conode/docker-compose.base.yaml at master · literally-user/conode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
services:
  api:
    build: .

    restart: on-failure
    command: ["conode", "api", "run"]

    depends_on:
      keycloak:
        condition: service_healthy
      postgres:
        condition: service_healthy
      migrations:
        condition: service_completed_successfully

    networks:
      - conode-network

  migrations:
    build: .

    restart: on-failure
    command: ["conode", "migrations", "upgrade"]

    depends_on:
      postgres:
        condition: service_healthy

    networks:
      - conode-network

  grafana:
    image: grafana/grafana:12.1.1

    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.grafana.rule=Host(`grafana.conode.com`)"
      - "traefik.http.routers.grafana.entrypoints=web"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"

    networks:
      - conode-network

  oauth:
    image: quay.io/oauth2-proxy/oauth2-proxy:latest
    command: ["--config=/etc/oauth2-proxy/oauth2-proxy.toml"]

    environment:
      OAUTH2_PROXY_CLIENT_ID: conode
      OAUTH2_PROXY_CLIENT_SECRET: y9QISRU4LktDcAOvrXmw5q8t5s44JshMrnc4PIqPfq1vIEGipEtYgmUxvgiG9nb0PsxVwvlVQQ4FPOlhl9tiZ3
      OAUTH2_PROXY_COOKIE_SECRET: x3CpXUQxfDgXzDDxIdST3mTbTDosKOlx

    volumes:
      - "./deploy/oauth_proxy.toml:/etc/oauth2-proxy/oauth2-proxy.toml"

    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.oauth.rule=Host(`api.conode.com`)"
      - "traefik.http.routers.oauth.entrypoints=web"
      - "traefik.http.services.oauth.loadbalancer.server.port=4180"

    networks:
      - conode-network

    depends_on:
      keycloak:
        condition: service_healthy

  traefik:
    image: traefik:latest
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

    networks:
      conode-network:
        aliases:
          - keycloak.conode.com
          - api.conode.com

  keycloak:
    image: quay.io/keycloak/keycloak:latest

    command: start-dev --import-realm

    depends_on:
      postgres:
        condition: service_healthy

    env_file:
      - "./deploy/keycloak/keycloak.env"

    healthcheck:
      test:
        - CMD-SHELL
        - >
          { printf 'HEAD /health/ready HTTP/1.0\r\n\r\n' >&0;
          grep -q '200'; } 0<>/dev/tcp/localhost/9000
      interval: 5s
      timeout: 10s
      retries: 30
      start_period: 30s

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.keycloak.rule=Host(`keycloak.conode.com`)"
      - "traefik.http.routers.keycloak.entrypoints=web"
      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"

    volumes:
      - keycloak-data:/opt/keycloak/
      - ./deploy/keycloak/keycloak.json:/opt/keycloak/data/import/realm-export.json

    networks:
      - conode-network

  postgres:
    image: postgres:16-alpine

    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./deploy/persistence:/docker-entrypoint-initdb.d:ro

    networks:
      conode-network:
        aliases:
          - persistence.literally.io

    env_file:
      - "./deploy/persistence/postgres.env"

    healthcheck:
      test: ["CMD", "pg_isready", "-U", "conode", "-d", "conode"]
      interval: 5s
      timeout: 15s
      retries: 5

  alloy:
    image: grafana/alloy:latest

    volumes:
      - ./deploy/observability/grafana/config.alloy:/etc/alloy/config.alloy
      - alloy-data:/var/lib/alloy/data

    command:
      - run
      - /etc/alloy/config.alloy
      - --storage.path=/var/lib/alloy/data
      - --server.http.listen-addr=0.0.0.0:12345

    networks:
      - conode-network


  prometheus:
    image: prom/prometheus

    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--web.enable-remote-write-receiver"

    volumes:
      - prometheus-data:/prometheus
      - ./deploy/observability/grafana/prometheus.yml:/etc/prometheus/prometheus.yml

    networks:
      - conode-network


  tempo:
    image: grafana/tempo:latest

    command:
      - "-target=all"
      - "-config.file=/etc/tempo.yaml"

    restart: always

    volumes:
      - ./deploy/observability/grafana/tempo.yaml:/etc/tempo.yaml
      - tempo-data:/var/tempo

    networks:
      - conode-network


volumes:
  prometheus-data:
  postgres-data:
  keycloak-data:
  tempo-data:
  alloy-data:

networks:
  conode-network:
    driver: bridge