RealTube/docker-compose.yml at master · mathieu-neron/RealTube · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
# RealTube - Docker Compose Stack
# See docs/design/infrastructure-design.md for the full target configuration.
#
# Services:
#   postgres        - PostgreSQL 16 database
#   redis           - Redis 7 cache
#   go-backend      - Go/Fiber primary API (port 8080)
#   python-backend  - Python/FastAPI secondary API (port 8081)
#   db-exporter     - Daily pg_dump to ./exports/
#   nginx           - NGINX reverse proxy (port 80/443)

secrets:
  postgres_password:
    file: ./secrets/postgres_password
  redis_password:
    file: ./secrets/redis_password

services:
  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/certs:/etc/nginx/certs:ro
    depends_on:
      go-backend:
        condition: service_healthy
      python-backend:
        condition: service_healthy
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    # No ports exposed to host — accessible only via Docker internal network
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-realtube}
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_DB: ${POSTGRES_DB:-realtube}
    secrets:
      - postgres_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./migrations:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U realtube"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    # No ports exposed to host — accessible only via Docker internal network
    command: >
      sh -c 'redis-server
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
      --appendonly no
      --requirepass "$$(cat /run/secrets/redis_password)"'
    secrets:
      - redis_password
    volumes:
      - redis_data:/data
    restart: unless-stopped

  go-backend:
    build:
      context: ./realtube-go
      dockerfile: Dockerfile
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-realtube}
      - POSTGRES_DB=${POSTGRES_DB:-realtube}
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_SSLMODE=${POSTGRES_SSLMODE:-prefer}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - PORT=8080
      - LOG_LEVEL=info
      - ENVIRONMENT=development
      - CORS_ORIGINS=chrome-extension://*,moz-extension://*,https://localhost,http://localhost:*
      - EXPORT_DIR=/exports
    secrets:
      - postgres_password
      - redis_password
    ports:
      - "8080:8080"
    volumes:
      - ./exports:/exports:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8080/health/live"]
      interval: 10s
      timeout: 3s
      retries: 3
    restart: unless-stopped

  python-backend:
    build:
      context: ./realtube-python
      dockerfile: Dockerfile
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-realtube}
      - POSTGRES_DB=${POSTGRES_DB:-realtube}
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_SSLMODE=${POSTGRES_SSLMODE:-prefer}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - PORT=8081
      - LOG_LEVEL=info
      - ENVIRONMENT=development
      - CORS_ORIGINS=chrome-extension://*,moz-extension://*,https://localhost,http://localhost:*
      - EXPORT_DIR=/exports
    secrets:
      - postgres_password
      - redis_password
    ports:
      - "8081:8081"
    volumes:
      - ./exports:/exports:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test: ["CMD", "python", "-c", "import httpx; httpx.get('http://localhost:8081/health/live').raise_for_status()"]
      interval: 10s
      timeout: 3s
      retries: 3
    restart: unless-stopped

  db-exporter:
    image: postgres:16-alpine
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      PGHOST: postgres
      PGUSER: ${POSTGRES_USER:-realtube}
      PGDATABASE: ${POSTGRES_DB:-realtube}
    secrets:
      - postgres_password
    volumes:
      - ./exports:/exports
      - ./scripts/db-export.sh:/db-export.sh:ro
      - ./scripts/db-exporter-entrypoint.sh:/db-exporter-entrypoint.sh:ro
    entrypoint: ["sh", "/db-exporter-entrypoint.sh"]
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data: