init2222

docker-compose.yml

@@ -1,20 +1,54 @@
 services:
+  keydb:
+    image: eqalpha/keydb
+    container_name: cryptowallet-keydb
+    restart: unless-stopped
+    expose:
+      - "6379"
+    volumes:
+      - keydb_data:/data
+    command:
+      - keydb-server
+      - --requirepass
+      - ${REDIS_PASSWORD}
+      - --dir
+      - /data
+      - --appendonly
+      - "yes"
+      - --appendfsync
+      - everysec
+      - --save
+      - "900"
+      - "1"
+      - --save
+      - "300"
+      - "10"
+      - --save
+      - "60"
+      - "10000"
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 5s
+      timeout: 2s
+      retries: 20
+
   api:
     build:
       context: .
       dockerfile: Dockerfile
     container_name: cryptowallet-api
     restart: unless-stopped
-    # Bind to loopback only — TLS termination + WAF на reverse proxy (Caddy / Nginx).
-    # Для direct exposure в dev → поменяй на "3001:3001".
+    depends_on:
+      keydb:
+        condition: service_healthy
+    # Production: port открыт на all interfaces. TLS/WAF обязательно на reverse proxy.
     ports:
-      - "127.0.0.1:3001:3001"
+      - "3001:3001"
     env_file:
       - .env
     environment:
       API_PORT: "3001"
     # Container hardening — post-RCE blast radius minimization.
-    # Audit-логи теперь идут в stdout (не файл), поэтому read_only OK без logs mount.
     read_only: true
     tmpfs:
       - /tmp
@@ -36,3 +70,6 @@ services:
       options:
         max-size: "20m"
         max-file: "5"
+
+volumes:
+  keydb_data: