Add dedicated nginx static-server for Django admin and DRF static files

- Created static-server with nginx to serve /static files
- Reverted urls.py to remove static() helper (Django no longer serves static files)
- Reverted entrypoint.sh to remove collectstatic command
- Updated Traefik routing: /static now routes to static-server instead of backend
- Backend routes only /api and /admin paths
- Static files collected during backend build and shared via volume
- Added wget to static-server for health checks

Co-authored-by: pirus99 <206077632+pirus99@users.noreply.github.com>

Author: Copilot

backend/core/urls.py

@@ -16,8 +16,6 @@
 """
 from django.contrib import admin
 from django.urls import path, include
-from django.conf import settings
-from django.conf.urls.static import static
 
 urlpatterns = [
     path('admin/', admin.site.urls),
@@ -26,10 +24,3 @@
     path('api/v1/auth/', include('user_auth_app.api.urls')),
     path('api-auth', include('rest_framework.urls')),
 ]
-
-# Serve static files in production
-# Note: This serves Django admin and DRF static files through Django.
-# For high-traffic production, consider using WhiteNoise middleware or
-# configuring nginx/CDN to serve static files directly.
-if not settings.DEBUG:
-    urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)

backend/entrypoint.sh

@@ -6,10 +6,6 @@ echo "Starting entrypoint script..."
 # Wait a bit for any database to be ready (useful for PostgreSQL/MySQL in the future)
 sleep 2
 
-# Collect static files to the volume-mounted directory
-echo "Collecting static files..."
-python manage.py collectstatic --noinput --clear
-
 # Run database migrations
 echo "Running database migrations..."
 python manage.py migrate --noinput

docker-compose.yml

@@ -69,13 +69,13 @@ services:
       - web
     labels:
       - "traefik.enable=true"
-      # HTTP router - backend accessible at /api/, /admin/, and /static/ paths on main domain
-      - "traefik.http.routers.backend.rule=Host(`${DOMAIN:-localhost}`) && (PathPrefix(`/api`) || PathPrefix(`/admin`) || PathPrefix(`/static`))"
+      # HTTP router - backend accessible at /api/ and /admin/ paths on main domain
+      - "traefik.http.routers.backend.rule=Host(`${DOMAIN:-localhost}`) && (PathPrefix(`/api`) || PathPrefix(`/admin`))"
       - "traefik.http.routers.backend.entrypoints=web"
       - "traefik.http.routers.backend.priority=100"
       - "traefik.http.services.backend.loadbalancer.server.port=8000"
       # HTTPS router - uses Traefik default certificate (or Let's Encrypt if configured)
-      - "traefik.http.routers.backend-secure.rule=Host(`${DOMAIN:-localhost}`) && (PathPrefix(`/api`) || PathPrefix(`/admin`) || PathPrefix(`/static`))"
+      - "traefik.http.routers.backend-secure.rule=Host(`${DOMAIN:-localhost}`) && (PathPrefix(`/api`) || PathPrefix(`/admin`))"
       - "traefik.http.routers.backend-secure.entrypoints=websecure"
       - "traefik.http.routers.backend-secure.priority=100"
       - "traefik.http.routers.backend-secure.tls=true"
@@ -88,6 +88,40 @@ services:
       retries: 3
       start_period: 40s
 
+  # Static Server - Serves Django admin and DRF static files
+  static-server:
+    build:
+      context: ./static-server
+      dockerfile: Dockerfile
+    container_name: join-static-server
+    restart: unless-stopped
+    volumes:
+      - backend-static:/usr/share/nginx/html/static:ro
+    networks:
+      - web
+    labels:
+      - "traefik.enable=true"
+      # HTTP router - serves /static/ path
+      - "traefik.http.routers.static-server.rule=Host(`${DOMAIN:-localhost}`) && PathPrefix(`/static`)"
+      - "traefik.http.routers.static-server.entrypoints=web"
+      - "traefik.http.routers.static-server.priority=100"
+      - "traefik.http.services.static-server.loadbalancer.server.port=80"
+      # HTTPS router - uses Traefik default certificate (or Let's Encrypt if configured)
+      - "traefik.http.routers.static-server-secure.rule=Host(`${DOMAIN:-localhost}`) && PathPrefix(`/static`)"
+      - "traefik.http.routers.static-server-secure.entrypoints=websecure"
+      - "traefik.http.routers.static-server-secure.priority=100"
+      - "traefik.http.routers.static-server-secure.tls=true"
+      # Uncomment the next line to use Let's Encrypt instead of Traefik default certificate
+      # - "traefik.http.routers.static-server-secure.tls.certresolver=letsencrypt"
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    depends_on:
+      - backend
+
   # Frontend - Angular Application
   frontend:
     build:

static-server/Dockerfile

@@ -0,0 +1,19 @@
+# Static Server Dockerfile - Serves Django admin and DRF static files
+FROM nginx:alpine
+
+# Install wget for health checks
+RUN apk add --no-cache wget
+
+# Copy nginx configuration
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+# Create directory for static files
+RUN mkdir -p /usr/share/nginx/html/static
+
+# The static files will be copied from the backend build stage
+# This is done in docker-compose.yml using a shared volume
+
+# Expose port
+EXPOSE 80
+
+CMD ["nginx", "-g", "daemon off;"]

static-server/nginx.conf

@@ -0,0 +1,39 @@
+server {
+    listen 80;
+    server_name localhost;
+    root /usr/share/nginx/html;
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 10240;
+    gzip_proxied expired no-cache no-store private auth;
+    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # Serve static files from /static path
+    location /static/ {
+        alias /usr/share/nginx/html/static/;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        
+        # Handle missing files gracefully
+        try_files $uri $uri/ =404;
+    }
+
+    # Health check endpoint
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    # Return 404 for all other paths
+    location / {
+        return 404;
+    }
+}