Production deployment with Docker Compose

Goal

Deploy a single-host production stack with Docker Compose, with persistent data and correct service dependencies.

The composition

A production compose file runs:

• postgres with a named volume — configuration and identity must survive restarts
• redis — publish notifications and cache
• api, web (console), proxy, worker — the ShieldGate services

Services read connection strings from environment variables, so one .env file configures the whole stack.

Key decisions

• Persistence — PostgreSQL data on a named volume or host path with backups. Redis can be ephemeral.
• Ports — expose the proxy's 80/443 to the world; keep the API and console behind your management network.
• Secrets — database passwords and JWT signing keys come from the environment or a secrets manager, never baked into images.
• Health checks — every service exposes /health; wire them into compose so dependencies start in order.

Steps

1. Prepare the .env file with connection strings and secrets.
2. docker compose up -d and watch health checks turn green.
3. Sign in to the console and run through the first-run checklist from Module 1.

Verify

• docker compose ps shows every service healthy.
• Restarting the stack preserves configuration (the PostgreSQL volume works).

Pitfalls

• Exposing the console or API publicly is the most common self-inflicted vulnerability — front them with the proxy or bind them to a management network.