docker-compose.yml

services:
  clickhouse:
    image: clickhouse/clickhouse-server:latest-alpine
    # ports:
    #   - "8123:8123"
    #   - "9001:9000"
    volumes:
      - ./.mlop/clickhouse:/var/lib/clickhouse
    networks:
      - mlop_network
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    env_file:
      - .env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.clickhouse_secure.rule=Host(`${TRAEFIK_CLICKHOUSE_HOST}`)"
      - "traefik.http.routers.clickhouse_secure.entrypoints=websecure_ch"
      - "traefik.http.routers.clickhouse_secure.service=clickhouse_svc"
      - "traefik.http.routers.clickhouse_secure.tls=true"
      - "traefik.http.routers.clickhouse_secure.tls.certresolver=myresolver"
      - "traefik.http.services.clickhouse_svc.loadbalancer.server.port=8123"
      - "traefik.http.services.clickhouse_svc.loadbalancer.server.scheme=http"
    restart: unless-stopped

  db:
    image: supabase/postgres:17.4.1.017
    # ports:
    #   - "5432:5432"
    command: postgres -c config_file=/etc/postgresql/postgresql.conf
    networks:
      - mlop_network
    volumes:
      - ./.mlop/postgresql:/var/lib/postgresql
    env_file:
      - .env
    healthcheck:
      test: [ "CMD", "pg_isready", "-U", "postgres", "-d", "postgres" ]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  minio:
    image: minio/minio:latest
    ports:
      - "9000:9000"
      # - "9001:9001"
    networks:
      - mlop_network
    volumes:
      - ./.mlop/minio:/data
    env_file:
      - .env
    command: server /data --console-address ":9001"
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9000/minio/health/live" ]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  minio_create:
    image: minio/mc
    networks:
      - mlop_network
    depends_on:
      - minio
    env_file:
      - .env
    entrypoint: >
      /bin/sh -c " until (/usr/bin/mc alias set myminio http://minio:9000 $STORAGE_ACCESS_KEY_ID $STORAGE_SECRET_ACCESS_KEY) do echo '...waiting...' && sleep 1; done; /usr/bin/mc mb myminio/$STORAGE_BUCKET; /usr/bin/mc anonymous set public myminio/$STORAGE_BUCKET; exit 0; "

  traefik:
    image: traefik:latest
    container_name: traefik
    command:
      - "--api.dashboard=true"
      - "--log.level=INFO"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure_ch.address=:8443"
      - "--entrypoints.websecure_py.address=:443"
      - "--certificatesresolvers.myresolver.acme.email=${TRAEFIK_ACME_EMAIL}"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
    ports:
      - "80:80" # for http challenge
      - "8443:8443" # clickhouse
      - "443:443" # py
    # - "8080:8080" # dashboard
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./.mlop/traefik/letsencrypt:/letsencrypt"
    networks:
      - mlop_network
    env_file:
      - .env
    restart: unless-stopped

  ingest:
    build:
      context: ./ingest
      dockerfile: Dockerfile
    ports:
      - "3003:3003"
    networks:
      - mlop_network
    depends_on:
      clickhouse:
        condition: service_started
      minio:
        condition: service_started
      db:
        condition: service_healthy
    env_file:
      - .env
    entrypoint: [ "/bin/sh", "-c", "/opt/docker-setup/create_tables.sh; exec server-rs" ]
    restart: unless-stopped
  backend:
    build:
      context: ./web/server
      dockerfile: Dockerfile
      # dockerfile: Dockerfile.bun
      args:
        - IS_DOCKER=${IS_DOCKER}
        - STORAGE_ENDPOINT=${STORAGE_ENDPOINT}
        - STORAGE_ACCESS_KEY_ID=${STORAGE_ACCESS_KEY_ID}
        - STORAGE_SECRET_ACCESS_KEY=${STORAGE_SECRET_ACCESS_KEY}
        - STORAGE_BUCKET=${STORAGE_BUCKET}
        - CLICKHOUSE_URL=${CLICKHOUSE_URL}
        - CLICKHOUSE_USER=${CLICKHOUSE_USER}
        - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD}
        - DATABASE_URL=${DATABASE_URL}
        - DATABASE_DIRECT_URL=${DATABASE_DIRECT_URL}
        - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
        - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}
        - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
        - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
        - PUBLIC_URL=${PUBLIC_URL}
        - BETTER_AUTH_URL=${BETTER_AUTH_URL}
        - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
    ports:
      - "3001:3001"
    networks:
      - mlop_network
    depends_on:
      - clickhouse
      - db
      - minio
    entrypoint: [ "/bin/sh", "-c", "corepack enable pnpm && pnpm exec prisma migrate dev && node ./.next/standalone/server.js" ]
    # entrypoint: [ "/bin/sh", "-c", "bun ./.next/standalone/server.js" ]
    environment:
      - MALLOC_ARENA_MAX=1 # TODO: specific to glibc
    env_file:
      - .env
    restart: unless-stopped

  frontend:
    build:
      context: ./web/app
      dockerfile: Dockerfile
      args:
        - VITE_IS_DOCKER=${VITE_IS_DOCKER}
        - VITE_SERVER_URL=${VITE_SERVER_URL}
        - VITE_ENV=production
    ports:
      - "3000:3000"
    networks:
      - mlop_network
    depends_on:
      # TODO: check build time env vars
      - backend
    env_file:
      - .env
    restart: unless-stopped
  py:
    build:
      context: ./py
      dockerfile: Dockerfile
    ports:
      - "3004:3004"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - mlop_network
    depends_on:
      - clickhouse
      - db
    env_file:
      - .env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.py_secure.rule=Host(`${TRAEFIK_PY_HOST}`)"
      - "traefik.http.routers.py_secure.entrypoints=websecure_py"
      - "traefik.http.routers.py_secure.service=py_svc"
      - "traefik.http.routers.py_secure.tls=true"
      - "traefik.http.routers.py_secure.tls.certresolver=myresolver"
      - "traefik.http.services.py_svc.loadbalancer.server.port=3004"
      - "traefik.http.services.py_svc.loadbalancer.server.scheme=http"

networks:
  mlop_network:
    name: mlop_network
    driver: bridge