compose.yml

x-graft-server-image: &graft-server-image ghcr.io/gewuyou/graft-server:${GRAFT_IMAGE_TAG:?GRAFT_IMAGE_TAG is required}

x-graft-server-runtime-env: &graft-server-runtime-env
  GRAFT_APP_ENV: ${GRAFT_APP_ENV:-production}
  GRAFT_DATABASE_URL: ${GRAFT_DATABASE_URL:-host=postgres port=5432 dbname=${POSTGRES_DB} user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} sslmode=disable}
  GRAFT_REDIS_ADDR: ${GRAFT_REDIS_ADDR:-redis:6379}
  GRAFT_AUTH_JWT_SECRET: ${GRAFT_AUTH_JWT_SECRET}
  # Keep deployment identity and image strategy explicit in every official server-image container.
  GRAFT_DEPLOYMENT_RUNTIME: ${GRAFT_DEPLOYMENT_RUNTIME:-compose}
  GRAFT_IMAGE_TAG: ${GRAFT_IMAGE_TAG:?GRAFT_IMAGE_TAG is required}
  GRAFT_UPDATE_RECOVERY_RUNNER_IMAGE: ${GRAFT_UPDATE_RECOVERY_RUNNER_IMAGE:-}
  GRAFT_HTTPX_WEBSOCKET_ALLOWED_ORIGINS: ${GRAFT_HTTPX_WEBSOCKET_ALLOWED_ORIGINS:-http://127.0.0.1:${GRAFT_WEB_HOST_PORT:-3000},http://localhost:${GRAFT_WEB_HOST_PORT:-3000}}

services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - ${COMPOSE_FILE_DIR:-.}/.data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    environment:
      GRAFT_REDIS_PASSWORD: ${GRAFT_REDIS_PASSWORD:-}
    command:
      - sh
      - -ec
      - |
        if [ -n "$${GRAFT_REDIS_PASSWORD:-}" ]; then
          exec redis-server --save "" --appendonly no --requirepass "$${GRAFT_REDIS_PASSWORD}"
        fi
        exec redis-server --save "" --appendonly no
    healthcheck:
      test:
        - CMD-SHELL
        - |
          if [ -n "$${GRAFT_REDIS_PASSWORD:-}" ]; then
            REDISCLI_AUTH="$${GRAFT_REDIS_PASSWORD}" redis-cli ping
          else
            redis-cli ping
          fi
      interval: 5s
      timeout: 3s
      retries: 10

  config-validate:
    image: *graft-server-image
    restart: "no"
    # The deployment .env may be root-owned, so this short-lived read-only check runs as root.
    user: "0:0"
    command: ["config", "validate", "--env-file", "/opt/graft/deployment/.env", "--compose-file", "/opt/graft/deployment/compose.yml"]
    volumes:
      - ${COMPOSE_FILE_DIR:-.}/compose.yml:/opt/graft/deployment/compose.yml:ro
      - ${COMPOSE_FILE_DIR:-.}/.env:/opt/graft/deployment/.env:ro
      - ${GRAFT_AGENT_SERVER_TLS_HOST_PATH:-./.data/agent-server-tls}:/run/graft/agent-server-tls:ro
      - ${GRAFT_CREDENTIAL_VAULT_HOST_PATH:-./.data/credential-vault}:/run/graft/credential-vault:ro

  bootstrap:
    image: *graft-server-image
    restart: "no"
    env_file:
      - .env
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        # cutover-v1 is the one-time bootstrap authority for legacy update state;
        # it must complete before the forward-only migration registry runs.
        /app/graft update cutover-v1
        exec /app/graft migrate up
    depends_on:
      config-validate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      <<: *graft-server-runtime-env
    volumes:
      # The beta cutover is the only bootstrap operation allowed to mutate v1 state.
      - graft-update-state:/var/lib/graft/update-state
      - ${GRAFT_AGENT_SERVER_TLS_HOST_PATH:-./.data/agent-server-tls}:/run/graft/agent-server-tls:ro
      - ${GRAFT_CREDENTIAL_VAULT_HOST_PATH:-./.data/credential-vault}:/run/graft/credential-vault:ro

  migration-preflight:
    image: *graft-server-image
    restart: "no"
    profiles: ["migration-preflight"]
    env_file:
      - .env
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        if [ -z "$${GRAFT_MIGRATION_SIDECAR_HOST_PATH:-}" ]; then
          echo "GRAFT_MIGRATION_SIDECAR_HOST_PATH must point at a verified sidecar directory for GRAFT_IMAGE_TAG" >&2
          exit 64
        fi
        case "$${GRAFT_IMAGE_TAG:-}" in
          ""|latest|beta)
            echo "migration preflight requires a fixed release GRAFT_IMAGE_TAG, not latest or beta" >&2
            exit 64
            ;;
        esac
        case "$${GRAFT_MIGRATION_PREFLIGHT_MANIFEST:-}" in
          ""|/*|..|*../*|../*)
            echo "GRAFT_MIGRATION_PREFLIGHT_MANIFEST must be a relative path inside the verified sidecar directory" >&2
            exit 64
            ;;
        esac
        case "$${GRAFT_MIGRATION_PREFLIGHT_SHA256:-}" in
          ""|*[!0123456789abcdefABCDEF]*)
            echo "GRAFT_MIGRATION_PREFLIGHT_SHA256 must be the expected SHA-256 hex digest for the sidecar manifest" >&2
            exit 64
            ;;
        esac
        if [ "$${#GRAFT_MIGRATION_PREFLIGHT_SHA256}" -ne 64 ]; then
          echo "GRAFT_MIGRATION_PREFLIGHT_SHA256 must be 64 hex characters" >&2
          exit 64
        fi
        manifest="/opt/graft/migration-sidecars/$${GRAFT_MIGRATION_PREFLIGHT_MANIFEST}"
        if [ ! -f "$${manifest}" ]; then
          echo "migration preflight manifest was not found inside the verified sidecar directory" >&2
          exit 64
        fi
        expected_sha256="$$(printf '%s' "$${GRAFT_MIGRATION_PREFLIGHT_SHA256}" | tr '[:upper:]' '[:lower:]')"
        actual_sha256="$$(sha256sum "$${manifest}" | awk '{print $$1}')"
        if [ "$${actual_sha256}" != "$${expected_sha256}" ]; then
          echo "migration preflight manifest digest mismatch" >&2
          exit 64
        fi
        exec /app/graft migrate preflight --manifest "$${manifest}"
    depends_on:
      config-validate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      <<: *graft-server-runtime-env
      GRAFT_MIGRATION_SIDECAR_HOST_PATH: ${GRAFT_MIGRATION_SIDECAR_HOST_PATH:-}
      GRAFT_MIGRATION_PREFLIGHT_MANIFEST: ${GRAFT_MIGRATION_PREFLIGHT_MANIFEST:-}
      GRAFT_MIGRATION_PREFLIGHT_SHA256: ${GRAFT_MIGRATION_PREFLIGHT_SHA256:-}
    volumes:
      # Release sidecars are read-only evidence for `migrate preflight`.
      # They must be copied from the same verified release as GRAFT_IMAGE_TAG.
      - ${GRAFT_MIGRATION_SIDECAR_HOST_PATH:-./.data/migration-sidecars}:/opt/graft/migration-sidecars:ro
      - ${GRAFT_AGENT_SERVER_TLS_HOST_PATH:-./.data/agent-server-tls}:/run/graft/agent-server-tls:ro
      - ${GRAFT_CREDENTIAL_VAULT_HOST_PATH:-./.data/credential-vault}:/run/graft/credential-vault:ro

  application-root-init:
    image: *graft-server-image
    restart: "no"
    user: "0:0"
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        set -eux
        mkdir -p /opt/graft/apps
        chown 10001:10001 /opt/graft/apps
        chmod 0750 /opt/graft/apps
        test "$(stat -c '%u:%g' /opt/graft/apps)" = "10001:10001"
        test "$(stat -c '%a' /opt/graft/apps)" = "750"
    volumes:
      - ${GRAFT_APPLICATION_ROOT_HOST_PATH:-/opt/graft/apps}:/opt/graft/apps
    depends_on:
      config-validate:
        condition: service_completed_successfully

  backup-root-init:
    image: *graft-server-image
    restart: "no"
    user: "0:0"
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        set -eu
        mkdir -p "${GRAFT_BACKUP_ARTIFACT_ROOT:-/var/lib/graft/backups}"
        chown 10001:10001 "${GRAFT_BACKUP_ARTIFACT_ROOT:-/var/lib/graft/backups}"
        chmod 0700 "${GRAFT_BACKUP_ARTIFACT_ROOT:-/var/lib/graft/backups}"
    volumes:
      - ${GRAFT_BACKUP_ARTIFACT_HOST_PATH:-/opt/graft/backups}:${GRAFT_BACKUP_ARTIFACT_ROOT:-/var/lib/graft/backups}
    depends_on:
      config-validate:
        condition: service_completed_successfully

  server:
    image: *graft-server-image
    restart: unless-stopped
    user: "0:0"
    entrypoint:
      - /bin/sh
      - -ec
      - |
        if [ -S /var/run/docker.sock ]; then
          sock_gid="$$(stat -c '%g' /var/run/docker.sock)"
          sock_group="$$(awk -F: -v gid="$$sock_gid" '$$3 == gid { print $$1; exit }' /etc/group)"
          if [ -z "$$sock_group" ]; then
            addgroup -S -g "$$sock_gid" dockerhost
            sock_group=dockerhost
          fi
          addgroup graft "$$sock_group"
        fi
        exec su graft -s /bin/sh -c '/app/graft serve'
    env_file:
      - .env
    depends_on:
      bootstrap:
        condition: service_completed_successfully
      application-root-init:
        condition: service_completed_successfully
      backup-root-init:
        condition: service_completed_successfully
    environment:
      <<: *graft-server-runtime-env
      GRAFT_HTTP_ADDR: ${GRAFT_HTTP_ADDR:-:8080}
      GRAFT_PROJECT_IMPORT_DEFAULT_PATH: ${GRAFT_PROJECT_IMPORT_DEFAULT_PATH:-}
      GRAFT_PROJECT_IMPORT_CONTAINER_PATH: ${GRAFT_PROJECT_IMPORT_CONTAINER_PATH:-/srv/graft-imports}
    expose:
      - "${GRAFT_SERVER_EXPOSE_PORT:-8080}"
      - "${GRAFT_HTTPX_AGENT_BOOTSTRAP_TLS_PORT:-8443}"
      - "${GRAFT_HTTPX_AGENT_TLS_PORT:-8444}"
    volumes:
      # Retained only for Runtime Target discovery/summary, Container
      # snapshot/resource/log/stream/event/stats/interactive reads,
      # Deployment Runtime's current-server Docker facts, and bounded
      # Update observation/recovery. Update Controller launch is Agent-owned.
      - /var/run/docker.sock:/var/run/docker.sock
      - ${GRAFT_PROJECT_IMPORT_HOST_PATH:-./.data/imports}:${GRAFT_PROJECT_IMPORT_CONTAINER_PATH:-/srv/graft-imports}:ro
      - ${GRAFT_APPLICATION_ROOT_HOST_PATH:-/opt/graft/apps}:/opt/graft/apps
      - ${GRAFT_BACKUP_ARTIFACT_HOST_PATH:-/opt/graft/backups}:${GRAFT_BACKUP_ARTIFACT_ROOT:-/var/lib/graft/backups}
      - ${GRAFT_AGENT_SERVER_TLS_HOST_PATH:-./.data/agent-server-tls}:/run/graft/agent-server-tls:ro
      - ${GRAFT_CREDENTIAL_VAULT_HOST_PATH:-./.data/credential-vault}:/run/graft/credential-vault:ro
      - graft-build-snapshots:/tmp/graft-build-snapshots
      # 更新 runner 独占写入该卷；server 重启后只能读取并投影状态。
      - graft-update-state:/var/lib/graft/update-state:ro

  docker-runtime-agent:
    image: ghcr.io/gewuyou/graft-docker-runtime-agent:${GRAFT_IMAGE_TAG:?GRAFT_IMAGE_TAG is required}
    restart: unless-stopped
    depends_on:
      server:
        condition: service_healthy
    group_add:
      - "${GRAFT_DOCKER_RUNTIME_AGENT_DOCKER_SOCKET_GID:-65534}"
    volumes:
      - ${GRAFT_DOCKER_RUNTIME_AGENT_CONFIG_HOST_PATH:-./.data/docker-runtime-agent/config}:/etc/graft/config:ro
      - ${GRAFT_DOCKER_RUNTIME_AGENT_BOOTSTRAP_HOST_PATH:-./.data/docker-runtime-agent/bootstrap}:/run/graft-agent-bootstrap:ro
      - ${GRAFT_DOCKER_RUNTIME_AGENT_TRUST_HOST_PATH:-./.data/docker-runtime-agent/trust}:/run/graft-agent-trust:ro
      - ${GRAFT_DOCKER_RUNTIME_AGENT_STATE_HOST_PATH:-./.data/docker-runtime-agent/state}:/var/lib/graft-runtime-agent/state
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${GRAFT_APPLICATION_ROOT_HOST_PATH:-/opt/graft/apps}:/opt/graft/apps
      - graft-build-snapshots:/tmp/graft-build-snapshots:ro
    healthcheck:
      test: ["CMD", "/app/graft-docker-runtime-agent", "--healthcheck"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s

  web:
    image: ghcr.io/gewuyou/graft-web:${GRAFT_IMAGE_TAG:?GRAFT_IMAGE_TAG is required}
    restart: unless-stopped
    environment:
      GRAFT_SERVER_UPSTREAM: ${GRAFT_SERVER_UPSTREAM:-http://server:8080}
    depends_on:
      server:
        condition: service_healthy
    ports:
      - "${GRAFT_WEB_HOST_PORT:-3000}:80"

volumes:
  graft-build-snapshots:
    name: graft-build-snapshots
  graft-update-state:
    name: ${GRAFT_UPDATE_STATE_VOLUME:-graft-update-state}