Initial import of Forge app

docker-compose.yml

@@ -0,0 +1,62 @@
+# Compose v2 — `version:` key intentionally omitted (deprecated).
+#
+# Topology: a bundled Postgres (`db`, database `forge`) + the FORGE app. The
+# schema self-bootstraps in initDB() on app boot (no ORM, no migrations) and
+# seeds the bundled ticket archives on first run. App host port is 3099 (FORGE's
+# lane); behind the Synology reverse proxy this is what forge.mycloud.dp.ua maps to.
+
+name: forge
+
+services:
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: forge
+      POSTGRES_USER: forge
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-forge}
+    volumes:
+      - forge-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U forge -d forge']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  app:
+    build:
+      context: .
+      target: runtime
+    image: forge-app:latest
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    ports:
+      # Host 3089 -> container 3000. 3089 is FORGE's lane.
+      - '3089:3000'
+    environment:
+      DATABASE_URL: postgresql://forge:${POSTGRES_PASSWORD:-forge}@db:5432/forge
+      NODE_ENV: production
+      PORT: 3000
+      # Read-API auth (see .env / .env.example).
+      SESSION_SECRET: ${SESSION_SECRET:?set SESSION_SECRET in .env}
+      AUTH_USER: ${AUTH_USER:-admin}
+      AUTH_PASS: ${AUTH_PASS:?set AUTH_PASS in .env}
+      # Guards POST /api/tokens. Prefer minting via the CLI instead (see SETUP.md).
+      ADMIN_KEY: ${ADMIN_KEY:-}
+    healthcheck:
+      test: ['CMD', 'wget', '-qO-', 'http://localhost:3000/healthz']
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    mem_limit: 1g
+    logging:
+      driver: json-file
+      options:
+        max-size: '10m'
+        max-file: '3'
+
+volumes:
+  forge-db: