Agrgar SSL

docker-compose.yml

@@ -2,16 +2,13 @@ services:
   # PostgreSQL Database
   db:
     image: postgres:15-alpine
-    environment:
-      - POSTGRES_DB=mac_attendance
-      - POSTGRES_USER=mac_user
-      - POSTGRES_PASSWORD=mac_password_2024_secure
+    env_file:
+      - .env.production
     volumes:
       - postgres_data:/var/lib/postgresql/data
     networks:
       - app-network
-    ports:
-      - "5432:5432"  # Expuesto para acceso desde host (comentar en producción si no es necesario)
+    # NO exponer puertos al host - solo accesible internamente
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U mac_user -d mac_attendance"]
       interval: 10s
@@ -26,26 +23,13 @@ services:
     command: >
       sh -c "python manage.py migrate &&
              python manage.py collectstatic --noinput &&
-             gunicorn --bind 0.0.0.0:8000 --workers 3 --timeout 120 mac_attendance.wsgi:application"
+             gunicorn --bind 0.0.0.0:8000 --workers 3 --timeout 300 mac_attendance.wsgi:application"
     volumes:
       - ./backend:/app
       - static_volume:/app/staticfiles
       - media_volume:/app/media
-    environment:
-      - DEBUG=True
-      - SECRET_KEY=django-insecure-dev-key-change-in-production-12345
-      - ALLOWED_HOSTS=localhost,127.0.0.1,nginx,backend
-      - RATELIMIT_ENABLE=False
-      - SECURE_SSL_REDIRECT=False
-      - SESSION_COOKIE_SECURE=False
-      - CSRF_COOKIE_SECURE=False
-      - CORS_ALLOWED_ORIGINS=http://localhost,http://127.0.0.1,http://localhost:80
-      - DB_ENGINE=postgresql
-      - DB_NAME=mac_attendance
-      - DB_USER=mac_user
-      - DB_PASSWORD=mac_password_2024_secure
-      - DB_HOST=db
-      - DB_PORT=5432
+    env_file:
+      - .env.production
     networks:
       - app-network
     depends_on:
@@ -60,9 +44,10 @@ services:
       context: .
       dockerfile: docker/Dockerfile.frontend
     ports:
-      - "80:80"
+      - "443:443"  # HTTPS (SSL/TLS) - ÚNICO puerto expuesto al host
     volumes:
       - ./docker/nginx.conf:/etc/nginx/conf.d/default.conf
+      - ./docker/ssl:/etc/nginx/ssl:ro  # Certificados SSL (solo lectura)
       - static_volume:/app/staticfiles
       - media_volume:/app/media
     depends_on:
@@ -72,7 +57,8 @@ services:
 
 networks:
   app-network:
-    driver: bridge
+    # Red interna para comunicación entre contenedores
+    # Solo nginx expone puerto 443 al host
 
 volumes:
   static_volume: