VacciChain/docker-compose.yml at main · princessoladele/VacciChain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
services:
  frontend:
    build: ./frontend
    ports:
      - "3000:80"
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:80"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/log/nginx
      - /tmp
    deploy:
      resources:
        limits:
          # nginx serving pre-built static assets — no dynamic work.
          # 0.05 CPU covers TLS termination + gzip at ~50 req/s.
          # 32 MB covers nginx worker processes with room to spare.
          cpus: "0.05"
          memory: 32M
        reservations:
          cpus: "0.01"
          memory: 16M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  backend:
    build: ./backend
    ports:
      - "4000:4000"
    env_file: .env
    environment:
      - EVENT_POLL_INTERVAL_MS=${EVENT_POLL_INTERVAL_MS:-15000}
      - DATABASE_PATH=/data/vaccichain.db
    volumes:
      - vaccichain_db:/data
    depends_on:
      python-service:
        condition: service_healthy
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4000/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          # Node.js heap for Express + Stellar SDK sits ~80–100 MB at rest.
          # Soroban RPC calls are CPU-light but allocate XDR buffers transiently.
          # 0.75 CPU allows burst during contract invocations without starving neighbours.
          # 256 MB gives 2× headroom over observed peak; OOM before host pressure.
          cpus: "0.75"
          memory: 256M
        reservations:
          cpus: "0.10"
          memory: 128M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  python-service:
    build: ./python-service
    ports:
      - "8001:8001"
    environment:
      - BACKEND_URL=http://backend:4000
      - ANOMALY_THRESHOLD=${ANOMALY_THRESHOLD:-50}
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8001/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          # FastAPI/uvicorn with httpx fan-out to Stellar Horizon.
          # Python baseline ~60 MB; analytics aggregation adds ~20 MB transiently.
          # 0.50 CPU handles concurrent async I/O without blocking the event loop.
          # 128 MB is 2× observed peak; keeps service isolated from backend OOM events.
          cpus: "0.50"
          memory: 128M
        reservations:
          cpus: "0.05"
          memory: 64M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  backup:
    build: ./backup
    env_file: .env
    volumes:
      - vaccichain_db:/data
    networks:
      - vaccichain
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

networks:
  vaccichain:
    driver: bridge

volumes:
  vaccichain_db: