fix: resolve Docker Compose deployment issues with SSL redirect and pg healthcheck

Make force_ssl opt-in (FORCE_SSL=true) so plain-HTTP deployments work
out of the box, fix the misplaced exclude option, match URL scheme/port
to the SSL setting, remove hardcoded PHX_HOST=localhost, and silence
noisy pg_isready logs by targeting the correct database.

Closes #4

Author: raffaelschneider

config/prod.exs

@@ -14,15 +14,16 @@ config :zentinel_cp, Oban, engine: Oban.Engines.Basic
 config :zentinel_cp, ZentinelCpWeb.Endpoint,
   cache_static_manifest: "priv/static/cache_manifest.json"
 
-# Force using SSL in production. This also sets the "strict-security-transport" header,
-# known as HSTS. If you have a health check endpoint, you may want to exclude it below.
-# Note `:force_ssl` is required to be set at compile-time.
-config :zentinel_cp, ZentinelCpWeb.Endpoint,
-  force_ssl: [rewrite_on: [:x_forwarded_proto]],
-  exclude: [
-    # paths: ["/health"],
-    hosts: ["localhost", "127.0.0.1"]
-  ]
+# Force SSL in production (opt-in via FORCE_SSL=true at build time).
+# Sets the "strict-transport-security" header (HSTS) and redirects HTTP → HTTPS.
+# Note: `force_ssl` must be set at compile-time.
+if System.get_env("FORCE_SSL") in ["true", "1"] do
+  config :zentinel_cp, ZentinelCpWeb.Endpoint,
+    force_ssl: [
+      rewrite_on: [:x_forwarded_proto],
+      exclude: ["localhost", "127.0.0.1"]
+    ]
+end
 
 # Configure Swoosh API Client
 config :swoosh, api_client: Swoosh.ApiClient.Req

config/runtime.exs

@@ -90,8 +90,15 @@ if config_env() == :prod do
 
   config :zentinel_cp, :dns_cluster_query, System.get_env("DNS_CLUSTER_QUERY")
 
+  port = String.to_integer(System.get_env("PORT") || "4000")
+
+  {url_scheme, url_port} =
+    if System.get_env("FORCE_SSL") in ["true", "1"],
+      do: {"https", 443},
+      else: {"http", port}
+
   config :zentinel_cp, ZentinelCpWeb.Endpoint,
-    url: [host: host, port: 443, scheme: "https"],
+    url: [host: host, port: url_port, scheme: url_scheme],
     http: [
       # Enable IPv6 and bind on all interfaces.
       # Set it to  {0, 0, 0, 0, 0, 0, 0, 1} for local network only access.

docker-compose.yml

@@ -6,7 +6,7 @@ services:
     environment:
       DATABASE_URL: "ecto://zentinel:zentinel@postgres:5432/zentinel_cp"
       SECRET_KEY_BASE: "change-me-in-production-use-mix-phx-gen-secret-to-generate"
-      PHX_HOST: "localhost"
+      # PHX_HOST: "your-domain.com"  # Set to your server's domain or IP
       PORT: "4000"
       S3_ENDPOINT: "http://minio:9000"
       S3_BUCKET: "zentinel-bundles"
@@ -37,7 +37,7 @@ services:
     volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U zentinel"]
+      test: ["CMD-SHELL", "pg_isready -U zentinel -d zentinel_cp"]
       interval: 5s
       timeout: 5s
       retries: 5