From e7efa59c6fa3686c0743a00e8cb95a0d7e4a9dfe Mon Sep 17 00:00:00 2001
From: host <arumyantsev@rummail.ru>
Date: Fri, 24 Jul 2026 22:04:06 +0300
Subject: [PATCH] =?UTF-8?q?=D0=91=D0=B5=D0=B7=D0=BE=D0=BF=D0=B0=D1=81?=
 =?UTF-8?q?=D0=BD=D1=8B=D0=B5=20=D0=B4=D0=B5=D1=84=D0=BE=D0=BB=D1=82=D1=8B?=
 =?UTF-8?q?=20=D0=B2=20docker-compose:=20=D0=BF=D0=B0=D1=80=D0=BE=D0=BB?=
 =?UTF-8?q?=D1=8C=20Postgres=20=D1=87=D0=B5=D1=80=D0=B5=D0=B7=20env,=20?=
 =?UTF-8?q?=D0=BF=D0=BE=D1=80=D1=82=208000=20=D0=B7=D0=B0=D0=BA=D1=80?=
 =?UTF-8?q?=D1=8B=D1=82,=20healthchecks?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docker-compose.yml | 43 ++++++++++++++++++++++++++++++++++---------
 1 file changed, 34 insertions(+), 9 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index eddd211..77e4e1f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,11 +5,19 @@ services:
     image: postgres:16-alpine
     restart: unless-stopped
     environment:
-      POSTGRES_USER: panel
-      POSTGRES_PASSWORD: panel
-      POSTGRES_DB: panel
+      # Используйте .env (POSTGRES_PASSWORD) или docker secrets.
+      # Значение по умолчанию пустое — compose упадёт без env, что заставит
+      # явно задать пароль и не оставит дефолтные "panel:panel".
+      POSTGRES_USER: ${POSTGRES_USER:-panel}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
+      POSTGRES_DB: ${POSTGRES_DB:-panel}
     volumes:
       - panel_db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-panel} -d ${POSTGRES_DB:-panel}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   backend:
     build: ./backend
@@ -17,19 +25,36 @@ services:
     env_file:
       - ./backend/.env
     environment:
-      DATABASE_URL: postgresql://panel:panel@db:5432/panel
+      DATABASE_URL: postgresql://${POSTGRES_USER:-panel}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-panel}
+      # Список доменов для CORS, через запятую. По умолчанию только localhost.
+      ALLOW_ORIGINS: ${ALLOW_ORIGINS:-http://localhost:5173}
     depends_on:
-      - db
-    ports:
-      - "8000:8000"   # можно убрать наружу, если доступ только через frontend/nginx
+      db:
+        condition: service_healthy
+    # Порт 8000 НЕ пробрасывается наружу — backend доступен только через nginx
+    # фронтенда. Если нужен прямой доступ для отладки, раскомментируйте:
+    # ports:
+    #   - "127.0.0.1:8000:8000"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=2)"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
 
   frontend:
     build: ./frontend
     restart: unless-stopped
     depends_on:
-      - backend
+      backend:
+        condition: service_healthy
     ports:
-      - "5173:5173"
+      - "${FRONTEND_PORT:-5173}:5173"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost:5173/"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
 
 volumes:
   panel_db: