docker-compose.yml

# Tips:
# - `z` makes bind mount content shared among multiple containers.
# - `Z` makes bind mount content private and unshared.

version: "2.4"

networks:
  default:
    driver: bridge

services:
  frontend:
    container_name: ${COMPOSE_PROJECT_NAME}-frontend
    image: ${COMPOSE_FRONTEND_IMAGE}:${COMPOSE_FRONTEND_TAG}
    build:
      context: .
    depends_on: ["backend", "baza-server"]
    ports:
      - 80:80  # nginx http
    volumes:
      - ./assets/conf.toml:/var/www/conf.toml:ro,Z
      - ./build/web/:/var/www/public/:ro,Z
      - ./dev/mailhog/mailhog.conf:/etc/nginx/conf.d/mailhog.conf:ro,Z
      - ./helm/messenger/conf/nginx.conf:/etc/nginx/conf.d/default.conf:ro,Z
  backend:
    container_name: ${COMPOSE_PROJECT_NAME}-backend
    image: ${COMPOSE_BACKEND}
    depends_on:
      cockroachdb:
        condition: service_healthy
      tigerbeetle:
        condition: service_healthy
      vault:
        condition: service_healthy
      baza-storage:
        condition: service_started
      mailhog:
        condition: service_started
    environment:
      CONF.MODE.DEBUG: "true"
      CONF.DB.COCKROACHDB.HOST: cockroachdb
      CONF.DB.TIGERBEETLE.ADDRESSES[0]: 127.0.0.1:3030
      CONF.MEDIA_SERVER.MEDEA.ICE.EMBEDDED.PUBLIC_HOST.STUN.MAIN: 127.0.0.1:3478
      CONF.MEDIA_SERVER.MEDEA.ICE.EMBEDDED.PUBLIC_HOST.TURN.MAIN: 127.0.0.1:3478
      CONF.MEDIA_SERVER.MEDEA.SERVER.CLIENT.HTTP.PUBLIC_URL: ws://localhost/api/medea/ws
      CONF.MEDIA_SERVER.MEDEA.SERVER.CLIENT.WEBRTC.TCP.PUBLIC_ADDR.MAIN: 127.0.0.1:19305
      CONF.MEDIA_SERVER.MEDEA.SERVER.CLIENT.WEBRTC.UDP.PUBLIC_ADDR.MAIN: 127.0.0.1:19305
      CONF.PUSH.FCM.SA_KEY: ${COMPOSE_PUSH_FCM_SA_KEY}
      CONF.PUSH.APNS.TEAM_ID: ${COMPOSE_PUSH_APNS_TEAM_ID}
      CONF.PUSH.APNS.KEY_ID: ${COMPOSE_PUSH_APNS_KEY_ID}
      CONF.PUSH.APNS.TOPIC: ${COMPOSE_PUSH_APNS_TOPIC}
      CONF.PUSH.APNS.PRIVATE_KEY: ${COMPOSE_PUSH_APNS_PRIVATE_KEY}
      CONF.STORAGE.FILE.S3.HOST: baza-storage
      CONF.SMTP.HOST: mailhog
      CONF.VAULT.HASHICORP.URL: http://vault:8200
    security_opt:
      - seccomp=unconfined  # required for TigerBeetle to use `io_uring` on CI
    ports:
      - 3478:3478                # backend medea stun tcp
      - 3478:3478/udp            # backend medea stun udp
      - 8081:7777                # backend http
      - 8090:8090                # backend medea http (ws)
      - 49066-49100:49166-49200  # backend medea turn
      - 19305:19305              # backend medea webrtc tcp
      - 19305:19305/udp          # backend medea webrtc udp
    expose:
      - 9372   # backend metrics
      - 10025  # backend healthz
    volumes:
      - ./.cache/backend/l10n/:/l10n/:Z
      - ./dev/backend.toml:/config.toml:ro,Z
  cockroachdb:
    container_name: ${COMPOSE_PROJECT_NAME}-cockroachdb
    image: ${COMPOSE_COCKROACHDB}
    command:
      - start-single-node
      - --insecure
      - --locality=region=local,zone=local
      - --log-config-file=/logs.yaml
    ports:
      - 8070:8080    # cockroachdb admin ui http
      - 8071:8081    # cockroachdb pgweb ui http
      - 26257:26257  # cockroachdb sql
    volumes:
      - ./.cache/cockroachdb/data/:/cockroach/cockroach-data/:Z
      - ./dev/cockroachdb/logs.yaml:/logs.yaml:ro,Z
    healthcheck:
      # https://www.cockroachlabs.com/docs/monitoring-and-alerting.html#health-ready-1
      test: ["CMD", "curl", "-f", "http://localhost:8080/health?ready=1"]
      interval: 3s
      timeout: 3s
      retries: 5
  cockroachdb-pgweb:
    container_name: ${COMPOSE_PROJECT_NAME}-cockroachdb-pgweb
    image: sosedoff/pgweb:latest
    depends_on:
      cockroachdb:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://root@127.0.0.1:26257/defaultdb?sslmode=disable
    network_mode: service:cockroachdb
  tigerbeetle:
    container_name: ${COMPOSE_PROJECT_NAME}-tigerbeetle
    image: ${COMPOSE_TIGERBEETLE}
    command: ["start", "--addresses=0.0.0.0:3030", "/data/0_0.tigerbeetle"]
    cap_add:
      - IPC_LOCK            # required for TigerBeetle to lock memory on CI
    security_opt:
      - seccomp=unconfined  # required for TigerBeetle to use `io_uring` on CI
    ports:
      - 3030:3030  # tigerbeetle
    volumes:
      - ./.cache/tigerbeetle/data/:/data/
    healthcheck:
      # NOTE: We're using `grep` here because `tigerbeetle` can't handle `help`
      #       command and loops execution.
      test: /tigerbeetle repl --addresses=0.0.0.0:3030 --cluster=0
                              --command="lookup_accounts"
                              2>&1
            | grep " connected "
      interval: 3s
      timeout: 3s
      retries: 5
  vault:
    container_name: ${COMPOSE_PROJECT_NAME}-vault
    image: ${COMPOSE_VAULT}
    command: ["vault", "server", "-config=/vault/config/local.json"]
    environment:
      VAULT_ADDR: http://localhost:8200  # for entrypoint and CLI
    cap_add:
      - IPC_LOCK   # required for HashiCorp Vault to lock memory on CI
    ports:
      - 8200:8200  # vault http
    volumes:
      - ./.cache/vault/data/:/vault/file/:Z
      - ./.cache/vault/secrets/:/vault/secrets/:Z
      - ./dev/vault/:/vault/config/:ro,Z
    healthcheck:
      test: vault status
      start_period: 15s  # wait for vault initialization
      interval: 5s
      timeout: 5s
      retries: 5
  baza-storage:
    container_name: ${COMPOSE_PROJECT_NAME}-baza-storage
    image: ghcr.io/instrumentisto/baza:0.2
    user: "1000"
    ports:
      - 5656:5656  # baza http (read)
      - 9294:9294  # baza s3 (write)
    volumes:
      - ./.cache/baza/data/:/var/lib/baza/:z
  baza-server:
    container_name: ${COMPOSE_PROJECT_NAME}-baza-server
    image: ${COMPOSE_FILESERVER}
    depends_on: ["baza-storage"]
    environment:
      NGINX_JWT_SECRET: baza
    volumes:
      - ./.cache/baza/cache/:/var/run/:Z
      - ./.cache/baza/data/:/var/lib/baza/:ro,z
    network_mode: service:baza-storage
  mailhog:
    container_name: ${COMPOSE_PROJECT_NAME}-mailhog
    image: mailhog/mailhog:latest
    environment:
      MH_HOSTNAME: mailhog.localhost
      MH_AUTH_FILE: /etc/auth.passwd  # robot:test
    ports:
      - 1025:1025  # mailhog smtp
      - 8082:8025  # mailhog http
    volumes:
      - ./dev/mailhog/auth.passwd:/etc/auth.passwd:ro,Z