underlay/docker-compose.yml at main · knowledgefutures/underlay · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
# Stack file — deploy with: docker stack deploy -c docker-compose.yml <stack-name>
# SOPS decrypts .env.{prod,dev}.enc → .env before this runs (see deploy workflow).

services:
  app:
    image: ${IMAGE:-ghcr.io/knowledgefutures/underlay}:${IMAGE_TAG:-latest}
    env_file:
      - .env
    environment:
      NODE_ENV: production
      NODE_OPTIONS: '--max-old-space-size=448'
      PORT: ${PORT:-3000}
      UNDERLAY_MODE: ${UNDERLAY_MODE:-origin}
      UNDERLAY_UPSTREAM: ${UNDERLAY_UPSTREAM:-}
      UNDERLAY_NODE_NAME: ${UNDERLAY_NODE_NAME:-}
      UNDERLAY_SYNC_SCHEDULE: ${UNDERLAY_SYNC_SCHEDULE:-0 0 * * 0}
    ports:
      - '${PORT:-3000}:${PORT:-3000}'
    deploy:
      replicas: ${APP_REPLICAS:-2}
      resources:
        limits:
          memory: 640m
          cpus: '1.0'
        reservations:
          memory: 384m
          cpus: '0.25'
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
        failure_action: rollback
      rollback_config:
        parallelism: 1
        order: start-first
      restart_policy:
        condition: on-failure
    tmpfs:
      - /tmp:size=64m
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'node -e "Promise.all([fetch(\"http://127.0.0.1:${PORT:-3000}/api/health\"),fetch(\"http://127.0.0.1:${PORT:-3000}/\")]).then(rs=>{for(const r of rs)if(!r.ok)throw r.status}).catch(()=>process.exit(1))"',
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 45s
    logging:
      driver: json-file
      options:
        max-size: '10m'
        max-file: '3'
    networks:
      - appnet

  cron:
    image: ${IMAGE:-ghcr.io/knowledgefutures/underlay}:${IMAGE_TAG:-latest}
    env_file:
      - .env
    environment:
      NODE_ENV: production
      NODE_OPTIONS: '--max-old-space-size=128'
      UNDERLAY_MODE: ${UNDERLAY_MODE:-origin}
      UNDERLAY_UPSTREAM: ${UNDERLAY_UPSTREAM:-}
      UNDERLAY_NODE_NAME: ${UNDERLAY_NODE_NAME:-}
      UNDERLAY_SYNC_SCHEDULE: ${UNDERLAY_SYNC_SCHEDULE:-0 0 * * 0}
    command: ['node', '--import', 'tsx/esm', 'tools/cron.ts']
    deploy:
      replicas: 1
      resources:
        limits:
          memory: 192m
          cpus: '0.5'
        reservations:
          memory: 64m
          cpus: '0.1'
      restart_policy:
        condition: any
    tmpfs:
      - /tmp:size=16m
    logging:
      driver: json-file
      options:
        max-size: '5m'
        max-file: '3'
    networks:
      - appnet

  postgres:
    image: postgres:17-alpine
    env_file:
      - .env
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-underlay}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-underlay}
      POSTGRES_DB: ${POSTGRES_DB:-underlay}
    command: >
      -c shared_buffers=1GB
      -c effective_cache_size=3GB
      -c work_mem=32MB
      -c maintenance_work_mem=256MB
      -c max_connections=200
      -c max_wal_size=2GB
      -c min_wal_size=256MB
      -c wal_buffers=32MB
      -c checkpoint_completion_target=0.9
      -c random_page_cost=1.1
    volumes:
      - pgdata:/var/lib/postgresql/data
    ports:
      - '${DB_PORT:-5432}:5432'
    networks:
      - appnet
      - dbaccess
    stop_grace_period: 60s
    deploy:
      replicas: 1
      resources:
        limits:
          memory: 4g
          cpus: '2.0'
        reservations:
          memory: 1g
          cpus: '0.5'
      placement:
        constraints: [node.role == manager]
      restart_policy:
        condition: any
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-underlay}']
      interval: 10s
      timeout: 5s
      retries: 5
    logging:
      driver: json-file
      options:
        max-size: '10m'
        max-file: '3'

networks:
  appnet:
    driver: overlay
  dbaccess:
    driver: overlay
    attachable: true

volumes:
  pgdata: