Stellar-Micro-Donation-API/docker-compose.prod.yml at main · Dennis-Ritchie1/Stellar-Micro-Donation-API · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
version: '3.9'

services:
  api:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - '3000:3000'
    # Use secrets from files instead of environment variables
    # Secrets are mounted as read-only files in /run/secrets/
    secrets:
      - encryption_key
      - api_keys
      - db_encryption_key
      - stellar_secret_key
      - stellar_public_key
      - jwt_secret
    environment:
      # Reference secrets via file paths
      - ENCRYPTION_KEY_FILE=/run/secrets/encryption_key
      - API_KEYS_FILE=/run/secrets/api_keys
      - DB_ENCRYPTION_KEY_FILE=/run/secrets/db_encryption_key
      - STELLAR_SECRET_KEY_FILE=/run/secrets/stellar_secret_key
      - STELLAR_PUBLIC_KEY_FILE=/run/secrets/stellar_public_key
      - JWT_SECRET_FILE=/run/secrets/jwt_secret
      - NODE_ENV=production
      - DB_PATH=/app/data/donations.db
      - LOG_LEVEL=info
      - SECURE_SECRETS=true
      - SHUTDOWN_TIMEOUT_MS=30000
    volumes:
      # Persist SQLite database across container restarts
      - db_data:/app/data
      # Mount logs directory for external log aggregation
      - logs:/app/logs
    restart: always
    # Allow the 30-second shutdown budget to complete before SIGKILL.
    stop_grace_period: 35s
    # Resource limits to prevent container resource exhaustion.
    #
    # ⚠️  IMPORTANT — deploy.resources is a Docker Swarm / Docker Stack
    #     construct.  When you start the container with:
    #
    #       docker-compose -f docker-compose.prod.yml up -d   (plain Compose)
    #
    #     Docker Compose silently ignores the entire deploy.resources block,
    #     so the limits AND reservations below are NOT enforced.  They only
    #     take effect when you deploy via Docker Swarm:
    #
    #       docker stack deploy -c docker-compose.prod.yml stellar
    #
    #     If you are using plain docker-compose up and want actual resource
    #     enforcement, replace this block with top-level service keys:
    #
    #       mem_limit: 1g
    #       cpus: '2.0'
    #
    #     These plain-Compose keys ARE honoured by `docker-compose up`.
    #
    # See: https://docs.docker.com/compose/compose-file/deploy/#resources
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
        # The reservation below is a "guaranteed minimum" scheduler hint.
        # It is Swarm-only and is silently ignored by plain docker-compose up.
        reservations:
          cpus: '1.0'
          memory: 512M
    # Health check configuration
    healthcheck:
      test: ['CMD', 'wget', '-qO-', 'http://localhost:3000/health']
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    # Logging configuration
    logging:
      driver: 'json-file'
      options:
        max-size: '100m'
        max-file: '10'
        labels: 'service=stellar-api,env=production'

volumes:
  db_data:
    driver: local
  logs:
    driver: local

secrets:
  # These secrets should be managed by Docker Swarm, Kubernetes, or populated from external secret stores
  # For Swarm: docker secret create encryption_key -
  # For K8s: kubectl create secret generic stellar-secrets --from-literal=encryption_key=<value>
  encryption_key:
    file: ./secrets/encryption_key.txt
  api_keys:
    file: ./secrets/api_keys.txt
  db_encryption_key:
    file: ./secrets/db_encryption_key.txt
  stellar_secret_key:
    file: ./secrets/stellar_secret_key.txt
  stellar_public_key:
    file: ./secrets/stellar_public_key.txt
  jwt_secret:
    file: ./secrets/jwt_secret.txt