create-win-project 1.4.0 → 2.0.0

package/templates/ci/fastapi.yml

@@ -0,0 +1,62 @@
+name: CI — Backend
+
+on:
+  push:
+    branches: [dev, main]
+    paths:
+      - backend/**
+  pull_request:
+    branches: [dev, main]
+    paths:
+      - backend/**
+
+permissions:
+  contents: read
+
+jobs:
+  ci-backend:
+    name: Test, Build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+    services:
+      postgres:
+        image: {{POSTGRES_IMAGE}}
+        env:
+          POSTGRES_DB: app_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d app_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgresql+asyncpg://postgres:postgres@127.0.0.1:5432/app_test
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "{{PYTHON_VERSION}}"
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v6
+        with:
+          version: "{{UV_VERSION}}"
+      - name: Install dependencies
+        run: uv sync --frozen
+      - name: Apply migrations
+        run: uv run alembic upgrade head
+      - name: Check migrations are current
+        run: uv run alembic check
+      - name: Run Ruff
+        run: uv run ruff check .
+      - name: Check formatting
+        run: uv run ruff format --check .
+      - name: Run mypy
+        run: uv run mypy .
+      - name: Run tests
+        run: uv run pytest
+      - name: Build image
+        run: docker build -f Dockerfile .

package/templates/docker/compose-prod/fastapi.yml

@@ -0,0 +1,52 @@
+# docker-compose.prod.yml — {{PROJECT_NAME}} ({{STACK}}) — Prod
+services:
+
+  backend:
+    container_name: {{PROJECT_NAME}}-backend
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+    ports:
+      - "${BACKEND_HOST_PORT:-8000}:8000"
+    environment:
+      - DATABASE_URL=${DATABASE_URL}
+      - OIDC_ISSUER=${OIDC_ISSUER}
+      - OIDC_AUDIENCE=${OIDC_AUDIENCE}
+      - OIDC_ALGORITHMS=${OIDC_ALGORITHMS}
+      - OIDC_JWKS_URL=${OIDC_JWKS_URL}
+      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS}
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - app-network
+    healthcheck:
+      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+  db:
+    container_name: {{PROJECT_NAME}}-db
+    image: {{POSTGRES_IMAGE}}
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    networks:
+      - app-network
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  postgres-data:
+    name: {{PROJECT_NAME}}-postgres-data
+
+networks:
+  app-network:
+    name: {{PROJECT_NAME}}-network

package/templates/docker/compose-prod/springboot.yml

@@ -16,6 +16,11 @@ services:
     networks:
       - app-network
     restart: always
+    read_only: true
+    tmpfs: [/tmp]
+    deploy:
+      resources:
+        limits: { cpus: "1.0", memory: 512M }
 
   backend:
     container_name: {{PROJECT_NAME}}-backend-prod
@@ -35,7 +40,17 @@ services:
         condition: service_healthy
     networks:
       - app-network
+      - data-network
     restart: always
+    stop_grace_period: 30s
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8080/api/health"]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+    deploy:
+      resources:
+        limits: { cpus: "1.0", memory: 768M }
 
   db:
     container_name: {{PROJECT_NAME}}-db-prod
@@ -47,7 +62,7 @@ services:
     volumes:
       - postgres-data-prod:/var/lib/postgresql/data
     networks:
-      - app-network
+      - data-network
     restart: always
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
@@ -62,3 +77,6 @@ volumes:
 networks:
   app-network:
     name: {{PROJECT_NAME}}-network-prod
+  data-network:
+    name: {{PROJECT_NAME}}-data-network-prod
+    internal: true

package/templates/docker/dockerfile/fastapi.dev.dockerfile

@@ -0,0 +1,9 @@
+FROM {{PYTHON_IMAGE}}
+WORKDIR /app
+COPY --from=ghcr.io/astral-sh/uv:{{UV_VERSION}} /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock .python-version README.md ./
+RUN uv sync --frozen --no-install-project
+COPY . .
+RUN uv sync --frozen
+EXPOSE 8000
+CMD ["uv", "run", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]

package/templates/docker/dockerfile/fastapi.prod.dockerfile

@@ -0,0 +1,11 @@
+FROM {{PYTHON_IMAGE}}
+WORKDIR /app
+COPY --from=ghcr.io/astral-sh/uv:{{UV_VERSION}} /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock .python-version README.md ./
+RUN uv sync --frozen --no-install-project
+COPY . .
+RUN uv sync --frozen
+RUN useradd --create-home --no-log-init appuser && chown -R appuser:appuser /app
+EXPOSE 8000
+USER appuser
+CMD ["/app/.venv/bin/uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

package/templates/docker/dockerfile/nextjs.prod.dockerfile

@@ -11,6 +11,7 @@ RUN npm run build
 FROM {{NODE_IMAGE}} AS production
 WORKDIR /app
 ENV NODE_ENV=production
+USER node
 COPY --from=builder /app/.next/standalone ./
 COPY --from=builder /app/.next/static ./.next/static
 COPY --from=builder /app/public ./public

package/templates/docker/dockerfile/springboot.prod.dockerfile

@@ -5,6 +5,9 @@ RUN mvn --batch-mode package -DskipTests
 
 FROM {{JAVA_IMAGE}} AS production
 WORKDIR /app
+RUN addgroup -S app && adduser -S -G app app
 COPY --from=builder /app/target/*.jar app.jar
+RUN chown app:app app.jar
+USER app
 EXPOSE 8080
-CMD ["java", "-jar", "app.jar"]
+CMD ["java", "-XX:MaxRAMPercentage=75", "-jar", "app.jar"]

package/templates/docker/dockerfile/vite.prod.dockerfile

@@ -8,5 +8,6 @@ RUN npm run build
 FROM {{NGINX_IMAGE}} AS production
 COPY --from=builder /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
-EXPOSE 80
+USER nginx
+EXPOSE 8080
 CMD ["nginx", "-g", "daemon off;"]

package/templates/makefile/fastapi.mk

@@ -0,0 +1,97 @@
+# =============================================================================
+# Makefile — {{PROJECT_NAME}}
+# =============================================================================
+
+# Variables
+COMPOSE      := docker compose
+BACKEND      := $(COMPOSE) exec backend
+DB           := $(COMPOSE) exec db
+WORKDIR      := $(PWD)
+
+# =============================================================================
+# Default
+# =============================================================================
+
+.DEFAULT_GOAL := help
+
+.PHONY: help
+help: ## Show all available commands
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) \
+		| awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
+
+# =============================================================================
+# Project Lifecycle
+# =============================================================================
+
+.PHONY: dev up down restart logs logs-back clean
+
+dev: ## Start all containers and follow logs
+	$(COMPOSE) up --build
+
+up: ## Start all containers in background
+	$(COMPOSE) up -d --build
+
+down: ## Stop and remove all containers
+	$(COMPOSE) down
+
+restart: down up ## Stop then start all containers
+
+logs: ## Follow logs from all containers
+	$(COMPOSE) logs -f
+
+logs-back: ## Follow backend logs only
+	$(COMPOSE) logs -f backend
+
+clean: ## Remove containers, volumes, orphans (full reset)
+	$(COMPOSE) down -v --remove-orphans
+
+# =============================================================================
+# Database
+# =============================================================================
+
+.PHONY: migrate db-shell
+
+migrate: ## Run pending Alembic migrations
+	$(BACKEND) uv run alembic upgrade head
+
+db-shell: ## Open psql shell inside DB container
+	$(DB) psql -U $${POSTGRES_USER} -d $${POSTGRES_DB}
+
+# =============================================================================
+# Shells
+# =============================================================================
+
+.PHONY: shell-back
+
+shell-back: ## Open shell inside backend container
+	$(BACKEND) sh
+
+# =============================================================================
+# Quality
+# =============================================================================
+
+.PHONY: lint test test-back
+
+lint: ## Run Ruff check and format check (backend)
+	$(BACKEND) uv run ruff check .
+	$(BACKEND) uv run ruff format --check .
+
+test: test-back ## Run all tests
+
+test-back: ## Run pytest (backend)
+	$(BACKEND) uv run pytest
+
+# =============================================================================
+# Production
+# =============================================================================
+
+.PHONY: build prod-up prod-down
+
+build: ## Build production Docker images
+	$(COMPOSE) -f docker-compose.prod.yml build
+
+prod-up: ## Start production stack
+	$(COMPOSE) -f docker-compose.prod.yml up -d --build
+
+prod-down: ## Stop production stack
+	$(COMPOSE) -f docker-compose.prod.yml down