docker-compose.base.yml

x-common-variables: &common-variables
  HOST: ${HOST}
  PROVISION_SSL: ${PROVISION_SSL}

  HTTP_PROTOCOL: ${HTTP_PROTOCOL}
  # With HTTP_PROTOCOL=https, browsers are told to reach HOST over HTTPS only
  # (Strict-Transport-Security) for this many seconds. Empty means one year;
  # 0 makes browsers forget the rule at their next HTTPS visit.
  HSTS_MAX_AGE_SECONDS: ${HSTS_MAX_AGE_SECONDS:-}

  STATUS_PAGE_CNAME_RECORD: ${STATUS_PAGE_CNAME_RECORD}
  DASHBOARD_CNAME_RECORD: ${DASHBOARD_CNAME_RECORD}
  # Forms on custom domains use STATUS_PAGE_CNAME_RECORD unless this names
  # another target (config.example.env). Empty when unset, without a warning.
  FORM_CNAME_RECORD: ${FORM_CNAME_RECORD:-}

  LOG_LEVEL: ${LOG_LEVEL}

  NODE_ENV: ${ENVIRONMENT}
  BILLING_ENABLED: ${BILLING_ENABLED}
  # Deprecated (see config.example.env): the edition is the image APP_TAG
  # pulls, and true on the Community image makes the App refuse to start. Deliberately no ONEUPTIME_EDITION here: an empty value
  # would override the ONEUPTIME_EDITION=enterprise the Enterprise image sets.
  IS_ENTERPRISE_EDITION: ${IS_ENTERPRISE_EDITION}
  BILLING_PUBLIC_KEY: ${BILLING_PUBLIC_KEY}
  SUBSCRIPTION_PLAN_BASIC: ${SUBSCRIPTION_PLAN_BASIC}
  SUBSCRIPTION_PLAN_GROWTH: ${SUBSCRIPTION_PLAN_GROWTH}
  SUBSCRIPTION_PLAN_SCALE: ${SUBSCRIPTION_PLAN_SCALE}
  SUBSCRIPTION_PLAN_ENTERPRISE: ${SUBSCRIPTION_PLAN_ENTERPRISE}
  ANALYTICS_KEY: ${ANALYTICS_KEY}
  ANALYTICS_HOST: ${ANALYTICS_HOST}
  GOOGLE_TAG_MANAGER_ENABLED: ${GOOGLE_TAG_MANAGER_ENABLED}
  CAPTCHA_ENABLED: ${CAPTCHA_ENABLED}
  CAPTCHA_SITE_KEY: ${CAPTCHA_SITE_KEY}

  # VAPID keys for Web Push Notifications
  VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
  VAPID_SUBJECT: ${VAPID_SUBJECT}

  ALLOWED_ACTIVE_MONITOR_COUNT_IN_FREE_PLAN: ${ALLOWED_ACTIVE_MONITOR_COUNT_IN_FREE_PLAN}
  WATCHED_TABLES_INCLUDED_PER_PROJECT: ${WATCHED_TABLES_INCLUDED_PER_PROJECT}
  WATCHED_TABLE_PRICE_IN_USD: ${WATCHED_TABLE_PRICE_IN_USD}
  WATCHED_TABLE_VOLUME_THRESHOLD: ${WATCHED_TABLE_VOLUME_THRESHOLD}
  WATCHED_TABLE_VOLUME_PRICE_IN_USD: ${WATCHED_TABLE_VOLUME_PRICE_IN_USD}
  WATCHED_TABLE_STRIPE_PRICE_ID: ${WATCHED_TABLE_STRIPE_PRICE_ID}

  # Outbound webhook egress policy — see config.example.env for the full
  # explanation. Both are off by default and instance-wide; there is no
  # per-project setting.
  ALLOW_PRIVATE_NETWORK_WEBHOOKS: ${ALLOW_PRIVATE_NETWORK_WEBHOOKS:-false}
  PRIVATE_NETWORK_WEBHOOK_ALLOWLIST: ${PRIVATE_NETWORK_WEBHOOK_ALLOWLIST:-}
  # Egress policy for everything that is not a webhook (data sources, LLM
  # providers, SMTP, OIDC discovery, runbook HTTP steps) — see
  # config.example.env. Defaulted so a config.env upgraded in place, which will
  # not have the key, keeps today's self-hosted behaviour.
  DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES: ${DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES:-false}

  SERVER_APP_HOSTNAME: app
  SERVER_HOME_HOSTNAME: home
  #Ports. Usually they don't need to change.
  APP_PORT: ${APP_PORT}
  HOME_PORT: ${HOME_PORT}
  # Backend exporter configuration. Headers may contain secrets and are never
  # included in a frontend env.js response.
  OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: ${OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT}
  OPENTELEMETRY_EXPORTER_OTLP_HEADERS: ${OPENTELEMETRY_EXPORTER_OTLP_HEADERS}
  # Record OneUptime AI's prompts and answers in that telemetry (see
  # config.example.env). Defaulted off so a config.env without the key keeps
  # them out.
  OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT: ${OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT:-false}
  # Browser RUM is a separate, deliberately public channel. This key must be
  # a Browser ingestion key with an origin allowlist, never a Server key.
  PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: ${PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT:-}
  PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY: ${PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY:-}

  SLACK_APP_CLIENT_ID: ${SLACK_APP_CLIENT_ID}

  MICROSOFT_TEAMS_APP_CLIENT_ID: ${MICROSOFT_TEAMS_APP_CLIENT_ID}
  MICROSOFT_TEAMS_APP_TENANT_ID: ${MICROSOFT_TEAMS_APP_TENANT_ID}
  MICROSOFT_TEAMS_CLOUD: ${MICROSOFT_TEAMS_CLOUD:-}

  # Video calls: the public client ids of the apps behind the one-click
  # Connect of Zoom, Google Meet and Microsoft Teams (see config.example.env).
  # Defaulted so a config.env upgraded in place, without the keys, starts.
  ZOOM_APP_CLIENT_ID: ${ZOOM_APP_CLIENT_ID:-}
  GOOGLE_MEET_APP_CLIENT_ID: ${GOOGLE_MEET_APP_CLIENT_ID:-}
  MICROSOFT_TEAMS_MEETINGS_APP_CLIENT_ID: ${MICROSOFT_TEAMS_MEETINGS_APP_CLIENT_ID:-}

  # Sign in with Microsoft: the public client id (see config.example.env).
  MICROSOFT_SIGN_IN_CLIENT_ID: ${MICROSOFT_SIGN_IN_CLIENT_ID:-}

  # Continue with Google: the public client id (see config.example.env).
  GOOGLE_SIGN_IN_CLIENT_ID: ${GOOGLE_SIGN_IN_CLIENT_ID:-}

x-common-runtime-variables: &common-runtime-variables
  <<: *common-variables
  ONEUPTIME_SECRET: ${ONEUPTIME_SECRET}

  # The bundled global Runner's key and how many of it run (the global-runner
  # service below). The app keeps the global Runner's row from them on every
  # boot: no key, or GLOBAL_RUNNER_REPLICAS=0, and the row is removed, so no
  # project lists a global Runner nobody runs.
  GLOBAL_RUNNER_KEY: ${GLOBAL_RUNNER_KEY}
  GLOBAL_RUNNER_REPLICAS: ${GLOBAL_RUNNER_REPLICAS:-1}

  # Seed a Global LLM Provider from env at startup (e.g. a local Ollama or
  # vLLM server). Set GLOBAL_LLM_PROVIDER_TYPE to enable; unset it to remove
  # the seeded provider on the next restart.
  GLOBAL_LLM_PROVIDER_NAME: ${GLOBAL_LLM_PROVIDER_NAME}
  GLOBAL_LLM_PROVIDER_DESCRIPTION: ${GLOBAL_LLM_PROVIDER_DESCRIPTION}
  GLOBAL_LLM_PROVIDER_TYPE: ${GLOBAL_LLM_PROVIDER_TYPE}
  GLOBAL_LLM_PROVIDER_BASE_URL: ${GLOBAL_LLM_PROVIDER_BASE_URL}
  GLOBAL_LLM_PROVIDER_MODEL_NAME: ${GLOBAL_LLM_PROVIDER_MODEL_NAME}
  GLOBAL_LLM_PROVIDER_API_KEY: ${GLOBAL_LLM_PROVIDER_API_KEY}

  VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}

  EXPO_ACCESS_TOKEN: ${EXPO_ACCESS_TOKEN}
  PUSH_NOTIFICATION_RELAY_URL: ${PUSH_NOTIFICATION_RELAY_URL}
  PUSH_NOTIFICATION_RELAY_SERVER_ENABLED: ${PUSH_NOTIFICATION_RELAY_SERVER_ENABLED}

  DATABASE_PORT: ${DATABASE_PORT}
  DATABASE_USERNAME: ${DATABASE_USERNAME}
  DATABASE_PASSWORD: ${DATABASE_PASSWORD}
  DATABASE_NAME: ${DATABASE_NAME}
  DATABASE_HOST: ${DATABASE_HOST}
  DATABASE_SSL_CA: ${DATABASE_SSL_CA}
  DATABASE_SSL_KEY: ${DATABASE_SSL_KEY}
  DATABASE_SSL_CERT: ${DATABASE_SSL_CERT}
  DATABASE_SSL_REJECT_UNAUTHORIZED: ${DATABASE_SSL_REJECT_UNAUTHORIZED}
  LETS_ENCRYPT_NOTIFICATION_EMAIL: ${LETS_ENCRYPT_NOTIFICATION_EMAIL}
  LETS_ENCRYPT_ACCOUNT_KEY: ${LETS_ENCRYPT_ACCOUNT_KEY}

  # Cache and queues. VALKEY_* is the current name; the `:-${REDIS_*}` fallback is
  # what lets a config.env written before the rename keep working with no edits.
  VALKEY_USERNAME: ${VALKEY_USERNAME:-${REDIS_USERNAME:-}}
  VALKEY_PASSWORD: ${VALKEY_PASSWORD:-${REDIS_PASSWORD:-}}
  VALKEY_HOST: ${VALKEY_HOST:-${REDIS_HOST:-}}
  VALKEY_PORT: ${VALKEY_PORT:-${REDIS_PORT:-}}
  VALKEY_DB: ${VALKEY_DB:-${REDIS_DB:-}}
  VALKEY_IP_FAMILY: ${VALKEY_IP_FAMILY:-${REDIS_IP_FAMILY:-}}
  VALKEY_TLS_CA: ${VALKEY_TLS_CA:-${REDIS_TLS_CA:-}}
  VALKEY_TLS_SENTINEL_MODE: ${VALKEY_TLS_SENTINEL_MODE:-${REDIS_TLS_SENTINEL_MODE:-}}

  # Deprecated mirrors, carrying the identical value. The app reads VALKEY_* and
  # only falls back to these, so they are dead weight for a matching image --
  # they exist because APP_TAG lets you pin an OLDER image against this file, and
  # an image from before the rename reads nothing else.
  REDIS_USERNAME: ${VALKEY_USERNAME:-${REDIS_USERNAME:-}}
  REDIS_PASSWORD: ${VALKEY_PASSWORD:-${REDIS_PASSWORD:-}}
  REDIS_HOST: ${VALKEY_HOST:-${REDIS_HOST:-}}
  REDIS_PORT: ${VALKEY_PORT:-${REDIS_PORT:-}}
  REDIS_DB: ${VALKEY_DB:-${REDIS_DB:-}}
  REDIS_IP_FAMILY: ${VALKEY_IP_FAMILY:-${REDIS_IP_FAMILY:-}}
  REDIS_TLS_CA: ${VALKEY_TLS_CA:-${REDIS_TLS_CA:-}}
  REDIS_TLS_SENTINEL_MODE: ${VALKEY_TLS_SENTINEL_MODE:-${REDIS_TLS_SENTINEL_MODE:-}}

  ENCRYPTION_SECRET: ${ENCRYPTION_SECRET}

  BILLING_PRIVATE_KEY: ${BILLING_PRIVATE_KEY}
  BILLING_PUBLIC_KEY: ${BILLING_PUBLIC_KEY}
  BILLING_ENABLED: ${BILLING_ENABLED}
  BILLING_WEBHOOK_SECRET: ${BILLING_WEBHOOK_SECRET}

  # TEST-ONLY. Unset (empty) in every shipped config, so the API never returns
  # a notification-channel verification code. The CI end-to-end job sets it to
  # "true" for its own stack because the e2e suite has no mailbox to read the
  # emailed code from; production leaves it empty and the code stays on the
  # mail path only. See Common/Server/Services/UserEmailService.ts.
  EXPOSE_VERIFICATION_CODE_IN_API_RESPONSE_FOR_E2E: ${EXPOSE_VERIFICATION_CODE_IN_API_RESPONSE_FOR_E2E:-}

