speccursor/docker-compose.prod.yml at main · SentinelOps-CI/speccursor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
# Production overlay — hardened control-plane on Docker Compose.
# Usage:
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml --env-file .env.production up -d --build
#
# Intended for a dedicated host or VM you control. For EKS/AWS observability,
# see terraform/observability/. This file does not create cloud accounts.

services:
  postgres:
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env.production}
      POSTGRES_USER: ${POSTGRES_USER:-speccursor}
      POSTGRES_DB: ${POSTGRES_DB:-speccursor}
    # Bind only to loopback on the host (not the LAN).
    ports:
      - '127.0.0.1:${POSTGRES_PUBLISH_PORT:-5432}:5432'
    restart: always

  redis:
    command: >
      redis-server
      --appendonly yes
      --requirepass ${REDIS_PASSWORD:?Set REDIS_PASSWORD in .env.production}
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?Set REDIS_PASSWORD in .env.production}
    ports:
      - '127.0.0.1:${REDIS_PUBLISH_PORT:-6379}:6379'
    healthcheck:
      test: ['CMD-SHELL', 'redis-cli -a "$$REDIS_PASSWORD" ping | grep -q PONG']
      interval: 10s
      timeout: 5s
      retries: 5
    restart: always

  prometheus:
    profiles: ['observability']
  grafana:
    profiles: ['observability']
  loki:
    profiles: ['observability']
  jaeger:
    profiles: ['observability']
  mailhog:
    profiles: ['devtools']
  lean-dev:
    profiles: ['devtools']

  controller:
    build:
      context: .
      dockerfile: infrastructure/docker/Dockerfile.service
      args:
        SERVICE: controller
    image: speccursor-controller:${IMAGE_TAG:-prod}
    container_name: speccursor-controller
    restart: always
    env_file:
      - .env.production
    environment:
      APP_ENV: production
      NODE_ENV: production
      PORT: 3001
      DATABASE_URL: postgresql://${POSTGRES_USER:-speccursor}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-speccursor}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      DB_SSL: ${DB_SSL:-false}
      LOG_LEVEL: ${LOG_LEVEL:-warn}
    ports:
      - '${CONTROLLER_PORT:-3001}:3001'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test:
        [
          'CMD',
          'node',
          '-e',
          "fetch('http://127.0.0.1:3001/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 20s
      timeout: 5s
      retries: 6
      start_period: 60s
    networks:
      - default

  ai-service:
    build:
      context: .
      dockerfile: infrastructure/docker/Dockerfile.service
      args:
        SERVICE: ai-service
    image: speccursor-ai-service:${IMAGE_TAG:-prod}
    container_name: speccursor-ai-service
    restart: always
    env_file:
      - .env.production
    environment:
      APP_ENV: production
      NODE_ENV: production
      PORT: 3002
      DATABASE_URL: postgresql://${POSTGRES_USER:-speccursor}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-speccursor}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      DB_SSL: ${DB_SSL:-false}
      LOG_LEVEL: ${LOG_LEVEL:-warn}
    ports:
      - '${AI_SERVICE_PORT:-3002}:3002'
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test:
        [
          'CMD',
          'node',
          '-e',
          "fetch('http://127.0.0.1:3002/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 20s
      timeout: 5s
      retries: 6
      start_period: 60s
    networks:
      - default

  github-app:
    build:
      context: .
      dockerfile: infrastructure/docker/Dockerfile.service
      args:
        SERVICE: github-app
    image: speccursor-github-app:${IMAGE_TAG:-prod}
    container_name: speccursor-github-app
    restart: always
    env_file:
      - .env.production
    environment:
      APP_ENV: production
      NODE_ENV: production
      PORT: 3000
      DATABASE_URL: postgresql://${POSTGRES_USER:-speccursor}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-speccursor}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      DB_SSL: ${DB_SSL:-false}
      LOG_LEVEL: ${LOG_LEVEL:-warn}
    ports:
      - '${GITHUB_APP_PORT:-3080}:3000'
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test:
        [
          'CMD',
          'node',
          '-e',
          "fetch('http://127.0.0.1:3000/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 20s
      timeout: 5s
      retries: 6
      start_period: 60s
    networks:
      - default