docker/on-prem/docker-compose.full.yml at main · currents-dev/docker

390 lines (379 loc) · 11.7 KB
# Currents On-Prem Docker Compose
# Version: 2026-07-26-005
# Profile: full - All services (redis, mongodb, clickhouse, rustfs)
# Generated by: ./scripts/generate-compose.sh
# Includes Traefik for TLS termination (opt-in with: --profile tls)
# Enable with: docker compose --profile tls up
name: currents_full
# This core Currents application services
# RustFS service configuration
# S3-compatible object storage - usually excluded when using external S3/cloud storage
  # Configure Currents services to use path-style S3 URLs (required for RustFS)
  director:
    hostname: director
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}director:${DC_CURRENTS_IMAGE_TAG:-staging}
      - ${DC_DIRECTOR_PORT:-1234}:1234
    restart: unless-stopped
    env_file:
      - .env
    networks:
      - default
    environment:
      CURRENTS_ENV: onprem
      EMAIL_TRANSPORTER: smtp
      FILE_STORAGE_FORCE_PATH_STYLE: "true"
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
    hostname: api
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}api:${DC_CURRENTS_IMAGE_TAG:-staging}
      - ${DC_API_PORT:-4000}:4000
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      INCLUDE_DASHBOARD: onprem
      BETTER_AUTH_ENABLED: "true"
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_CURRENTS_PASSWORD}
      EMAIL_TRANSPORTER: smtp
      FILE_STORAGE_FORCE_PATH_STYLE: "true"
    volumes:
      - ${DC_SSO_VOLUME:-./data/sso}:/etc/currents/sso:ro
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  changestreams-worker:
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}change-streams:${DC_CURRENTS_IMAGE_TAG:-staging}
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_CURRENTS_PASSWORD}
      EMAIL_TRANSPORTER: smtp
      FILE_STORAGE_FORCE_PATH_STYLE: "true"
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  # Currents services depend on clickhouse
  write-worker:
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}writer:${DC_CURRENTS_IMAGE_TAG:-staging}
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_CURRENTS_PASSWORD}
      EMAIL_TRANSPORTER: smtp
      FILE_STORAGE_FORCE_PATH_STYLE: "true"
    depends_on:
      clickhouse:
        condition: service_healthy
        required: false
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  scheduler:
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}scheduler:${DC_CURRENTS_IMAGE_TAG:-staging}
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_CURRENTS_PASSWORD}
      RUN_STARTUP_TASKS: "true"
      EMAIL_TRANSPORTER: smtp
      FILE_STORAGE_FORCE_PATH_STYLE: "true"
    volumes:
      - ${DC_SCHEDULER_STARTUP_VOLUME:-./data/startup}:/app/packages/scheduler/dist/.startup
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  webhooks:
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}webhooks:${DC_CURRENTS_IMAGE_TAG:-staging}
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      EMAIL_TRANSPORTER: smtp
      FILE_STORAGE_FORCE_PATH_STYLE: "true"
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  # Enable RustFS storage routing in Traefik
    hostname: traefik
    image: ${DC_TRAEFIK_IMAGE:-traefik:v3.3}
    restart: unless-stopped
    profiles:
      - tls
    environment:
      TRAEFIK_ENABLE_STORAGE: "true"
      TRAEFIK_GENERATE_TEMP_CERTS: ${TRAEFIK_GENERATE_TEMP_CERTS:-false}
      - ${DC_TRAEFIK_HTTP_PORT:-80}:80
      - ${DC_TRAEFIK_HTTPS_PORT:-443}:443
    networks:
      - default
    volumes:
      - ${DC_TRAEFIK_CERTS_DIR:-./data/traefik/certs}:/certs
      - ${DC_TRAEFIK_CONFIG_DIR:-./data/traefik/config}:/traefik-config:ro
    command:
      # Entrypoints
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      # HTTP to HTTPS redirect
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      # TLS configuration (file-based certificates)
      - --entrypoints.websecure.http.tls=true
      # File provider for dynamic configuration
      - --providers.file.filename=${DC_TRAEFIK_DYNAMIC_CONFIG_PATH:-/etc/traefik/dynamic.yml}
      - --providers.file.watch=true
      # Enable API for healthcheck (insecure mode, internal only)
      - --api.insecure=true
      - --api.dashboard=false
      # Health check endpoint
      - --ping=true
    configs:
      - source: traefik_dynamic
        target: /etc/traefik/dynamic.yml
    healthcheck:
      test: ['CMD', 'traefik', 'healthcheck', '--ping']
      interval: 10s
      timeout: 5s
      retries: 3
  clickhouse:
    hostname: clickhouse
    image: ${DC_CLICKHOUSE_IMAGE:-clickhouse/clickhouse-server:25.8}
    restart: unless-stopped
    environment:
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: '1'
    healthcheck:
      test:
        - 'CMD-SHELL'
        - 'wget --spider -q clickhouse:8123/ping'
      interval: 2s
      timeout: 5s
      retries: 10
    env_file:
      - .env
      - ${DC_CLICKHOUSE_HTTP_PORT:-127.0.0.1:8123}:8123 # HTTP Interface
      - ${DC_CLICKHOUSE_TCP_PORT:-127.0.0.1:9123}:9000 # TCP Interface
    networks:
      - default
    configs:
      - source: clickhouse_users
        target: /etc/clickhouse-server/users.d/users.xml
    volumes:
      - ${DC_CLICKHOUSE_VOLUME:-./data/clickhouse}:/var/lib/clickhouse
    hostname: mongodb
    image: ${DC_MONGODB_IMAGE:-mongo:8.2.3}
      - ${DC_MONGODB_PORT:-127.0.0.1:27017}:27017
    restart: unless-stopped
    entrypoint:
      - bash
        # Generate keyFile if it doesn't exist
        KEYFILE=/data/db/replica.key
        if [ ! -f "$$KEYFILE" ]; then
          echo "Generating MongoDB replica set keyFile..."
          openssl rand -base64 756 > "$$KEYFILE"
        chmod 400 "$$KEYFILE"
        chown mongodb:mongodb "$$KEYFILE"
        # Call original Docker entrypoint (handles MONGO_INITDB_* user creation)
        exec docker-entrypoint.sh mongod --bind_ip_all --replSet rs0 --auth --keyFile "$$KEYFILE"
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGODB_USERNAME}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD}
    networks:
      - default
    healthcheck:
      test:
        - CMD-SHELL
          mongosh -u "$$MONGO_INITDB_ROOT_USERNAME" -p "$$MONGO_INITDB_ROOT_PASSWORD" --authenticationDatabase admin --quiet --eval "
          try {
            const status = rs.status();
            if (status.myState === 1) { quit(0); }
            quit(1);
          } catch (err) {
            if (err.codeName === 'NotYetInitialized') {
              rs.initiate({_id:'rs0', members:[{_id:0, host:'mongodb:27017'}]});
            quit(1);
      interval: 5s
      timeout: 10s
      retries: 30
      start_period: 10s
    volumes:
      - ${DC_MONGODB_VOLUME:-./data/mongodb}:/data/db
    hostname: redis
    image: ${DC_REDIS_IMAGE:-redis/redis-stack-server:7.4.0-v8}
      - ${DC_REDIS_PORT:-127.0.0.1:6379}:6379
    restart: unless-stopped
    networks:
      - default
    volumes:
      - ${DC_REDIS_VOLUME:-./data/redis}:/data
    hostname: rustfs
    image: ${DC_RUSTFS_IMAGE:-rustfs/rustfs:1.0.0-alpha.79}
      - ${DC_RUSTFS_S3_PORT:-9000}:9000 # S3 API port
      - ${DC_RUSTFS_CONSOLE_PORT:-9001}:9001 # Web console port
    environment:
      RUSTFS_CONSOLE_ENABLE: "true"
      RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY}
      RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY}
    env_file:
      - .env
    networks:
      - default
    volumes:
      - ${DC_RUSTFS_VOLUME:-./data/rustfs}:/data # /data is RustFS's default storage location
    healthcheck:
      test: ['CMD-SHELL', 'curl -f http://localhost:9000/health || exit 1']
      interval: 2s
      timeout: 5s
      retries: 10
  rustfs-init:
    image: ${DC_AWS_CLI_IMAGE:-amazon/aws-cli:2.32.31}
    depends_on:
      rustfs:
        condition: service_healthy
    environment:
      AWS_ACCESS_KEY_ID: ${RUSTFS_ACCESS_KEY}
      AWS_SECRET_ACCESS_KEY: ${RUSTFS_SECRET_KEY}
      AWS_DEFAULT_REGION: us-east-1
    entrypoint: >
      sh -c "aws --endpoint-url=http://rustfs:9000 s3 mb s3://currents || true"
    networks:
      - default
  default: null
  traefik_dynamic:
    content: |
      # Traefik dynamic configuration (supports Go templating with sprig)
      {{- if ne (env "TRAEFIK_GENERATE_TEMP_CERTS") "true" }}
        certificates:
          - certFile: /certs/wildcard.crt
            keyFile: /certs/wildcard.key
      {{- end }}
      http:
        routers:
          # API / Dashboard service
          api:
            rule: "Host(`${TRAEFIK_API_SUBDOMAIN:-currents-app}.${TRAEFIK_DOMAIN:-localhost}`)"
            service: api
            entryPoints:
              - websecure
            tls: {}
          # Director service (record API)
          director:
            rule: "Host(`${TRAEFIK_DIRECTOR_SUBDOMAIN:-currents-record}.${TRAEFIK_DOMAIN:-localhost}`)"
            service: director
            entryPoints:
              - websecure
            tls: {}
          {{- if eq (env "TRAEFIK_ENABLE_STORAGE") "true" }}
          # RustFS S3 API (conditionally enabled)
          storage:
            rule: "Host(`${TRAEFIK_STORAGE_SUBDOMAIN:-currents-storage}.${TRAEFIK_DOMAIN:-localhost}`)"
            service: rustfs
            entryPoints:
              - websecure
            tls: {}
          {{- end }}
        services:
          api:
            loadBalancer:
              servers:
                - url: "http://api:4000"
          director:
            loadBalancer:
              servers:
                - url: "http://director:1234"
          {{- if eq (env "TRAEFIK_ENABLE_STORAGE") "true" }}
          rustfs:
            loadBalancer:
              servers:
                - url: "http://rustfs:9000"
          {{- end }}
  clickhouse_users:
    content: |
      <?xml version="1.0"?>
      <clickhouse>
          <users>
              <!-- Default user with password from environment (local access only) -->
              <default>
                  <password>${CLICKHOUSE_DEFAULT_PASSWORD}</password>
                  <networks>
                      <ip>::1</ip>
                      <ip>127.0.0.1</ip>
                  </networks>
                  <profile>default</profile>
                  <quota>default</quota>
                  <access_management>1</access_management>
              </default>
              <!-- Currents application user -->
              <currents>
                  <password>${CLICKHOUSE_CURRENTS_PASSWORD}</password>
                  <networks>
                      <ip>::/0</ip>
                  </networks>
                  <profile>default</profile>
                  <quota>default</quota>
              </currents>
          </users>
      </clickhouse>
FilesExpand file tree

docker-compose.full.yml

Latest commit

History

docker-compose.full.yml

File metadata and controls
