first

docker/entrypoint.sh

@@ -0,0 +1,49 @@
+#!/bin/sh
+set -e
+
+echo "==> Waiting for PostgreSQL..."
+python - <<'PY'
+import os
+import time
+
+import psycopg
+
+timeout = int(os.getenv("DATABASE_WAIT_TIMEOUT", "60"))
+deadline = time.monotonic() + timeout
+last_error = None
+
+while time.monotonic() < deadline:
+    try:
+        if os.getenv("DATABASE_URL"):
+            connection = psycopg.connect(os.environ["DATABASE_URL"], connect_timeout=5)
+        else:
+            connection = psycopg.connect(
+                dbname=os.environ["POSTGRES_DB"],
+                user=os.environ["POSTGRES_USER"],
+                password=os.environ["POSTGRES_PASSWORD"],
+                host=os.environ["POSTGRES_HOST"],
+                port=os.getenv("POSTGRES_PORT", "5432"),
+                connect_timeout=5,
+            )
+        connection.close()
+        break
+    except psycopg.OperationalError as exc:
+        last_error = exc
+        time.sleep(2)
+else:
+    raise SystemExit(f"PostgreSQL was not ready after {timeout}s: {last_error}")
+PY
+
+if [ "${RUN_STARTUP_TASKS:-0}" = "1" ]; then
+  echo "==> Applying database migrations..."
+  python manage.py migrate --noinput
+
+  echo "==> Bootstrapping required application data..."
+  python manage.py bootstrap
+
+  echo "==> Collecting static files..."
+  python manage.py collectstatic --noinput
+fi
+
+echo "==> Starting: $*"
+exec "$@"

docker/nginx.conf

@@ -0,0 +1,43 @@
+map $arg_download $media_disposition {
+    default "";
+    "1"     "attachment";
+}
+
+server {
+    listen 80;
+    server_name _;
+
+    location /static/ {
+        alias /app/staticfiles/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    location ^~ /media/branding/ {
+        alias /app/media/branding/;
+        expires 7d;
+        add_header X-Content-Type-Options nosniff always;
+        access_log off;
+    }
+
+    location /protected-media/ {
+        alias /app/media/;
+        secure_link $arg_md5,$arg_expires;
+        secure_link_md5 "$secure_link_expires$uri ${MEDIA_SIGNING_SECRET}";
+        if ($secure_link = "") { return 403; }
+        if ($secure_link = "0") { return 410; }
+        add_header Content-Disposition $media_disposition always;
+        add_header X-Content-Type-Options nosniff always;
+        expires -1;
+    }
+
+    location = /healthz/ {
+        default_type application/json;
+        return 200 '{"status":"ok"}';
+    }
+
+    location / {
+        return 404;
+    }
+}