  CLICKHOUSE_USER: ${CLICKHOUSE_USER}
  CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
  CLICKHOUSE_DATABASE: ${CLICKHOUSE_DATABASE}
  CLICKHOUSE_HOST: ${CLICKHOUSE_HOST}
  CLICKHOUSE_PORT: ${CLICKHOUSE_PORT}
  # Per-container ClickHouse pool ceilings; the ingest pool (fan-in telemetry
  # writer) inherits CLICKHOUSE_MAX_OPEN_CONNECTIONS when left empty.
  CLICKHOUSE_MAX_OPEN_CONNECTIONS: ${CLICKHOUSE_MAX_OPEN_CONNECTIONS}
  CLICKHOUSE_INGEST_MAX_OPEN_CONNECTIONS: ${CLICKHOUSE_INGEST_MAX_OPEN_CONNECTIONS}

  AVERAGE_SPAN_ROW_SIZE_IN_BYTES: ${AVERAGE_SPAN_ROW_SIZE_IN_BYTES}
  AVERAGE_LOG_ROW_SIZE_IN_BYTES: ${AVERAGE_LOG_ROW_SIZE_IN_BYTES}
  AVERAGE_METRIC_ROW_SIZE_IN_BYTES: ${AVERAGE_METRIC_ROW_SIZE_IN_BYTES}
  AVERAGE_EXCEPTION_ROW_SIZE_IN_BYTES: ${AVERAGE_EXCEPTION_ROW_SIZE_IN_BYTES}

  WORKFLOW_SCRIPT_TIMEOUT_IN_MS: ${WORKFLOW_SCRIPT_TIMEOUT_IN_MS}
  WORKFLOW_TIMEOUT_IN_MS: ${WORKFLOW_TIMEOUT_IN_MS}

  DISABLE_AUTOMATIC_INCIDENT_CREATION: ${DISABLE_AUTOMATIC_INCIDENT_CREATION}

  DISABLE_AUTOMATIC_ALERT_CREATION: ${DISABLE_AUTOMATIC_ALERT_CREATION}

  DISABLE_TELEMETRY_INGESTION: ${DISABLE_TELEMETRY_INGESTION}

  # Defaulted, unlike its siblings: this one gates outbound traffic, and an
  # existing config.env upgraded in place will not have the key.
  DISABLE_UPDATE_CHECK: ${DISABLE_UPDATE_CHECK:-false}
  LATEST_RELEASE_CHECK_URL: ${LATEST_RELEASE_CHECK_URL:-}
  SECURITY_ADVISORIES_CHECK_URL: ${SECURITY_ADVISORIES_CHECK_URL:-}
  DISABLE_INSTANCE_CHECK_IN: ${DISABLE_INSTANCE_CHECK_IN:-false}

  # On-call calendar feeds (token-in-URL .ics subscriptions). Defaulted so a
  # config.env upgraded in place, which will not have these keys, neither warns
  # nor hands the container an empty kill switch. Blank rate-limit values mean
  # "use the built-in default".
  DISABLE_ON_CALL_CALENDAR_FEED: ${DISABLE_ON_CALL_CALENDAR_FEED:-false}
  ON_CALL_CALENDAR_FEED_RATE_LIMIT_WINDOW_SECONDS: ${ON_CALL_CALENDAR_FEED_RATE_LIMIT_WINDOW_SECONDS:-}
  ON_CALL_CALENDAR_FEED_RATE_LIMIT_PER_TOKEN_PER_WINDOW: ${ON_CALL_CALENDAR_FEED_RATE_LIMIT_PER_TOKEN_PER_WINDOW:-}
  ON_CALL_CALENDAR_FEED_RATE_LIMIT_PER_IP_PER_WINDOW: ${ON_CALL_CALENDAR_FEED_RATE_LIMIT_PER_IP_PER_WINDOW:-}

  # OAuth sign-in for the MCP server (/mcp). Defaulted so a config.env upgraded
  # in place, which will not have these keys, neither warns nor hands the
  # container an empty switch.
  DISABLE_MCP_OAUTH: ${DISABLE_MCP_OAUTH:-false}
  DISABLE_MCP_OAUTH_CLIENT_ID_METADATA_DOCUMENTS: ${DISABLE_MCP_OAUTH_CLIENT_ID_METADATA_DOCUMENTS:-false}

  # Browser source map upload / symbolication limits. Blank means "use the
  # built-in default", so a config.env upgraded in place keeps today's
  # behaviour. maxFilesPerRequest and maxFileSizeBytes can only be lowered --
  # the multipart parser's shared, pre-auth ceilings sit above them.
  SOURCE_MAP_MAX_MAPS_PER_RELEASE: ${SOURCE_MAP_MAX_MAPS_PER_RELEASE:-}
  SOURCE_MAP_MAX_FILES_PER_REQUEST: ${SOURCE_MAP_MAX_FILES_PER_REQUEST:-}
  SOURCE_MAP_MAX_FILE_SIZE_BYTES: ${SOURCE_MAP_MAX_FILE_SIZE_BYTES:-}
  SOURCE_MAP_MAX_BYTES_PER_RESOLVE: ${SOURCE_MAP_MAX_BYTES_PER_RESOLVE:-}
  SOURCE_MAP_RETENTION_DAYS: ${SOURCE_MAP_RETENTION_DAYS:-}

  # How many appending proxies of your own sit in front of the app. Decides
  # which X-Forwarded-For entry counts as the client for IP allowlists and rate
  # limits. Defaulted because an existing config.env upgraded in place will not
  # have the key, and an empty value here would read as "no proxy" and make
  # every visitor look like the ingress container.
  TRUSTED_PROXY_HOPS: ${TRUSTED_PROXY_HOPS:-1}

  # The headers your CDN or load balancer writes the visitor's country, region
  # and city into, which security emails read to say roughly where a request
  # came from. Empty reads none: see config.example.env.
  TRUSTED_GEO_COUNTRY_HEADER: ${TRUSTED_GEO_COUNTRY_HEADER:-}
  TRUSTED_GEO_REGION_HEADER: ${TRUSTED_GEO_REGION_HEADER:-}
  TRUSTED_GEO_CITY_HEADER: ${TRUSTED_GEO_CITY_HEADER:-}

  # Open Source Deployment Webhook
  OPEN_SOURCE_DEPLOYMENT_WEBHOOK_URL: ${OPEN_SOURCE_DEPLOYMENT_WEBHOOK_URL}

  # Notification Webhooks
  NOTIFICATION_SLACK_WEBHOOK_ON_CREATED_USER: ${NOTIFICATION_SLACK_WEBHOOK_ON_CREATED_USER}
  NOTIFICATION_SLACK_WEBHOOK_ON_CREATED_PROJECT: ${NOTIFICATION_SLACK_WEBHOOK_ON_CREATED_PROJECT}
  NOTIFICATION_SLACK_WEBHOOK_ON_DELETED_PROJECT: ${NOTIFICATION_SLACK_WEBHOOK_ON_DELETED_PROJECT}
  NOTIFICATION_SLACK_WEBHOOK_ON_SUBSCRIPTION_UPDATE: ${NOTIFICATION_SLACK_WEBHOOK_ON_SUBSCRIPTION_UPDATE}
  NOTIFICATION_SLACK_WEBHOOK_ON_AI_FEEDBACK: ${NOTIFICATION_SLACK_WEBHOOK_ON_AI_FEEDBACK}

  SLACK_APP_CLIENT_SECRET: ${SLACK_APP_CLIENT_SECRET}
  SLACK_APP_SIGNING_SECRET: ${SLACK_APP_SIGNING_SECRET}

  # Microsoft Teams Configuration

  MICROSOFT_TEAMS_APP_CLIENT_SECRET: ${MICROSOFT_TEAMS_APP_CLIENT_SECRET}
  CAPTCHA_SECRET_KEY: ${CAPTCHA_SECRET_KEY}

  # Video calls: the secrets of the apps behind the one-click Connect of
  # Zoom, Google Meet and Microsoft Teams (see config.example.env).
  ZOOM_APP_CLIENT_SECRET: ${ZOOM_APP_CLIENT_SECRET:-}
  ZOOM_APP_WEBHOOK_SECRET_TOKEN: ${ZOOM_APP_WEBHOOK_SECRET_TOKEN:-}
  GOOGLE_MEET_APP_CLIENT_SECRET: ${GOOGLE_MEET_APP_CLIENT_SECRET:-}
  MICROSOFT_TEAMS_MEETINGS_APP_CLIENT_SECRET: ${MICROSOFT_TEAMS_MEETINGS_APP_CLIENT_SECRET:-}
  MICROSOFT_TEAMS_MEETINGS_APP_TENANT_ID: ${MICROSOFT_TEAMS_MEETINGS_APP_TENANT_ID:-}

  # Cloud > Connect: the AWS identity that signs in to customers' read-only
  # IAM roles (see config.example.env). Unset, AWS connects with an access key.
  CLOUD_CONNECT_AWS_ACCESS_KEY_ID: ${CLOUD_CONNECT_AWS_ACCESS_KEY_ID:-}
  CLOUD_CONNECT_AWS_SECRET_ACCESS_KEY: ${CLOUD_CONNECT_AWS_SECRET_ACCESS_KEY:-}

  # GitHub App Configuration
  GITHUB_APP_ID: ${GITHUB_APP_ID}
  GITHUB_APP_NAME: ${GITHUB_APP_NAME}
  GITHUB_APP_CLIENT_ID: ${GITHUB_APP_CLIENT_ID}
  GITHUB_APP_CLIENT_SECRET: ${GITHUB_APP_CLIENT_SECRET}
  GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY}
  GITHUB_APP_WEBHOOK_SECRET: ${GITHUB_APP_WEBHOOK_SECRET}

  # Sign in with Microsoft: the app's secret (see config.example.env).
  MICROSOFT_SIGN_IN_CLIENT_SECRET: ${MICROSOFT_SIGN_IN_CLIENT_SECRET:-}

  # Continue with Google: the OAuth client's secret (see config.example.env).
  GOOGLE_SIGN_IN_CLIENT_SECRET: ${GOOGLE_SIGN_IN_CLIENT_SECRET:-}

  # Cloud marketplaces: AWS, Microsoft, Google Cloud and Vercel Marketplace
  # (see config.example.env). OneUptime Cloud only; empty everywhere else.
  AWS_MARKETPLACE_ACCESS_KEY_ID: ${AWS_MARKETPLACE_ACCESS_KEY_ID:-}
  AWS_MARKETPLACE_SECRET_ACCESS_KEY: ${AWS_MARKETPLACE_SECRET_ACCESS_KEY:-}
  AWS_MARKETPLACE_PRODUCT_CODE: ${AWS_MARKETPLACE_PRODUCT_CODE:-}
  AWS_MARKETPLACE_EVENTS_SECRET: ${AWS_MARKETPLACE_EVENTS_SECRET:-}
  AZURE_MARKETPLACE_TENANT_ID: ${AZURE_MARKETPLACE_TENANT_ID:-}
  AZURE_MARKETPLACE_CLIENT_ID: ${AZURE_MARKETPLACE_CLIENT_ID:-}
  AZURE_MARKETPLACE_CLIENT_SECRET: ${AZURE_MARKETPLACE_CLIENT_SECRET:-}
  GOOGLE_CLOUD_MARKETPLACE_PROVIDER_ID: ${GOOGLE_CLOUD_MARKETPLACE_PROVIDER_ID:-}
  GOOGLE_CLOUD_MARKETPLACE_SERVICE_ACCOUNT_KEY: ${GOOGLE_CLOUD_MARKETPLACE_SERVICE_ACCOUNT_KEY:-}
  GOOGLE_CLOUD_MARKETPLACE_SERVICE_NAME: ${GOOGLE_CLOUD_MARKETPLACE_SERVICE_NAME:-}
  GOOGLE_CLOUD_MARKETPLACE_USAGE_METRIC: ${GOOGLE_CLOUD_MARKETPLACE_USAGE_METRIC:-}
  GOOGLE_CLOUD_MARKETPLACE_PUBSUB_SERVICE_ACCOUNT_EMAIL: ${GOOGLE_CLOUD_MARKETPLACE_PUBSUB_SERVICE_ACCOUNT_EMAIL:-}
  GOOGLE_CLOUD_MARKETPLACE_SIGNUP_AUDIENCE: ${GOOGLE_CLOUD_MARKETPLACE_SIGNUP_AUDIENCE:-}
  GOOGLE_CLOUD_MARKETPLACE_PUBSUB_AUDIENCE: ${GOOGLE_CLOUD_MARKETPLACE_PUBSUB_AUDIENCE:-}
  VERCEL_MARKETPLACE_CLIENT_ID: ${VERCEL_MARKETPLACE_CLIENT_ID:-}
  VERCEL_MARKETPLACE_CLIENT_SECRET: ${VERCEL_MARKETPLACE_CLIENT_SECRET:-}

  # Inbound Email Configuration (for Incoming Email Monitor)
  INBOUND_EMAIL_PROVIDER: ${INBOUND_EMAIL_PROVIDER}
  INBOUND_EMAIL_DOMAIN: ${INBOUND_EMAIL_DOMAIN}
  INBOUND_EMAIL_WEBHOOK_SECRET: ${INBOUND_EMAIL_WEBHOOK_SECRET}

  # BullMQ Queue Dashboard (Bull Board)
  ENABLE_QUEUE_DASHBOARD: ${ENABLE_QUEUE_DASHBOARD}
  QUEUE_DASHBOARD_SECRET: ${QUEUE_DASHBOARD_SECRET}

services:
  # Valkey is the BSD-licensed fork of Redis 7.2 that most of the original Redis
  # contributors moved to after Redis 7.4 left the BSD licence, and it speaks the
  # same wire protocol -- point VALKEY_HOST at a managed Redis instead and
  # nothing else changes.
  #
  # The service is reachable as both "valkey" and "redis" (see the network
  # alias), so a config.env written before the rename, still saying
  # REDIS_HOST=redis, resolves with no edits.
  valkey:
    image: valkey/valkey:9.1-alpine
    restart: always
    networks:
      oneuptime:
        aliases:
          - redis
    command: valkey-server --requirepass "${VALKEY_PASSWORD:-${REDIS_PASSWORD:-}}" --save "" --appendonly no
    environment:
      VALKEY_PASSWORD: ${VALKEY_PASSWORD:-${REDIS_PASSWORD:-}}
    healthcheck:
      test: ["CMD", "valkey-cli", "-a", "${VALKEY_PASSWORD:-${REDIS_PASSWORD:-}}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  clickhouse:
    # Pinned to 26.7 to match the Helm/production ClickHouse (which tracks the
    # newer server). ClickHouse 26.7 validates that every off-key column on an
    # AggregatingMergeTree is an aggregate measure; staying on 25.7 here
    # diverged from production and let invalid aggregate schemas slip past the
    # E2E stack.
    image: clickhouse/clickhouse-server:26.7
    restart: always
    environment:
      CLICKHOUSE_USER: ${CLICKHOUSE_USER}
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
      CLICKHOUSE_DB: ${CLICKHOUSE_DATABASE}
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
    networks:
      - oneuptime
    volumes:
      - clickhouse:/var/lib/clickhouse/
      # Cluster + embedded-Keeper drop-in: OneUptime's analytics schema is always
      # ReplicatedMergeTree + Distributed, so a single node runs an embedded
      # Keeper and a 1-node "oneuptime" cluster (config.d is merged into the
      # server config regardless of the main config.xml).
      - ./Clickhouse/config.d/cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
      # Profile-level drop-in: batch the background Distributed-insert sender so it
      # keeps up with telemetry volume (otherwise system.distribution_queue backs up
      # and dashboards lag). users.d is merged into the users config, where profiles
      # are read. Mirrors the Altinity operator defaults.
      - ./Clickhouse/users.d/distributed-insert-tuning.xml:/etc/clickhouse-server/users.d/distributed-insert-tuning.xml
      # System-log retention drop-in: ClickHouse's own query_log/trace_log/… ship
      # with their TTL commented out, so without this they grow forever and eat the
      # clickhouse volume (processors_profile_log alone reached 536 GiB on the
      # hosted deployment). Caps six system logs at 6h from event_time and removes
      # processors_profile_log, mirroring the Helm path (values.yaml ->
      # clickhouse.configuration); Tests/Ops fails the build if the two drift.
      # The TTL keys off event_time (DateTime), NOT event_date (Date): adding
      # hours to a Date pins the expiry to 06:00 on the row's own day, which
      # discards nearly everything written after 06:00 instead of keeping 6h.
      # See the header of Clickhouse/config.d/system-log-ttl.xml.
      - ./Clickhouse/config.d/system-log-ttl.xml:/etc/clickhouse-server/config.d/system-log-ttl.xml
      # Logger drop-in: the image logs at trace (every query and merge, to its
      # log files and system.text_log); warning, as Helm runs it, keeps the
      # warnings and errors at a fraction of the CPU and disk writes. See
      # Clickhouse/config.d/logger.xml; Tests/Ops keeps it in step with Helm.
      - ./Clickhouse/config.d/logger.xml:/etc/clickhouse-server/config.d/logger.xml
    healthcheck:
      test: ["CMD-SHELL", "clickhouse-client --query 'SELECT 1'"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  postgres:
    image: postgres:15
    restart: always
    environment:
      POSTGRES_USER: ${DATABASE_USERNAME}
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD}
      POSTGRES_DB: ${DATABASE_NAME}
    networks:
      - oneuptime
    volumes:
      - postgres:/var/lib/postgresql/data
    healthcheck:
      # Names the role and database the container was told to create: on its
      # own pg_isready connects as root, the user Docker runs a check as, and
      # the server logs FATAL: role "root" does not exist at every check.
      # Over TCP because the temporary server the image runs while creating a
      # new database listens only on its socket: nothing is told this one is
      # healthy until the server the other containers connect to is up.
      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -p 5432 -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  test-server:
    networks:
      - oneuptime
    restart: always
    environment:
      <<: *common-runtime-variables
      PORT: ${TEST_SERVER_PORT}
      DISABLE_TELEMETRY: ${DISABLE_TELEMETRY_FOR_TEST_SERVER}
      ENABLE_PROFILING: ${ENABLE_PROFILING_FOR_TEST_SERVER}
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  app:
    networks:
      - oneuptime
    restart: always
    environment:
      <<: *common-runtime-variables
      PORT: ${APP_PORT}
      SMS_DEFAULT_COST_IN_CENTS: ${SMS_DEFAULT_COST_IN_CENTS}
      WHATSAPP_TEXT_DEFAULT_COST_IN_CENTS: ${WHATSAPP_TEXT_DEFAULT_COST_IN_CENTS}
      CALL_DEFAULT_COST_IN_CENTS_PER_MINUTE: ${CALL_DEFAULT_COST_IN_CENTS_PER_MINUTE}
      SMS_HIGH_RISK_COST_IN_CENTS: ${SMS_HIGH_RISK_COST_IN_CENTS}
      CALL_HIGH_RISK_COST_IN_CENTS_PER_MINUTE: ${CALL_HIGH_RISK_COST_IN_CENTS_PER_MINUTE}
      DISABLE_TELEMETRY: ${DISABLE_TELEMETRY_FOR_APP}
      ENABLE_PROFILING: ${ENABLE_PROFILING_FOR_APP}
      WORKER_CONCURRENCY: ${WORKER_CONCURRENCY}
      # AI investigations this container runs at once — see config.example.env.
      # Empty falls back to the code default (10).
      AI_INVESTIGATION_CONCURRENCY: ${AI_INVESTIGATION_CONCURRENCY:-}
      # Telemetry ingestion settings (merged from telemetry service)
      TELEMETRY_CONCURRENCY: ${TELEMETRY_CONCURRENCY}
      # Network device polling throughput — see config.example.env for docs.
      # Empty falls back to the code default.
      NETWORK_DEVICE_POLL_FETCH_LIMIT: ${NETWORK_DEVICE_POLL_FETCH_LIMIT:-}
      # The project's daily session replay upload limit — see
      # config.example.env. This container enforces it and also measures the
      # storage budget metrics against it, so the two always agree. Empty
      # falls back to the code default (1 GiB).
      SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY: ${SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY:-}
      # Fan-in telemetry writer knobs — see config.example.env for docs.
      # Empty values fall back to the code defaults.
      TELEMETRY_FANIN_MAX_BATCH_ROWS: ${TELEMETRY_FANIN_MAX_BATCH_ROWS}
      TELEMETRY_FANIN_MAX_WAIT_MS: ${TELEMETRY_FANIN_MAX_WAIT_MS}
      TELEMETRY_FANIN_MAX_CONCURRENT_INSERTS: ${TELEMETRY_FANIN_MAX_CONCURRENT_INSERTS}
      TELEMETRY_FANIN_MAX_PENDING_ROWS: ${TELEMETRY_FANIN_MAX_PENDING_ROWS}
      TELEMETRY_FANIN_RETRY_MAX_ATTEMPTS: ${TELEMETRY_FANIN_RETRY_MAX_ATTEMPTS}
      TELEMETRY_FANIN_RETRY_BASE_DELAY_MS: ${TELEMETRY_FANIN_RETRY_BASE_DELAY_MS}
      TELEMETRY_FANIN_RETRY_MAX_DELAY_MS: ${TELEMETRY_FANIN_RETRY_MAX_DELAY_MS}
      TELEMETRY_WAIT_FOR_ASYNC_INSERT: ${TELEMETRY_WAIT_FOR_ASYNC_INSERT}
      TELEMETRY_WRITER_URL: ${TELEMETRY_WRITER_URL}
      TELEMETRY_WRITER_REQUEST_TIMEOUT_MS: ${TELEMETRY_WRITER_REQUEST_TIMEOUT_MS}
      TELEMETRY_WRITER_MAX_BODY_BYTES: ${TELEMETRY_WRITER_MAX_BODY_BYTES}
      TELEMETRY_WRITER_MAX_INFLIGHT_REQUESTS: ${TELEMETRY_WRITER_MAX_INFLIGHT_REQUESTS}
      REGISTER_PROBE_KEY: ${REGISTER_PROBE_KEY}
      # MQTT ingest for IoT devices. MQTT-over-WebSocket rides the
      # ingress at /mqtt out of the box; the raw TCP listener stays
      # internal to the compose network unless an operator publishes
      # the port with a compose override.
      MQTT_INGEST_ENABLED: ${MQTT_INGEST_ENABLED}
      MQTT_INGEST_PORT: ${MQTT_INGEST_PORT}
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  home:
    networks:
      - oneuptime
    restart: always
    environment:
      <<: *common-runtime-variables
      PORT: ${HOME_PORT}
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  probe-1:
    restart: always
    network_mode: host
    # A /dev/shm larger than Docker's 64MB default. The synthetic runtime's
    # browsers do not use it: Playwright starts Chromium with
    # --disable-dev-shm-usage, so Chromium keeps its shared memory in the
    # per-execution run directory under /tmp, and Firefox uses memfd.
    shm_size: ${GLOBAL_PROBE_1_SHM_SIZE:-512m}
    # The probe remains root so its trusted supervisor can assign a unique UID
    # to every synthetic execution. Drop everything except the capabilities it
    # needs to prepare, terminate, and clean up those workers (plus NET_RAW for
    # ping/traceroute monitors). no-new-privileges is inherited by workers.
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - KILL
      - NET_RAW
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
      # Playwright's official Docker profile
      # (https://github.com/microsoft/playwright/blob/main/utils/docker/seccomp_profile.json)
      # with one change: chroot is allowed next to clone/setns/unshare.
      # Firefox and Chromium both sandbox their child processes by creating
      # a user namespace and calling chroot inside it, which needs no
      # capability. Upstream allows chroot only to a container holding
      # CAP_SYS_CHROOT, which cap_drop ALL removes, and that crashed every
      # Firefox content process and the Chromium zygote at launch. Allowing
      # the syscall in the profile, rather than adding the capability back,
      # keeps chroot(2) unusable for the root supervisor itself.
      # Probe/Tests/Build/ProbeContainerBrowserSandbox.test.ts pins this.
      - seccomp=./packages/Probe/seccomp_profile.json
    environment:
      ONEUPTIME_URL: ${GLOBAL_PROBE_1_ONEUPTIME_URL}
      REGISTER_PROBE_KEY: ${REGISTER_PROBE_KEY}
      PROBE_NAME: ${GLOBAL_PROBE_1_NAME}
      PROBE_DESCRIPTION: ${GLOBAL_PROBE_1_DESCRIPTION}
      PROBE_MONITORING_WORKERS: ${GLOBAL_PROBE_1_MONITORING_WORKERS}
      PROBE_KEY: ${GLOBAL_PROBE_1_KEY}
      PROBE_SYNTHETIC_MONITOR_SCRIPT_TIMEOUT_IN_MS: ${GLOBAL_PROBE_1_SYNTHETIC_MONITOR_SCRIPT_TIMEOUT_IN_MS}
      PROBE_SYNTHETIC_MONITOR_MAX_CONCURRENCY: ${GLOBAL_PROBE_1_SYNTHETIC_MONITOR_MAX_CONCURRENCY}
      PROBE_SYNTHETIC_MONITOR_MAX_PROCESS_TREE_RSS_BYTES: ${GLOBAL_PROBE_1_SYNTHETIC_MONITOR_MAX_PROCESS_TREE_RSS_BYTES:-1610612736}
      PROBE_SYNTHETIC_MONITOR_MAX_DISK_BYTES: ${GLOBAL_PROBE_1_SYNTHETIC_MONITOR_MAX_DISK_BYTES:-268435456}
      # Compose installs the bundled seccomp profile above, which allows the
      # user namespace and the chroot inside it, so the Chromium sandbox can
      # be required instead of silently falling back to --no-sandbox.
      PROBE_SYNTHETIC_MONITOR_CHROMIUM_SANDBOX_ENABLED: "true"
      PROBE_CUSTOM_CODE_MONITOR_SCRIPT_TIMEOUT_IN_MS: ${GLOBAL_PROBE_1_CUSTOM_CODE_MONITOR_SCRIPT_TIMEOUT_IN_MS}
      # Honored here too (issue #3879). This one config.env value applies to
      # both bundled probes, which auto-register as global probes, so "true"
      # lets monitors from every project on the instance reach private
      # addresses through them. Off by default; see config.example.env.
      PROBE_ALLOW_PRIVATE_NETWORK_MONITORS: ${PROBE_ALLOW_PRIVATE_NETWORK_MONITORS:-false}
      # Lets the probe apply the one exception to the setting above: a global
      # probe of a billing-enabled (hosted, open-signup) instance stays
      # public-only. The Helm chart passes billing.enabled the same way.
      BILLING_ENABLED: ${BILLING_ENABLED}
      PROBE_MONITOR_FETCH_LIMIT: ${GLOBAL_PROBE_1_MONITOR_FETCH_LIMIT}
      PROBE_NETWORK_DEVICE_POLL_CONCURRENCY: ${GLOBAL_PROBE_1_NETWORK_DEVICE_POLL_CONCURRENCY:-}
      PROBE_SNMP_GET_CHUNK_SIZE: ${GLOBAL_PROBE_1_SNMP_GET_CHUNK_SIZE:-}
      HTTP_PROXY_URL: ${GLOBAL_PROBE_1_HTTP_PROXY_URL:-${GLOBAL_PROBE_1_PROXY_URL:-}}
      HTTPS_PROXY_URL: ${GLOBAL_PROBE_1_HTTPS_PROXY_URL:-${GLOBAL_PROBE_1_PROXY_URL:-}}
      NO_PROXY: ${GLOBAL_PROBE_1_NO_PROXY:-}
      PORT: ${GLOBAL_PROBE_1_PORT}
      NODE_ENV: ${ENVIRONMENT}
      LOG_LEVEL: ${LOG_LEVEL}
      DISABLE_TELEMETRY: ${DISABLE_TELEMETRY_FOR_PROBE}
      ENABLE_PROFILING: ${ENABLE_PROFILING_FOR_PROBE}
      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: ${OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT}
      OPENTELEMETRY_EXPORTER_OTLP_HEADERS: ${OPENTELEMETRY_EXPORTER_OTLP_HEADERS}
