_policy: always
OPENCONCHO_UPSTREAM_ALLOWLIST: ${OPENCONCHO_UPSTREAM_ALLOWLIST:-}
ports:
- "127.0.0.1:8080:8080"
# Lets the default host.docker.internal upstream resolve on Linux too
# (Docker Desktop / Colima provide it automatically).
extra_hosts:
- "host.docker.internal:host-gateway"
restart: unless-stopped

20
docs/docker.md
View File

@@ -15,24 +15,26 @@ applies**; the nginx→Honcho hop is server-side, where CORS is irrelevant. The
frontend stays the source of truth for which instance to talk to, so the frontend stays the source of truth for which instance to talk to, so the
multi-instance switcher and the Fleet view keep working. multi-instance switcher and the Fleet view keep working.
## Compose: dev-forward vs prod ## Compose: dev vs prod profiles
Two Compose files, env/ports defined once in the base: One [`docker-compose.yml`](../docker-compose.yml) with two profiles; the shared
config (env, ports, extra_hosts) is defined once via a YAML anchor:
- **`docker-compose.yml`** — dev-forward: `build: .`, so it runs **your local source**. - **`dev` profile** — `build: .`, runs **your local source** (`make up`).
- **`docker-compose.prod.yml`** — override that swaps the build for the **published - **`prod` profile** — pulls the **published image**
image** (`ghcr.io/offendingcommit/openconcho-web:latest`, `pull_policy: always`). (`ghcr.io/offendingcommit/openconcho-web:latest`, `pull_policy: always`) (`make prod`).
```bash ```bash
make up # build from source + run → http://localhost:8080 make up # build from source + run → http://localhost:8080
make prod # pull ghcr…:latest instead of building make prod # pull ghcr…:latest instead of building
make down # stop + remove (dev or prod) make down # stop + remove (either profile)
make clean # down + drop the locally built image make clean # down + drop the locally built image
``` ```
`make prod` expands to `make up` expands to `docker compose --profile dev up -d --build` and `make prod`
`docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d`. Set env to `docker compose --profile prod up -d`. A bare `docker compose up` (no profile)
inline or via a `.env` file: starts nothing — use the make targets or pass `--profile`. Set env inline or via a
`.env` file:
```bash ```bash
OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make prod OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make prod