docker-compose-web.yml

# DeepVuln Web Service Docker Compose 配置
#
# 启动 Web 服务所需的全部组件：
# - Web API (FastAPI + Uvicorn)
# - Celery Worker (后台扫描任务)
# - Redis (Celery broker)
# - PostgreSQL (数据库)
#
# 使用方法:
#   1. 配置环境变量（参考 .env.example）
#   2. docker-compose -f docker-compose-web.yml up -d
#   3. 访问 http://localhost:8000/health

version: "3.8"

services:
  # PostgreSQL 数据库
  postgres:
    image: postgres:16-alpine
    container_name: deepvuln-postgres
    environment:
      POSTGRES_USER: deepvuln
      POSTGRES_PASSWORD: deepvuln_password
      POSTGRES_DB: deepvuln
    ports:
      - "5432:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U deepvuln"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - deepvuln-network

  # Redis - Celery broker
  redis:
    image: redis:7-alpine
    container_name: deepvuln-redis
    command: redis-server --appendonly yes --appendfilename "appendonly.aof"
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - deepvuln-network

  # Celery Worker - 处理后台扫描任务
  celery-worker:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        APT_MIRROR: ${APT_MIRROR:-https://mirrors.tuna.tsinghua.edu.cn/debian}
    image: deepvuln:latest
    container_name: deepvuln-celery-worker
    command: ["python", "-m", "celery", "-A", "src.web.tasks.scan_tasks", "worker", "-l", "info", "-Q", "scan", "--concurrency=2"]
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - OPENAI_BASE_URL=${OPENAI_BASE_URL:-https://api.lkeap.cloud.tencent.com/coding/v3}
      - PYTHONUNBUFFERED=1
      # 数据库连接
      # 代码只读 DEEPVULN_DB_* 前缀（audit B3：DATABASE_URL 从未生效）
      - DEEPVULN_DB_URL=postgresql+asyncpg://deepvuln:deepvuln_password@postgres:5432/deepvuln
      # Redis 连接（broker + WS pub/sub）
      - CELERY_BROKER_URL=redis://redis:6379/0
      - CELERY_RESULT_BACKEND=redis://redis:6379/0
      - CELERY_REDIS_URL=redis://redis:6379/0
      # 安全：JWT secret 必须显式提供（web service 在默认 secret 下拒绝启动）
      # 用法：openssl rand -hex 32，然后 export DEEPVULN_SECURITY_JWT_SECRET=...
      - DEEPVULN_SECURITY_JWT_SECRET=${DEEPVULN_SECURITY_JWT_SECRET:?请在 .env 中设置 DEEPVULN_SECURITY_JWT_SECRET（openssl rand -hex 32 生成）}
      - DEEPVULN_SECURITY_DEV_MODE=${DEEPVULN_SECURITY_DEV_MODE:-false}
      # ZIP 上传扫描：worker 读取 web-api 解压后的源码（共享 uploads 卷）
      - DEEPVULN_WEB_UPLOAD_DIR=/app/uploads
    volumes:
      - ./src:/app/src:ro
      - deepvuln-cache:/home/deepvuln/.cache
      - codeql-databases:/tmp/codeql_cache
      - codeql-packs:/home/deepvuln/.codeql
      - uploads-data:/app/uploads
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - deepvuln-network
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3

  # Web API 服务器
  web-api:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        APT_MIRROR: ${APT_MIRROR:-https://mirrors.tuna.tsinghua.edu.cn/debian}
    image: deepvuln:latest
    container_name: deepvuln-web-api
    command: ["python", "-m", "uvicorn", "src.web.main:app", "--host", "0.0.0.0", "--port", "8000"]
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - OPENAI_BASE_URL=${OPENAI_BASE_URL:-https://api.lkeap.cloud.tencent.com/coding/v3}
      - PYTHONUNBUFFERED=1
      # 数据库连接
      # 代码只读 DEEPVULN_DB_* 前缀（audit B3：DATABASE_URL 从未生效）
      - DEEPVULN_DB_URL=postgresql+asyncpg://deepvuln:deepvuln_password@postgres:5432/deepvuln
      # Redis 连接（broker + WS pub/sub）
      - CELERY_BROKER_URL=redis://redis:6379/0
      - CELERY_RESULT_BACKEND=redis://redis:6379/0
      - CELERY_REDIS_URL=redis://redis:6379/0
      # 安全：JWT secret 必须显式提供（web service 在默认 secret 下拒绝启动）
      # 用法：openssl rand -hex 32，然后 export DEEPVULN_SECURITY_JWT_SECRET=...
      - DEEPVULN_SECURITY_JWT_SECRET=${DEEPVULN_SECURITY_JWT_SECRET:?请在 .env 中设置 DEEPVULN_SECURITY_JWT_SECRET（openssl rand -hex 32 生成）}
      - DEEPVULN_SECURITY_DEV_MODE=${DEEPVULN_SECURITY_DEV_MODE:-false}
      # ZIP 上传扫描：web-api 与 celery-worker 共享 uploads 卷（Dockerfile WORKDIR=/app）
      - DEEPVULN_WEB_UPLOAD_DIR=/app/uploads
    ports:
      - "8000:8000"
    volumes:
      - ./src:/app/src:ro
      - deepvuln-cache:/home/deepvuln/.cache
      - codeql-databases:/tmp/codeql_cache
      - codeql-packs:/home/deepvuln/.codeql
      - uploads-data:/app/uploads
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      celery-worker:
        condition: service_started
    networks:
      - deepvuln-network
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  postgres-data:
    name: deepvuln-postgres-data
  redis-data:
    name: deepvuln-redis-data
  deepvuln-cache:
    name: deepvuln-cache
  codeql-databases:
    name: codeql-databases
  codeql-packs:
    name: codeql-packs
  uploads-data:
    name: deepvuln-uploads-data

networks:
  deepvuln-network:
    name: deepvuln-network