Harden client and WebSocket proxy

docker-compose.yml

@@ -1,22 +1,47 @@
-version: '3.8'
-
 services:
-  svelte-mud:
+  svelte-mud-app:
     build:
       context: .
       dockerfile: Dockerfile
-    container_name: svelte-mud
+    image: svelte-mud:local
+    container_name: svelte-mud-app
+    command: ["node", "build/index.js"]
     restart: unless-stopped
     networks:
       - revproxy
     environment:
-      - NODE_ENV=production
-    # No need to publish ports to host, but expose them to container network
+      NODE_ENV: production
     expose:
-      - 3000
-      - 3001
+      - "3000"
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+  svelte-mud-proxy:
+    image: svelte-mud:local
+    container_name: svelte-mud-proxy
+    command: ["node", "src/websocket-server.js"]
+    restart: unless-stopped
+    depends_on:
+      svelte-mud-app:
+        condition: service_started
+    networks:
+      - revproxy
+    environment:
+      NODE_ENV: production
+      ALLOWED_ORIGINS: https://mud.iamtalon.me
+      TRUST_PROXY: "1"
+    expose:
+      - "3001"
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
 
 # Define networks to connect to external services
 networks:
   revproxy:
-    external: true
+    external: true