node2mint/docker-compose.yml at main · yanstd888/node2mint · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
services:
  gateway:
    build: ./gateway
    ports: ['8080:8080']
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    env_file: ./gateway/.env
    environment:
      # Default AMAN: rate limit hidup. Developer yang perlu bebas hambatan
      # membaliknya lewat docker-compose.override.yml (dev) atau env eksplisit —
      # jangan jadikan "mati" sebagai default, karena lupa satu variabel berarti
      # login bisa di-brute-force tanpa hambatan.
      RATE_LIMIT_DISABLE: ${RATE_LIMIT_DISABLE:-false}
      # Monitor uptime menolak host non-publik (SSRF). Dev yang memang memantau
      # gateway/db sendiri membukanya di docker-compose.override.yml.
      UPTIME_ALLOW_INTERNAL: ${UPTIME_ALLOW_INTERNAL:-false}
    healthcheck:
      test: ['CMD-SHELL', 'wget -qO- http://127.0.0.1:8080/healthz || exit 1']
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s
    restart: on-failure
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: aiuser
      POSTGRES_PASSWORD_FILE: /run/secrets/db_pass
      POSTGRES_DB: aisell
    ports: ['127.0.0.1:5432:5432']
    secrets:
      - db_pass
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./gateway/sql/schema.sql:/docker-entrypoint-initdb.d/00-schema.sql:ro
      - ./gateway/sql/99-local-dev-seed.sql:/docker-entrypoint-initdb.d/99-local-dev-seed.sql:ro
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U aiuser -d aisell']
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped
  redis:
    image: redis:7-alpine
    # Sandi dari secret yang sama-sama dibaca gateway. Port tetap loopback:
    # sandi adalah lapisan kedua, bukan pengganti pembatasan jaringan.
    command: ['sh', '-c', 'exec redis-server --requirepass "$$(cat /run/secrets/redis_pass)" --appendonly no']
    secrets:
      - redis_pass
    ports: ['127.0.0.1:6379:6379']
    healthcheck:
      test: ['CMD-SHELL', 'redis-cli -a "$$(cat /run/secrets/redis_pass)" ping | grep -q PONG']
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped
  uptime-kuma:
    image: louislam/uptime-kuma:1
    ports: ['3001:3001']
    volumes:
      - kuma:/app/data
    restart: unless-stopped
volumes:
  pgdata:
  kuma:
secrets:
  db_pass:
    file: ./gateway/.secrets/DB_PASSWORD
  redis_pass:
    file: ./gateway/.secrets/REDIS_PASSWORD