env and config for production

.env.example

@@ -2,9 +2,10 @@
 SECRET_KEY=7(2w1sedok=aznpq)ta1mc4i%4h=xx@hxwx*o57ctsuml0x%fr
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG=true
+DEBUG=false
 
 DOMAIN=your.domain.here
+EMAIL=your@email.here
 
 ## Leave unset to allow all hosts
 # ALLOWED_HOSTS="localhost,127.0.0.1,[::1]"

docker-compose.yml

@@ -4,18 +4,27 @@ services:
     nginx:
         image: nginx:latest
         ports:
-            - 1333:80
+            - 80:80
+            - 443:443
         depends_on:
             - web
         networks:
             - main
         volumes:
             - ./nginx:/etc/nginx/conf.d
+            - ./certbot/conf:/etc/nginx/ssl
+            - ./certbot/data:/var/www/certbot
             - static_volume:/app/static
             - media_volume:/app/images
+    certbot:
+        image: certbot/certbot:latest
+        command: certonly --webroot --webroot-path=/var/www/certbot --email ${EMAIL} --agree-tos --no-eff-email -d ${DOMAIN} -d www.${DOMAIN}
+        volumes:
+            - ./certbot/conf:/etc/letsencrypt
+            - ./certbot/logs:/var/log/letsencrypt
+            - ./certbot/data:/var/www/certbot
     db:
         image: postgres
-        env_file: .env
         volumes:
           - pgdata:/var/lib/postgresql/data
         networks:
@@ -36,14 +45,12 @@ services:
             - 8000:8000
     redis:
         image: redis
-        env_file: .env
         ports:
-          - "6379:6379"
+          - 6379:6379
         networks:
             - main
         restart: on-failure
     celery_worker:
-        env_file: .env
         build: .
         networks:
             - main

nginx/default.conf

@@ -3,8 +3,30 @@ upstream web {
 }
 
 server {
+    listen [::]:80;
     listen 80;
 
+    server_name your-domain.com www.your-domain.com;
+
+    location ~ /.well-known/acme-challenge {
+        allow all;
+        root /var/www/certbot;
+    }
+
+    # redirect http to https www
+    return 301 https://www.your-domain.com$request_uri;
+}
+
+server {
+    listen [::]:443 ssl http2;
+    listen 443 ssl http2;
+
+    server_name your-domain.com;
+
+    # SSL code
+    ssl_certificate /etc/nginx/ssl/live/your-domain.com/fullchain.pem;
+    ssl_certificate_key /etc/nginx/ssl/live/your-domain.com/privkey.pem;
+
     location / {
         proxy_pass http://web;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -20,46 +42,3 @@ server {
         alias /app/static/;
     }
 }
-
-# PROD version
-#
-#server {
-#    listen [::]:80;
-#    listen 80;
-#
-#    server_name your-domain.com www.your-domain.com;
-#
-#    location ~ /.well-known/acme-challenge {
-#        allow all;
-#        root /var/www/certbot;
-#    }
-#
-#    # redirect http to https www
-#    return 301 https://www.your-domain.com$request_uri;
-#}
-#
-#server {
-#    listen [::]:443 ssl http2;
-#    listen 443 ssl http2;
-#
-#    server_name your-domain.com;
-#
-#    # SSL code
-#    ssl_certificate /etc/nginx/ssl/live/your-domain.com/fullchain.pem;
-#    ssl_certificate_key /etc/nginx/ssl/live/your-domain.com/privkey.pem;
-#
-#    location / {
-#        proxy_pass http://web;
-#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-#        proxy_set_header Host $host;
-#        proxy_redirect off;
-#    }
-#
-#    location /images/ {
-#        alias /app/images/;
-#    }
-#
-#    location /static/ {
-#        alias /app/static/;
-#    }
-#}

prod-docker-compose.yml

@@ -1,74 +0,0 @@
-version: '3'
-
-services:
-    nginx:
-        image: nginx:latest
-        ports:
-            - 80:80
-            - 443:443
-        depends_on:
-            - web
-        networks:
-            - main
-        volumes:
-            - ./nginx:/etc/nginx/conf.d
-            - ./certbot/conf:/etc/nginx/ssl
-            - ./certbot/data:/var/www/certbot
-            - static_volume:/app/static
-            - media_volume:/app/images
-    certbot:
-        image: certbot/certbot:latest
-        command: certonly --webroot --webroot-path=/var/www/certbot --email your-email@domain.com --agree-tos --no-eff-email -d your-domain.com -d www.your-domain.com
-        volumes:
-            - ./certbot/conf:/etc/letsencrypt
-            - ./certbot/logs:/var/log/letsencrypt
-            - ./certbot/data:/var/www/certbot
-    db:
-        image: postgres
-        env_file: .env
-        volumes:
-          - pgdata:/var/lib/postgresql/data
-        networks:
-            - main
-    web:
-        build: .
-        command: python manage.py runserver 0.0.0.0:8000
-        volumes:
-            - .:/app
-            - static_volume:/app/static
-            - media_volume:/app/images
-        depends_on:
-            - db
-            - celery_worker
-        networks:
-            - main
-        ports:
-            - 8000:8000
-    redis:
-        image: redis
-        env_file: .env
-        ports:
-          - "6379:6379"
-        networks:
-            - main
-        restart: on-failure
-    celery_worker:
-        env_file: .env
-        build: .
-        networks:
-            - main
-        command: celery -A celerywyrm worker -l info
-        volumes:
-            - .:/app
-            - static_volume:/app/static
-            - media_volume:/app/images
-        depends_on:
-            - db
-            - redis
-        restart: on-failure
-volumes:
-    pgdata:
-    static_volume:
-    media_volume:
-networks:
-    main: