Merge current features with security hardening and automatic safe initialization

docker-compose.coolify.yml

@@ -27,7 +27,8 @@ services:
       NODE_ENV: production
       PORT: 3000
       HOSTNAME: 0.0.0.0
-      DATABASE_URL: ${APP_DATABASE_URL:?}
+      APP_DATABASE_PASSWORD_FILE: /app/runtime-secrets/database-password
+      APP_DATABASE_NAME: ${POSTGRES_DB:-kita_planer}
       AUTH_SECRET: ${AUTH_SECRET:?}
       AUTH_URL: ${AUTH_URL:?}
       NEXTAUTH_URL: ${NEXTAUTH_URL:?}
@@ -38,6 +39,7 @@ services:
       RESEND_API_KEY: ${RESEND_API_KEY:?}
       EMAIL_FROM: ${EMAIL_FROM:?}
       ADMIN_EMAIL: ${ADMIN_EMAIL:?}
+      NOTDIENST_JOB_SECRET: ${NOTDIENST_JOB_SECRET:?}
       UPLOAD_DIR: /app/uploads/announcements
       UPLOAD_TENANT_QUOTA_BYTES: ${UPLOAD_TENANT_QUOTA_BYTES:-268435456}
       UPLOAD_GLOBAL_QUOTA_BYTES: ${UPLOAD_GLOBAL_QUOTA_BYTES:-10737418240}
@@ -45,9 +47,12 @@ services:
     volumes:
       - kita_planer_uploads:/app/uploads
       - kita_planer_next_cache:/app/.next/cache
+      - kita_planer_runtime_secrets:/app/runtime-secrets:ro
     depends_on:
       postgres:
         condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
     expose:
       - "3000"
     read_only: true
@@ -63,7 +68,6 @@ services:
     restart: unless-stopped
 
   migrate:
-    profiles: ["maintenance"]
     build:
       context: .
       dockerfile: Dockerfile
@@ -72,11 +76,16 @@ services:
         NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:?}
     environment:
       NODE_ENV: production
-      DATABASE_URL: ${MIGRATION_DATABASE_URL:?}
-      APP_DATABASE_PASSWORD: ${APP_DATABASE_PASSWORD:?}
+      POSTGRES_DB: ${POSTGRES_DB:-kita_planer}
+      POSTGRES_USER: ${POSTGRES_USER:-kita_planer}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
+      APP_DATABASE_PASSWORD_FILE: /app/runtime-secrets/database-password
       UPLOAD_DIR: /app/uploads/announcements
+    command: ["node", "scripts/initialize-production.mjs"]
     volumes:
       - kita_planer_uploads:/app/uploads
+      - kita_planer_next_cache:/app/runtime-cache
+      - kita_planer_runtime_secrets:/app/runtime-secrets
     depends_on:
       postgres:
         condition: service_healthy
@@ -103,4 +112,5 @@ volumes:
   kita_planer_postgres_data:
   kita_planer_uploads:
   kita_planer_next_cache:
+  kita_planer_runtime_secrets:
   kita_planer_pgadmin_data: