muzick: nginx proxy Bearer auth, restart policies, env subst

docker-compose.yml

@@ -16,15 +16,16 @@ services:
     image: typesense/typesense:0.25.1
     restart: always
     ports:
-      - "8108:8108"
+      - "127.0.0.1:8108:8108"
     volumes:
       - ./data/typesense:/data
     command: --data-dir /data --api-key=${TYPESENSE_API_KEY}
 
   backend:
     build: ./backend
+    restart: unless-stopped
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     environment:
       DATABASE_URL: postgresql://user:${DB_PASSWORD}@db:5432/muzick
       REDIS_URL: redis://:${REDIS_PASSWORD}@infra-redis:6379
@@ -43,13 +44,17 @@ services:
 
   frontend:
     build: ./frontend
+    restart: unless-stopped
     ports:
-      - "5174:80"
+      - "127.0.0.1:5174:80"
+    environment:
+      MUZICK_API_KEY: ${MUZICK_API_KEY}
     depends_on:
       - backend
 
   worker:
     build: ./workers
+    restart: unless-stopped
     network_mode: host
     environment:
       DATABASE_URL: postgresql://user:${DB_PASSWORD}@127.0.0.1:5432/muzick

frontend/Dockerfile

@@ -7,6 +7,6 @@ RUN npm run build
 
 FROM nginx:stable-alpine
 COPY --from=build /app/dist /usr/share/nginx/html
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY nginx.conf.template /etc/nginx/templates/default.conf.template
 EXPOSE 80
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["/bin/sh", "-c", "envsubst '${MUZICK_API_KEY}' < /etc/nginx/templates/default.conf.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]

frontend/nginx.conf.template

@@ -0,0 +1,19 @@
+server {
+    listen 80;
+
+    location / {
+        root /usr/share/nginx/html;
+        index index.html index.htm;
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /api {
+        proxy_pass http://backend:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header Authorization "Bearer ${MUZICK_API_KEY}";
+        proxy_cache_bypass $http_upgrade;
+    }
+}