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  probe-2:
    restart: always
    network_mode: host
    # A /dev/shm larger than Docker's 64MB default. The synthetic runtime's
    # browsers do not use it: Playwright starts Chromium with
    # --disable-dev-shm-usage, so Chromium keeps its shared memory in the
    # per-execution run directory under /tmp, and Firefox uses memfd.
    shm_size: ${GLOBAL_PROBE_2_SHM_SIZE:-512m}
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - KILL
      - NET_RAW
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
      - seccomp=./packages/Probe/seccomp_profile.json
    environment:
      ONEUPTIME_URL: ${GLOBAL_PROBE_2_ONEUPTIME_URL}
      REGISTER_PROBE_KEY: ${REGISTER_PROBE_KEY}
      PROBE_NAME: ${GLOBAL_PROBE_2_NAME}
      PROBE_DESCRIPTION: ${GLOBAL_PROBE_2_DESCRIPTION}
      PROBE_MONITORING_WORKERS: ${GLOBAL_PROBE_2_MONITORING_WORKERS}
      PROBE_KEY: ${GLOBAL_PROBE_2_KEY}
      PROBE_SYNTHETIC_MONITOR_SCRIPT_TIMEOUT_IN_MS: ${GLOBAL_PROBE_2_SYNTHETIC_MONITOR_SCRIPT_TIMEOUT_IN_MS}
      PROBE_SYNTHETIC_MONITOR_MAX_CONCURRENCY: ${GLOBAL_PROBE_2_SYNTHETIC_MONITOR_MAX_CONCURRENCY}
      PROBE_SYNTHETIC_MONITOR_MAX_PROCESS_TREE_RSS_BYTES: ${GLOBAL_PROBE_2_SYNTHETIC_MONITOR_MAX_PROCESS_TREE_RSS_BYTES:-1610612736}
      PROBE_SYNTHETIC_MONITOR_MAX_DISK_BYTES: ${GLOBAL_PROBE_2_SYNTHETIC_MONITOR_MAX_DISK_BYTES:-268435456}
      PROBE_SYNTHETIC_MONITOR_CHROMIUM_SANDBOX_ENABLED: "true"
      PROBE_CUSTOM_CODE_MONITOR_SCRIPT_TIMEOUT_IN_MS: ${GLOBAL_PROBE_2_CUSTOM_CODE_MONITOR_SCRIPT_TIMEOUT_IN_MS}
      # Honored here too (issue #3879). This one config.env value applies to
      # both bundled probes, which auto-register as global probes, so "true"
      # lets monitors from every project on the instance reach private
      # addresses through them. Off by default; see config.example.env.
      PROBE_ALLOW_PRIVATE_NETWORK_MONITORS: ${PROBE_ALLOW_PRIVATE_NETWORK_MONITORS:-false}
      # Lets the probe apply the one exception to the setting above: a global
      # probe of a billing-enabled (hosted, open-signup) instance stays
      # public-only. The Helm chart passes billing.enabled the same way.
      BILLING_ENABLED: ${BILLING_ENABLED}
      PROBE_MONITOR_FETCH_LIMIT: ${GLOBAL_PROBE_2_MONITOR_FETCH_LIMIT}
      PROBE_NETWORK_DEVICE_POLL_CONCURRENCY: ${GLOBAL_PROBE_2_NETWORK_DEVICE_POLL_CONCURRENCY:-}
      PROBE_SNMP_GET_CHUNK_SIZE: ${GLOBAL_PROBE_2_SNMP_GET_CHUNK_SIZE:-}
      HTTP_PROXY_URL: ${GLOBAL_PROBE_2_HTTP_PROXY_URL:-${GLOBAL_PROBE_2_PROXY_URL:-}}
      HTTPS_PROXY_URL: ${GLOBAL_PROBE_2_HTTPS_PROXY_URL:-${GLOBAL_PROBE_2_PROXY_URL:-}}
      NO_PROXY: ${GLOBAL_PROBE_2_NO_PROXY:-}
      PORT: ${GLOBAL_PROBE_2_PORT}
      NODE_ENV: ${ENVIRONMENT}
      LOG_LEVEL: ${LOG_LEVEL}
      DISABLE_TELEMETRY: ${DISABLE_TELEMETRY_FOR_PROBE}
      ENABLE_PROFILING: ${ENABLE_PROFILING_FOR_PROBE}
      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: ${OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT}
      OPENTELEMETRY_EXPORTER_OTLP_HEADERS: ${OPENTELEMETRY_EXPORTER_OTLP_HEADERS}
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  # The bundled global Runner (Common/Types/Runner/BundledGlobalRunner.ts): it
  # runs the runbook JavaScript steps, each in a sandbox of its own that
  # reaches the internet only, and the AI code fixes of every project that
  # uses global Runners. It never runs a repository's own commands: a project
  # that wants those runs a Runner of its own. It is the Runner image started
  # with a fixed id and its own key, and holds nothing else - no cluster key
  # (ONEUPTIME_SECRET), none of the server's settings - on the oneuptime
  # network, not the host's. Set GLOBAL_RUNNER_REPLICAS=0 in config.env to
  # turn it off.
  # Tests/Ops/BundledGlobalRunner.test.js holds this.
  global-runner:
    networks:
      - oneuptime
    restart: always
    deploy:
      replicas: ${GLOBAL_RUNNER_REPLICAS:-1}
    environment:
      ONEUPTIME_URL: http://app:${APP_PORT}
      ONEUPTIME_RUNNER_ID: "00000000-0000-0000-0000-000000000002"
      ONEUPTIME_RUNNER_KEY: ${GLOBAL_RUNNER_KEY}
      ONEUPTIME_RUNNER_CONCURRENCY: ${GLOBAL_RUNNER_CONCURRENCY:-4}
      # The server never serves it AI remediation commands; this says the
      # same here.
      ONEUPTIME_RUNNER_ENABLE_AI_COMMANDS: "false"
      LOG_LEVEL: ${LOG_LEVEL}
      NODE_ENV: ${ENVIRONMENT}
      OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT: ${OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT}
      OPENTELEMETRY_EXPORTER_OTLP_HEADERS: ${OPENTELEMETRY_EXPORTER_OTLP_HEADERS}
      DISABLE_TELEMETRY: ${DISABLE_TELEMETRY_FOR_RUNNER}
      ENABLE_PROFILING: ${ENABLE_PROFILING_FOR_RUNNER}
      PORT: ${GLOBAL_RUNNER_PORT:-3877}
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  fluentd:
    networks:
      - oneuptime
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  fluent-bit:
    networks:
      - oneuptime
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  e2e:
    restart: "no"
    network_mode: host # This is needed to access the host network,
    environment:
      <<: *common-variables
      # ExceptionOccurrenceFixture writes to ClickHouse directly, so pass exactly
      # the connection settings it reads. From this host-networked container the
      # "clickhouse" hostname does not resolve; with HOST=localhost the fixture
      # maps it to the loopback port published by
      # Scripts/Dev/docker-compose.dev.yml or
      # packages/E2E/docker-compose.e2e-clickhouse.yml. E2E_CLICKHOUSE_URL
      # overrides both.
      CLICKHOUSE_USER: ${CLICKHOUSE_USER}
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
      CLICKHOUSE_DATABASE: ${CLICKHOUSE_DATABASE}
      CLICKHOUSE_HOST: ${CLICKHOUSE_HOST}
      CLICKHOUSE_PORT: ${CLICKHOUSE_PORT}
      E2E_CLICKHOUSE_URL: ${E2E_CLICKHOUSE_URL:-}
      E2E_TEST_IS_USER_REGISTERED: ${E2E_TEST_IS_USER_REGISTERED}
      E2E_TEST_REGISTERED_USER_EMAIL: ${E2E_TEST_REGISTERED_USER_EMAIL}
      E2E_TEST_REGISTERED_USER_PASSWORD: ${E2E_TEST_REGISTERED_USER_PASSWORD}
      E2E_TEST_STATUS_PAGE_URL: ${E2E_TEST_STATUS_PAGE_URL}
      E2E_TESTS_FAILED_WEBHOOK_URL: ${E2E_TESTS_FAILED_WEBHOOK_URL}
      # "<current>/<total>" runs one shard of the default suite (see
      # packages/E2E/Sharding/Sharding.ts). The release workflows set it per
      # job; empty, the whole suite runs.
      E2E_SHARD: ${E2E_SHARD:-}
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

  ingress:
    restart: always
    networks:
      - oneuptime
    # The ingress proxies a high volume of short-lived upstream connections to a
    # single backend. Widen the ephemeral source-port range and allow TIME_WAIT
    # reuse so the gateway never exhausts local ports — otherwise nginx starts
    # returning "connect() ... (99: Address not available)" 502s for every route.
    # These are per-container (network-namespace) sysctls; no privileged mode.
    sysctls:
      net.ipv4.ip_local_port_range: "1024 65535"
      net.ipv4.tcp_tw_reuse: "1"
      net.ipv4.tcp_fin_timeout: "15"
    environment:
      <<: *common-runtime-variables
      ONEUPTIME_HTTP_PORT: ${ONEUPTIME_HTTP_PORT}
      NGINX_LISTEN_ADDRESS: ${NGINX_LISTEN_ADDRESS}
      NGINX_LISTEN_OPTIONS: ${NGINX_LISTEN_OPTIONS}
      # Per-request access logging for the high-volume ingest locations
      # (/otlp, /telemetry, /session-replay, /kubernetes-cost, /pyroscope).
      # Defaults to "on" here rather than to config.env, so an operator who has
      # never heard of this knob keeps every ingest log line. Set it to off /
      # false / 0 / no in config.env to opt out; anything else keeps logging.
      NGINX_INGEST_ACCESS_LOG: ${NGINX_INGEST_ACCESS_LOG:-on}
      DISABLE_TELEMETRY: ${DISABLE_TELEMETRY_FOR_INGRESS}
    ports:
      - "${ONEUPTIME_HTTP_PORT}:7849"
      - "${STATUS_PAGE_HTTPS_PORT}:7850"
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"

volumes:
  postgres:
  clickhouse:

networks:
  oneuptime:
    driver: bridge