Docker configuration done

Author: TheRefraction

.env.example

@@ -3,17 +3,21 @@
 POSTGRES_HOST=postgres 
 POSTGRES_PORT=5432
 POSTGRES_DB=efes-db
-POSTGRES_USER=
-POSTGRES_PASSWORD= 
+POSTGRES_ROOT_USER=
+POSTGRES_ROOT_PASSWORD= 
+POSTGRES_APP_USER=
+POSTGRES_APP_PASSWORD=
 
-# MongoDB (inside the Docker network)
-MONGO_URI=mongodb://mongo:27017/efes-db
+# MongoDB 
+MONGO_DB=efes-db
+MONGO_ROOT_USER=
+MONGO_ROOT_PASSWORD=
+MONGO_APP_USER=
+MONGO_APP_PASSWORD=
 
 # Container ports (what is exposed to the host machine)
 DOCKER_PORT_FRONTEND=4200
 DOCKER_PORT_BACKEND=3000
-DOCKER_PORT_POSTGRES=5432
-DOCKER_PORT_MONGO=27017
 
 # Docker Compose profiles
 COMPOSE_PROFILES=prod

README.md

@@ -8,10 +8,15 @@
 | `frontend-dev` | Custom (dev target) | Runs `ng serve` on port 4200. Mounts local `src/` and `public/` for hot reload. |
 | `backend` | Custom (prod target) | Runs compiled Node app on port 3000. Reads secrets from `.env` via `env_file`. |
 | `backend-dev` | Custom (dev target) | Runs `npm run dev` (`tsx watch`) on port 3000. Mounts local `backend/` for hot reload. |
-| `postgres` | `postgres:16-alpine` | Persists DB files in `postgres-data` volume. Exposes port 5432. |
-| `mongo` | `mongo:7` | Persists DB files in `mongodb-data` volume. Exposes port 27017. |
+| `postgres` | `postgres:16-alpine` | Persists DB files in `postgres-data` volume. |
+| `mongo` | `mongo:7` | Persists DB files in `mongodb-data` volume. |
+| `flyway` | `flyway:latest` | Runs migrations before starting the backend. |
 
-Container names are prefixed `efes-` (e.g. `frontend` -> `efes-frontend`).
+> [!NOTE]
+> Container names are prefixed `efes-` (e.g. `frontend` -> `efes-frontend`).
+
+> [!CAUTION]
+> Starting both production and development containers will result in undefined behavior. Please make sure you stop containers with the command `docker compose --profile <profile_name> stop`.
 
 ## Ports
 
@@ -22,26 +27,35 @@ Host ports are set in your `.env` as `DOCKER_PORT_*` variables. Container-side p
 | Frontend (prod) | `DOCKER_PORT_FRONTEND` | `80` (Nginx) |
 | Frontend (dev) | `DOCKER_PORT_FRONTEND` | `4200` (ng serve) |
 | Backend | `DOCKER_PORT_BACKEND` | `3000` |
-| Postgres | `DOCKER_PORT_POSTGRES` | `5432` |
-| Mongo | `DOCKER_PORT_MONGO` | `27017` |
 
-> **Note:** Inside the Docker network, services talk to each other by service name (e.g. `http://backend:3000`), not `localhost`.
+> [!NOTE] 
+> Inside the Docker network, services talk to each other by service name (e.g. `http://backend:3000`), not `localhost`.
+
+> [!IMPORTANT]
+> Both `postgres` and `mongo` are not exposed as it having those programs already installed onto the host may interfere if not configured properly. If you want to access the shell or run commands, please use `docker compose exec <service_name> <bash|cmd>`.
 
 ## Volumes
 
 | Volume | Mounted to | Purpose |
 |---|---|---|
 | `postgres-data` | `/var/lib/postgresql/data` | Persist Postgres DB files |
 | `mongodb-data` | `/data/db` | Persist Mongo DB files |
-| `backend_node_modules` | `/app/node_modules` | Preserve node_modules across dev rebuilds |
+| `mongodb-configdb` | `/data/configdb` | Persist Mongo DB config files |
+| `backend-node-modules` | `/app/node_modules` | Preserve node_modules across dev rebuilds |
 
 Local mounts used in dev:
 
-| Local path | Container path | Service |
-|---|---|---|
-| `./frontend/src` | `/app/src` | `frontend-dev` |
-| `./frontend/public` | `/app/public` | `frontend-dev` |
-| `./backend` | `/app` | `backend-dev` |
+| Local path | Container path | Service | Purpose |
+|---|---|---|---|
+| `./frontend/src` | `/app/src` | `frontend-dev` | Mount app source for `ng serve` so code edits are reflected immediately |
+| `./frontend/public` | `/app/public` | `frontend-dev` | Mount static assets |
+| `./backend` | `/app` | `backend-dev` | Mount backend source for `tsx watch` so the server restarts in code changes |
+| `./backend/db/init` | `/docker-entrypoint-initdb.d` | `postgres` | Bootstrap SQL/shell scripts executed once on a fresh postgres volume |
+| `./backend/db/mongo` | `/docker-entrypoint-initdb.d` | `mongo` | JavaScript init scripts executed once on a fresh mongo volume |
+| `./backend/db/migrations` | `/flyway/sql` | `flyway` | Versioned SQL migration files read by Flyway |
+
+> [!NOTE]
+> In production, those folders are not mounted. Instead the service the files it has within its image.
 
 ## Network
 
@@ -51,6 +65,7 @@ All services share the custom bridge network `app-network`. Cross-container DNS
 
 - **Postgres** - `pg_isready` healthcheck (see `docker-compose.yml`)
 - **Mongo** - `mongosh ping` healthcheck
+- **Flyway** - runs once to migrate the database
 - `backend` and `backend-dev` both declare `depends_on` with `condition: service_healthy`, so Compose waits for DB readiness before starting them.
 
 ## How the frontend reaches the API
@@ -73,6 +88,12 @@ Browser JS should always call same-origin paths like `/api/health`. The dev serv
 # Commands
 Open a terminal window from the project root and make sure Docker Desktop is started.
 
+> [!NOTE]
+> The default profile is `prod`. Thus the following commands are equivalent: `docker compose --profile prod <...>` and `docker compose <...>`.
+
+> [!IMPORTANT]
+> When you enter a command for a given profile, the "counter-command" should also include the profile. Failure to do so may yield networking errors or containers may fail to stop/remove themselves.
+
 ## Start
 
 | Description | Command |
@@ -111,8 +132,14 @@ Open a terminal window from the project root and make sure Docker Desktop is sta
 
 | Description | Command |
 |---|---|
-| Open a shell in a container | `docker compose exec frontend-dev sh` |
+| Open a shell in a container | `docker compose exec -it frontend-dev sh` |
 | Run a command in a container | `docker compose exec frontend-dev <cmd>` |
+| Open `mongosh` | `docker compose exec mongo mongosh -u <root_user> -p <root_password>` |
+| Open `psql` | `docker compose exec postgres psql -U <root_user> -d <db_name> -W` |
+| Migrate | `docker compose run --rm flyway` |
+| Repair migrations | `docker compose run --rm flyway repair` |
+| Validate migrations | `docker compose run --rm flyway validate` |
+| Info on migrations | `docker compose run --rm flyway info` |
 
 ## Status
 

backend/db/init/01-create-app-user.sh

@@ -0,0 +1,45 @@
+#!/bin/sh
+set -eu
+
+# The Postgres official image already creates the database named by POSTGRES_DB
+# on first initialization. This script only creates the application role and
+# grants it the rights needed to use that database.
+
+: "${POSTGRES_DB:?missing POSTGRES_DB}"
+: "${POSTGRES_USER:?missing POSTGRES_USER}"
+: "${POSTGRES_APP_USER:?missing POSTGRES_APP_USER}"
+: "${POSTGRES_APP_PASSWORD:?missing POSTGRES_APP_PASSWORD}"
+
+sql_escape_literal() {
+  printf "%s" "$1" | sed "s/'/''/g"
+}
+
+sql_escape_ident() {
+  printf "%s" "$1" | sed 's/"/""/g'
+}
+
+APP_USER_LIT=$(sql_escape_literal "$POSTGRES_APP_USER")
+APP_USER_IDENT=$(sql_escape_ident "$POSTGRES_APP_USER")
+APP_PASSWORD_LIT=$(sql_escape_literal "$POSTGRES_APP_PASSWORD")
+DB_NAME_IDENT=$(sql_escape_ident "$POSTGRES_DB")
+
+# Check whether the application role already exists.
+role_exists=$(psql -tAc "SELECT 1 FROM pg_roles WHERE rolname = '$APP_USER_LIT'" \
+  --username "$POSTGRES_USER" \
+  --dbname "$POSTGRES_DB" | tr -d '[:space:]')
+
+if [ -z "$role_exists" ]; then
+  psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" -v ON_ERROR_STOP=1 <<EOF
+CREATE ROLE "$APP_USER_IDENT" LOGIN PASSWORD '$APP_PASSWORD_LIT';
+EOF
+fi
+
+# Grant access on the existing database created by initdb.
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" -v ON_ERROR_STOP=1 <<EOF
+GRANT CONNECT ON DATABASE "$DB_NAME_IDENT" TO "$APP_USER_IDENT";
+GRANT USAGE, CREATE ON SCHEMA public TO "$APP_USER_IDENT";
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO "$APP_USER_IDENT";
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+  GRANT USAGE, SELECT ON SEQUENCES TO "$APP_USER_IDENT";
+EOF

backend/db/migrations/tmp

@@ -0,0 +1,21 @@
+const dbName = process.env.MONGO_INITDB_DATABASE || 'efes-db';
+const appUser = process.env.MONGO_APP_USER;
+const appPassword = process.env.MONGO_APP_PASSWORD;
+
+if (!appUser) {
+  throw new Error('missing MONGO_APP_USER');
+}
+
+if (!appPassword) {
+  throw new Error('missing MONGO_APP_PASSWORD');
+}
+
+db = db.getSiblingDB(dbName);
+
+db.createUser({
+  user: appUser,
+  pwd: appPassword,
+  roles: [
+    { role: 'readWrite', db: dbName }
+  ]
+});

backend/db/mongo/01-create-app-user.js

@@ -1,11 +1,11 @@
 import { Pool } from 'pg';
 
 const pool = new Pool({
-  host:     process.env.POSTGRES_HOST     || 'localhost',
+  host:     process.env.POSTGRES_HOST || 'localhost',
   port:     Number(process.env.POSTGRES_PORT) || 5432,
   database: process.env.POSTGRES_DB,
-  user:     process.env.POSTGRES_USER,
-  password: process.env.POSTGRES_PASSWORD,
+  user:     process.env.POSTGRES_APP_USER,
+  password: process.env.POSTGRES_APP_PASSWORD,
   max: 10,
   idleTimeoutMillis: 30000,
   connectionTimeoutMillis: 2000,

backend/src/config/postgres.ts

@@ -6,7 +6,7 @@ services:
       dockerfile: Dockerfile
       target: production
     ports:
-      - "${DOCKER_PORT_FRONTEND}:80"
+      - "${DOCKER_PORT_FRONTEND:-4200}:80"
     depends_on:
       - backend
     networks:
@@ -22,7 +22,7 @@ services:
       dockerfile: Dockerfile
       target: development
     ports:
-      - "${DOCKER_PORT_FRONTEND}:4200"
+      - "${DOCKER_PORT_FRONTEND:-4200}:4200"
     volumes:
       - ./frontend/src:/app/src
       - ./frontend/public:/app/public
@@ -40,13 +40,17 @@ services:
       dockerfile: Dockerfile
       target: production
     ports:
-      - "${DOCKER_PORT_BACKEND}:3000"
+      - "${DOCKER_PORT_BACKEND:-3000}:3000"
     env_file: .env
+    environment:
+      MONGO_URI: mongodb://${MONGO_APP_USER}:${MONGO_APP_PASSWORD}@mongo:27017/${MONGO_DB}?authSource=${MONGO_DB}
     depends_on:
       postgres:
         condition: service_healthy
       mongo:
         condition: service_healthy
+      flyway:
+        condition: service_completed_successfully
     networks:
       - app-network
     profiles:
@@ -60,16 +64,20 @@ services:
       dockerfile: Dockerfile
       target: development
     ports:
-      - "${DOCKER_PORT_BACKEND}:3000"
+      - "${DOCKER_PORT_BACKEND:-3000}:3000"
     env_file: .env
+    environment:
+      MONGO_URI: mongodb://${MONGO_APP_USER}:${MONGO_APP_PASSWORD}@mongo:27017/${MONGO_DB}?authSource=${MONGO_DB}
     volumes:
       - ./backend:/app
-      - backend_node_modules:/app/node_modules
+      - backend-node-modules:/app/node_modules
     depends_on:
       postgres:
         condition: service_healthy
       mongo:
         condition: service_healthy
+      flyway:
+        condition: service_completed_successfully
     networks:
       - app-network
     profiles:
@@ -78,31 +86,37 @@ services:
   postgres:
     container_name: efes-postgres
     image: postgres:16-alpine
-    ports:
-      - "${DOCKER_PORT_POSTGRES}:5432"
     environment:
-      POSTGRES_DB:       ${POSTGRES_DB}
-      POSTGRES_USER:     ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB:           ${POSTGRES_DB}
+      POSTGRES_USER:         ${POSTGRES_ROOT_USER}
+      POSTGRES_PASSWORD:     ${POSTGRES_ROOT_PASSWORD}
+      POSTGRES_APP_USER:     ${POSTGRES_APP_USER}
+      POSTGRES_APP_PASSWORD: ${POSTGRES_APP_PASSWORD}
     volumes:
       - postgres-data:/var/lib/postgresql/data
+      - ./backend/db/init:/docker-entrypoint-initdb.d
     networks:
       - app-network
     restart: unless-stopped
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_ROOT_USER} -d ${POSTGRES_DB}"]
       interval: 5s
       timeout: 5s
       retries: 5
 
   mongo:
     container_name: efes-mongo
     image: mongo:7
-    ports:
-      - "${DOCKER_PORT_MONGO}:27017"
+    environment:
+      MONGO_INITDB_DATABASE: ${MONGO_DB}
+      MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USER}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD}
+      MONGO_APP_USER: ${MONGO_APP_USER}
+      MONGO_APP_PASSWORD: ${MONGO_APP_PASSWORD}
     volumes:
       - mongodb-data:/data/db
       - mongodb-configdb:/data/configdb
+      - ./backend/db/mongo:/docker-entrypoint-initdb.d
     networks:
       - app-network
     restart: unless-stopped
@@ -112,6 +126,23 @@ services:
       timeout: 5s
       retries: 5
 
+  flyway:
+    image: flyway/flyway:latest
+    container_name: efes-flyway
+    command: migrate
+    environment:
+      FLYWAY_URL: jdbc:postgresql://${POSTGRES_HOST:-postgres}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
+      FLYWAY_USER: ${POSTGRES_ROOT_USER}
+      FLYWAY_PASSWORD: ${POSTGRES_ROOT_PASSWORD}
+      FLYWAY_LOCATIONS: filesystem:/flyway/sql
+    volumes:
+      - ./backend/db/migrations:/flyway/sql
+    depends_on:
+      postgres:
+        condition: service_healthy
+    networks:
+      - app-network
+
 networks:
   app-network:
     driver: bridge
@@ -120,4 +151,4 @@ volumes:
   mongodb-data:
   mongodb-configdb:
   postgres-data:
-  backend_node_modules:
+  backend-node-modules: