Docker, Nginx & Linux Stack Visual Composer

# =====================================================================
# Generated by InfraCalc Visual Stack Composer (https://infracalc.web.id)
# Project : kampus-app (app.example.com)
# Topology: BOTH_NGINX_AND_CF -> frontend + backend-api -> POSTGRES_16 + redis
# =====================================================================
name: kampus-app

services:
  nginx-proxy:
    image: nginx:1.27-alpine
    container_name: kampus-app-nginx
    restart: unless-stopped
    ports:
      - "127.0.0.1:8080:80"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./certbot/conf:/etc/letsencrypt:ro
    depends_on:
      - frontend
      - backend-api
    networks:
      - edge-net

  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: kampus-app-tunnel
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}
    networks:
      - edge-net

  frontend:
    image: node:20-alpine
    container_name: kampus-app-frontend
    restart: unless-stopped
    working_dir: /app
    environment:
      NODE_ENV: production
      NEXT_PUBLIC_API_URL: https://app.example.com/api
    expose:
      - "3000"
    networks:
      - edge-net

  backend-api:
    image: dunglas/frankenphp:1-php8.3-alpine
    container_name: kampus-app-backend
    restart: unless-stopped
    working_dir: /app
    command: php artisan octane:frankenphp --host=0.0.0.0 --port=8000
    environment:
      APP_ENV: production
      PORT: 8000
      DB_HOST: database
      DB_PORT: 5432
      DB_NAME: ${DB_NAME:-app_db}
      DB_USER: ${DB_USER:-app_user}
      DB_PASSWORD: ${DB_PASSWORD}
      REDIS_URL: redis://redis-cache:6379
    expose:
      - "8000"
    depends_on:
      database:
        condition: service_healthy
    networks:
      - edge-net
      - db-net

  database:
    image: postgres:16-alpine
    container_name: kampus-app-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME:-app_db}
      POSTGRES_USER: ${DB_USER:-app_user}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-app_user} -d ${DB_NAME:-app_db}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - db-net

  redis-cache:
    image: redis:7.4-alpine
    container_name: kampus-app-redis
    restart: unless-stopped
    command: redis-server --save 60 1 --loglevel warning --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis-data:/data
    networks:
      - db-net

  uptime-kuma:
    image: louislam/uptime-kuma:1
    container_name: kampus-app-monitoring
    restart: unless-stopped
    ports:
      - "127.0.0.1:3001:3001"
    volumes:
      - kuma-data:/app/data
    networks:
      - edge-net

networks:
  edge-net:
    driver: bridge
  db-net:
    driver: bridge
    internal: true

volumes:
  db-data:
  redis-data:
  kuma-data:

# =====================================================================
# Nginx Reverse Proxy Configuration — Generated via https://infracalc.web.id
# Domain: app.example.com
# =====================================================================
upstream frontend_upstream {
    server frontend:3000;
    keepalive 32;
}

upstream backend_upstream {
    server backend-api:8000;
    keepalive 32;
}

server {
    listen 80;
    server_name app.example.com;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    client_max_body_size 25M;

    # Backend API Route (/api/* -> backend-api:8000)
    location /api/ {
        proxy_pass http://backend_upstream;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Root Route (-> frontend:3000)
    location / {
        proxy_pass http://frontend_upstream;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

#!/usr/bin/env bash
# =====================================================================
# Ubuntu/Debian VPS & Docker Firewall Hardening Script
# Generated via https://infracalc.web.id
# =====================================================================
set -euo pipefail

echo "[1/4] Configuring UFW Default Policies..."
sudo ufw default deny incoming
sudo ufw default allow outgoing

echo "[2/4] Allowing SSH Port (22/tcp)..."
sudo ufw allow 22/tcp comment 'SSH Management'
echo "[3/4] Zero-Trust Cloudflare Tunnel Active: Blocking public HTTP/HTTPS direct ports..."
# No inbound 80/443 needed on public VPS IP when using cloudflared!

echo "[4/4] Enabling UFW & Verifying Database Isolation (db-net internal: true)..."
sudo ufw --force enable
sudo ufw status verbose

# .env.example — Copy to .env before running 'docker compose up -d'
DB_NAME=kampus_app_db
DB_USER=kampus_app_user
DB_PASSWORD=ChangeMe_StrongPassword_2026!
DB_ROOT_PASSWORD=ChangeMe_RootSecret_2026!
REDIS_PASSWORD=ChangeMe_RedisSecret_2026!
CLOUDFLARE_TUNNEL_TOKEN=eyJhIjoi...paste_your_tunnel_token_here