ci: deploy stage

deploy/compose.yaml

@@ -0,0 +1,45 @@
+services:
+  portfolio:
+    image: rezayaghobi-site:${TAG:?set TAG}
+    container_name: portfolio
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+    networks: [web_net]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=web_net"
+
+      # rezayaghobi.ir
+      - "traefik.http.routers.portfolio.rule=Host(`rezayaghobi.ir`)"
+      - "traefik.http.routers.portfolio.entrypoints=websecure"
+      - "traefik.http.routers.portfolio.tls.certresolver=le"
+      - "traefik.http.routers.portfolio.middlewares=portfolio-hsts"
+      - "traefik.http.routers.portfolio.service=portfolio"
+      - "traefik.http.services.portfolio.loadbalancer.server.port=8080"
+
+      # www -> bare domain
+      - "traefik.http.routers.portfolio-www.rule=Host(`www.rezayaghobi.ir`)"
+      - "traefik.http.routers.portfolio-www.entrypoints=websecure"
+      - "traefik.http.routers.portfolio-www.tls.certresolver=le"
+      - "traefik.http.routers.portfolio-www.middlewares=portfolio-www-redirect"
+      - "traefik.http.routers.portfolio-www.service=noop@internal"
+      - 'traefik.http.middlewares.portfolio-www-redirect.redirectregex.regex=^https://www\.rezayaghobi\.ir/(.*)'
+      - 'traefik.http.middlewares.portfolio-www-redirect.redirectregex.replacement=https://rezayaghobi.ir/$${1}'
+      - "traefik.http.middlewares.portfolio-www-redirect.redirectregex.permanent=true"
+
+      # HSTS for this site only
+      - "traefik.http.middlewares.portfolio-hsts.headers.stsseconds=86400"
+
+networks:
+  web_net:
+    external: true