docker-compose.yml

# Talkyard, discussion forum software, v1.
#
# This is for development and testing.  For production installations, use
# another repo:  https://github.com/debiki/talkyard-prod-one,
# also found as a Git submodule here:  modules/ed-prod-one-test/.


# These get created automatically by Docker, and prefixed by 'tyd1_'
# (the Compose project name in .env).
volumes:
  web-generated:
  web-core-dumps:
  pub-files:
  priv-files:
  redis-data:
  pg-data:
  es-data:
  es-logs:

# See: https://docs.docker.com/compose/how-tos/use-secrets/
secrets:
  postgres_password:
    file: ./tests/secrets/test_postgres_password.txt
  backup_password:
    file: ./tests/secrets/test_backup_password.txt

# This network structure reduces the blast radius: If someone breaks into Nginx, they still
# can't access Postgres or ElasticSearch directly. But they could possibly inspect
# traffic to/from Nginx and look at active user or admin sessions, and in that way get access
# via the app server. So, this setup reduces, but doesn't eliminate, the risk (e.g. they
# might need an active session to exploit).
#
# Internal networks are isolated from the external world, can't access the Internet.
# See: https://docs.docker.com/reference/compose-file/networks/#internal
#
# The egress proxy & subnet prevent Server-Side Request Forgery (SSRF).
#
# The netw names get prefixed with COMPOSE_PROJECT_NAME = 'tyd1_' by Docker, from .env.
#
networks:
  # Frontend public network. Connects Nginx to the Internet.
  fe_pub_net:
    ipam:
      config:
        - subnet: ${FE_PUB_NET_SUBNET}
  # So Nginx can talk to the app server.
  fe_int_net:
    internal: true
    ipam:
      config:
        - subnet: ${FE_INT_NET_SUBNET}
  # Backend network: the app server and various databases.
  be_int_net:
    internal: true
    ipam:
      config:
        - subnet: ${BE_INT_NET_SUBNET}
  # So the app server can connect to the egress proxy.
  eg_int_net:
    internal: true
    ipam:
      config:
        - subnet: ${EG_INT_NET_SUBNET}
  # So the egress proxy can access the Internet, e.g. to send webhooks or fetch link previews.
  eg_pub_net:
    ipam:
      config:
        - subnet: ${EG_PUB_NET_SUBNET}
  test_int_net:
    internal: true
    ipam:
      config:
        - subnet: ${TEST_INT_NET_SUBNET}
  test_pub_net:
    ipam:
      config:
        - subnet: ${TEST_PUB_NET_SUBNET}
  test_ext_net:
    ipam:
      config:
        - subnet: ${TEST_EXT_NET_SUBNET}

# See: https://github.com/compose-spec/compose-spec/blob/main/spec.md#logging
x-logging: &default_logging
  # This driver rotates logs, so won't run out of disk.
  driver: local


services:
  web:
    build: images/web
    # SECURITY [ty_v2]: Later, in prod, use an unprivileged image?
    # See: https://github.com/nginx/docker-nginx-unprivileged
    # Also: read_only: true,  then Gemini thinks we also need sth like:
    # tmpfs:
    #   - /var/cache/nginx:size=100M
    #   - /var/run:size=1M
    #   - /var/lib/nginx/tmp:size=100M
    #   - /tmp ...
    #   - /run ...
    image: ${DOCKER_REG_ORG}/talkyard-web
    # so can specify core dump path [NGXCORED]
    #privileged: true
    volumes:
      # A LetsEncrypt ACME account key gets generated on startup and saved here, by:
      # ./images/web/run-envsubst-gen-keys-exec-nginx.sh
      # Once done, you could make this volume read-only: append ':ro' to the next line.
      - web-generated:/etc/nginx/generated
      # Mount the config, scripts and styles, rather than relying on Docker's COPY,
      # so Nginx can auto reload them after edits, without rebuilding the image.
      # (The files are COPY:d too, in the Dockerfile, so will work in Prod.)
      - ./images/web/sites-enabled/:/etc/nginx/sites-enabled/:ro
      - ./images/web/ty-lua/:/opt/talkyard/lua/:ro
      - ./images/web/assets/:/opt/talkyard/assets/:ro   # [NGXSTC]
      - ./images/web/ty-media/:/opt/talkyard/ty-media/:ro
      # Mount Lua packages dir, so can upgrade packages by running
      # 'opm install' from inside a web container. [upd_resty_pkgs]
      #- ./images/web/openresty-pkgs/new/:/usr/local/openresty/site/
      # Don't, however, mount priv-files here.
      - pub-files:/var/talkyard/v1/pub-files:ro
      # Seems core dumps get saved here? [NGXCORED]
      - web-core-dumps:/tmp/cores
    ports:
      - '80:80'
      - '443:443'
    networks:
      fe_pub_net:
        ipv4_address: ${FE_PUB_NET_WEB_IP}
      fe_int_net:
        ipv4_address: ${FE_INT_NET_WEB_IP}
    depends_on:
      - app
      # lua-resty-acme caches https certs in Redis.
      - cache
    logging: *default_logging
    environment:
      TY_NGX_ERROR_LOG_LEVEL: 'debug'
      #TY_NGX_ACCESS_LOG_CONFIG: 'tyalogfmt'
      #TY_NGX_LIMIT_REQ_BODY_SIZE: "5m"
      CDN_PULL_KEY: "public"
      # This is dev mode; tell the browser to refresh its cache each request. [2WBKP46]
      TY_MAX_AGE_YEAR: "no-cache"
      TY_MAX_AGE_MONTH: "no-cache"
      TY_MAX_AGE_WEEK: "no-cache"
      TY_MAX_AGE_DAY: "no-cache"
      TY_MAX_AGE_HOUR: "no-cache"
      TY_MAX_AGE_15MIN: "no-cache"
    # Try this out during development for a while,
    # see: https://stackoverflow.com/questions/43467670/which-capabilities-can-i-drop-in-a-docker-nginx-container
    # DO_AFTER 2021-03-1 reply and say if worked, accept answer.
    # When cap_drop is ALL, it gets processed before cap_add, see:
    # https://stackoverflow.com/a/63219871
    # and:
    # https://github.com/moby/moby/blob/1c39b1c44c973f18f39bd684c6aba57bb96510fe/oci/caps/utils.go#L120
    security_opt:
      # Check if works by using `docker inspect web`.
      - no-new-privileges=true
    cap_drop:
      - ALL
    cap_add:
      # Docs: https://man7.org/linux/man-pages/man7/capabilities.7.html
      #
      # Without CHOWN:
      # nginx: [emerg] chown("/opt/nginx/proxy-cache", 100) failed (1: Operation not permitted)
      - CHOWN
      # To bypass file read, write, and execute permission checks:
      # (DAC means "discretionary access control", and DAC_OVERRIDE)
      # Without DAC_OVERRIDE:
      # nginx: [emerg] mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)
      - DAC_OVERRIDE
      # To change the group and user id of a process: (so Nginx won't need to run as root)
      - SETGID
      - SETUID
      # To bind to lower ports. Maybe listen on 8080 instead, and map port 80:8080?
      - NET_BIND_SERVICE

  app:
    build:
      context: images/app/
      dockerfile: Dockerfile.dev
    # A different image:  ${DOCKER_REG_ORG}/talkyard-app  (without "-dev") is used in
    # production; it's created by ./docker/build-app-prod.sh.
    image: ${DOCKER_REG_ORG}/talkyard-app-dev
    stdin_open: true  # otherwise Play Framework exits
    tty: true  # colored logs
    volumes:
      - ./:/opt/talkyard/app/
      # ./conf/app:/opt/talkyard/app/conf/
      - pub-files:/var/talkyard/v1/pub-files
      - priv-files:/var/talkyard/v1/priv-files
      # So assets get refreshed on restart, in dev mode, without rebuilding image. [APPJSPATH]
      - ./images/app/assets/:/opt/talkyard/app/assets/:ro
      - ./images/app/migrations/:/opt/talkyard/app/migrations/  # :ro
      - ./version.txt:/opt/talkyard/app/version.txt:ro
      # Without this, takes forever to start: sbt would always download all dependencies. [SBTHOME]
      # This is for Linux:  (https://get-coursier.io/docs/cache.html#default-location)
      - ./vendors/jars/cache/:/home/owner/.cache/
      - ./vendors/jars/ivy2/:/home/owner/.ivy2/
      - ./vendors/jars/sbt/:/home/owner/.sbt/
    secrets:
      - source: postgres_password
        target: /tmp/postgres_password  # [postgres_pw_path]
    networks:
      # --- So can attach a debugger on port 9999 ------
      # But comment out by default, so we'll notice egress proxy issues. [egressp_conf]
      #fe_pub_net:
      #  ipv4_address: ${FE_PUB_NET_APP_IP}
      # -------------------------------------------------
      fe_int_net:
        ipv4_address: ${FE_INT_NET_APP_IP}
      be_int_net:
        ipv4_address: ${BE_INT_NET_APP_IP}
      eg_int_net:
        ipv4_address: ${EG_INT_NET_APP_IP}
      test_int_net:
        ipv4_address: ${TEST_INT_NET_APP_IP}
    ports:
      # Let's expose these, for debugging and troubleshooting.
      - '9000:9000' # Play's HTTP listen port.
      - '9999:9999' # Java debugger port
      - '3333:3333' # JMX
    depends_on:
      # Start also if other services are unhealthy, so can show admin troubleshooting tips.
      - rendr
      - cache
      - rdb
      - search
      - egressp
    logging: *default_logging
    environment:
      PLAY_HEAP_MEMORY_MB: 2800
      HOSTNAME: "localhost"
      CREATE_SITE_HOSTNAME: "localhost"
      BECOME_OWNER_EMAIL_ADDRESS: "admin@example.com"
      E2E_TEST_PASSWORD: "public"
      FORBIDDEN_PASSWORD: "public"
      # [egressp_conf]
      http_proxy: 'http://egressp:4750'
      https_proxy: 'http://egressp:4750'
      # Don't exclude anything — that'd negate the whole point of the proxy.
      no_proxy: ''

      # ----- Tracing
      # See: https://github.com/jaegertracing/legacy-client-java/blob/master/jaeger-core/README.md
      #         #configuration-via-environment

      # Or "probabilistic", param 0.0 ... 1.0, or "ratelimiting" with param = num samples per second.
      # or "remote" (the default), asks the Jaeger agent how to sample.
      JAEGER_SAMPLER_TYPE: "const"
      JAEGER_SAMPLER_PARAM: "1"
      # Or 6831? 6832? will be renamed to JAEGER_CONFIG_MANAGER_HOST_PORT
      # https://github.com/jaegertracing/jaeger-client-go/issues/282
      #JAEGER_SAMPLER_MANAGER_HOST_PORT: "tracer:5778"

      # Either configure Jaeger agent host and port:
      # JAEGER_AGENT_HOST
      # JAEGER_AGENT_PORT
      # Or connect directly to the Jaeger connector: (optionally with authentication info)
      JAEGER_ENDPOINT: "http://tracer:14268/api/traces"
      # JAEGER_USER: ""
      # JAEGER_PASSWORD: ""
      # JAEGER_AUTH_TOKEN: ""
    security_opt:
      - no-new-privileges=true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID

  rendr:
    build: images/rendr/
    image: ${DOCKER_REG_ORG}/talkyard-rendr
    read_only: true  # will this work? If so, add to prod too
    networks:
      be_int_net:
        ipv4_address: ${BE_INT_NET_RENDR_IP}
    ports:
     # For debugging and troubleshooting, dev builds.
     - '8084:8084' # Deno listens on this port.
     - '9084:9084' # Deno debugger port
    logging: *default_logging
    security_opt:
      - no-new-privileges=true
    cap_drop:
      - ALL

  cache:
    build: images/cache/
    image: ${DOCKER_REG_ORG}/talkyard-cache
    volumes:
      - redis-data:/data
    # Expose, so can troubleshoot-query Redis.
    ports:
      - '6379:6379'
    networks:
      fe_int_net:
        ipv4_address: ${FE_INT_NET_CACHE_IP}
    logging: *default_logging
    sysctls:
      net.core.somaxconn: 511
    security_opt:
      - no-new-privileges=true
    cap_drop:
      - ALL
    cap_add:
      # The redis entryoint does:
      #    find . \! -user redis -exec chown redis '{}' +
      # so we need CHOWN. [redis_cap_chown]
      # (See /usr/local/bin/docker-entrypoint.sh after having entered the container,
      # docker compose run --rm cache sh,
      # or see: https://github.com/redis/docker-library-redis/blob/master/7.2/debian/docker-entrypoint.sh)
      - CHOWN
      - SETGID
      - SETUID
      # Otherwise Redis 8.6 won't start because of this error:  (but worked fine w 8.4)
      # "setpriv: apply bounding set: Operation not permitted"
      - SETPCAP

  search:
    build: images/search/
    image: ${DOCKER_REG_ORG}/talkyard-search
    # If too low, the 'search' container will suddenly exit with code 137. No error message
    # will get logged — instead it just exits, suddenly. Why? OOM-killed? In Docker? Hmm.
    #mem_limit: 800M
    volumes:
      - es-data:/usr/share/elasticsearch/data
      # Deprecation logs aren't written to stdout, but to files in this dir,
      # auto rotated, max 5G in total.
      # See: https://www.elastic.co/docs/deploy-manage/monitor/logging-configuration/elasticsearch-deprecation-logs
      - es-logs:/usr/share/elasticsearch/logs
    ports:
      # Expose, dev mode, for troubleshooting.
      - '9200:9200'
      - '9300:9300'
    networks:
      # --- So can `curl` to ElasticSearch at 9200 ------
      fe_pub_net:
        ipv4_address: ${FE_PUB_NET_SEARCH_IP}
      # -------------------------------------------------
      be_int_net:
        ipv4_address: ${BE_INT_NET_SEARCH_IP}
    logging: *default_logging
    environment:
      ES_JAVA_OPTS: '-Xms2024m -Xmx2024m'
      #ELASTIC_PASSWORD=str0ng_pwd # for the 'elastic' user
      #logger.org.elasticsearch: DEBUG — very verbose
      #logger.level: DEBUG # or TRACE if preferred
      logger.level: INFO
    ulimits:
      # Memory locking, if swap disabled on host.
      memlock:
        soft: -1
        hard: -1
      # Increase the number of open files limit
      nofile:
        soft: 65536
        hard: 65536
    security_opt:
      - no-new-privileges=true
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID

  rdb:
    build: images/rdb/
    image: ${DOCKER_REG_ORG}/talkyard-rdb
    secrets:
      - postgres_password
    volumes:
      # PostgreSQL 18 creates a sub dir, e.g. /var/lib/postgresql/18/docker/
      # PostgreSQL 19 creates a .../19/... dir, etc, to allow upgrading between major
      # versions using `--link` when running pg_upgrade and mounting /var/lib/postgresql.
      # See: https://github.com/docker-library/postgres/issues/37#issuecomment-3476426533
      - pg-data:/var/lib/postgresql
    networks:
      be_int_net:
        ipv4_address: ${BE_INT_NET_RDB_IP}
    logging: *default_logging
    environment:
      # The password instead gets read from ./tests/secrets/test_postgres_password.txt .
      #POSTGRES_PASSWORD: 'public'
      POSTGRES_PASSWORD_FILE: '/run/secrets/postgres_password'
      PEER_HOST: 'rdb2'
      PEER_PORT: '5432'
      PEER_PASSWORD: 'public2'
      CREATE_TEST_USER: 'yes'
    security_opt:
      - no-new-privileges=true
    cap_drop:
      - ALL
    cap_add:  # [enough_caps]? See: https://github.com/docker-library/postgres/issues/649
      - CHOWN
      - DAC_READ_SEARCH
      - FOWNER
      - SETGID
      - SETUID
      - SYS_NICE

  # Egress proxy.
  # Stops Server Side Request Forgery (SSRF).
  egressp:
    image: ${DOCKER_REG_ORG}/talkyard-egressp
    build: images/egressp/
    networks:
      eg_int_net:
        ipv4_address: ${EG_INT_NET_EGRESSP_IP}
      eg_pub_net:
        ipv4_address: ${EG_PUB_NET_EGRESSP_IP}
      test_ext_net:
        ipv4_address: ${TEST_EXT_NET_EGRESSP_IP}
    logging: *default_logging
    read_only: true
    security_opt:
      - no-new-privileges=true
    cap_drop:
      - ALL

  backup:
    build: images/backup/
    image: ${DOCKER_REG_ORG}/talkyard-backup
    restart: no
    profiles: [backup] # prevents auto-start on 'up'
    # If under heavy load, run backup scripts in the background with 25% priority.
    # (The default share is 1024. 256 means that the backup container gets just 25%
    # as much CPU as the other containers.)
    cpu_shares: 256
    # Don't let the backup container use more than 60% CPU (even if the system is idle),
    # otherwise on a small VM the kernel might panic [100_kernel_panic].
    cpu_quota:   60000
    cpu_period: 100000
    secrets:
      # Will appear at /run/secrets/postgres_password. [backup_pg_client_secret]
      - postgres_password
      #- backup_password
    volumes:
      # Here we save the backups.
      - ./target/var-opt-backups-talkyard-v1:/var/opt/backups/talkyard/v1
      # So can backup uploaded files and Redis.
      - pub-files:/var/talkyard/v1/pub-files:ro
      - priv-files:/var/talkyard/v1/priv-files:ro
      - redis-data:/var/talkyard/v1/redis-data:ro
      # So can test backup of config files, e.g. an edited .env file.
      - ./modules/ed-prod-one-test:/opt/talkyard-v1:ro
      # So can edit the backup script and changes take effect without rebuild.
      #- ./images/backup/backup.sh:/ty/backup.sh
    logging: *default_logging
    depends_on:
      # So can backup database.
      - rdb
    networks:
      be_int_net:
    security_opt:
      - no-new-privileges=true
    cap_drop:
      - ALL
    cap_add:
      # So 'root' can access Redis' dump.rdb file, which is owned by user 'redis' 999.
      - CAP_DAC_READ_SEARCH


  # An extra database, so you can experiment with Postgres replication and failover.
  # You don't need to start it.
  #rdb2:
  #  mem_limit: 30M
  #  build: images/rdb/
  #  volumes:
  #    - pg2-data:/var/lib/postgresql
  #  networks:
  #    be_int_net:
  #      ipv4_address: ${BE_INT_NET_RDB2_IP}
  #  logging: *default_logging
  #  environment:
  #    POSTGRES_PASSWORD: 'public2'
  #    PEER_HOST: 'rdb'
  #    PEER_PORT: '5432'
  #    PEER_PASSWORD: 'public'
  #  security_opt:
  #    - no-new-privileges=true
  # + cap_drop etc from service 'rdb' above.

  # Not included in production (the docker file in talkyard-prod-one).
  adminer:
    image: adminer
    restart: no
    profiles: [tools]
    logging: *default_logging
    ports:
      # Pg's default port, 5432, backwards.   Does this work, when on the be_int_net only ??
      - 2345:8080
    networks:
      be_int_net:

  # Remove this? Instead,  s/d run --rm -p '9229:9229' nodejs   .. ?
  # But how specify ipv4_address via `s/d run`?
  #
  #test:
  #  build: images/gulp/
  #  image: ${DOCKER_REG_ORG}/talkyard-test
  #  volumes:
  #    - ./:/opt/talkyard/server/
  #  ports:
  #    # This is for debugging tests running in Node.js in this container, and started
  #    # via `node --debug-brk --inspect=9229`. [8EA02R4]
  #    - '9229:9229'
  #  networks:
  #    internal_net:
  #      ipv4_address: ${INTERNAL_NET_TEST_IP}
  #  # So can send HTTP request to the web container. See tests/security/settings.ts [7PKW4R2]
  #  depends_on:
  #    - web
  #  # Don't want this container to start at all by default.
  #  command: 'exit 0'

  # A fake external server, for e2e tests, when the Ty server sends its own HTTP
  # requests to external things.
  fakeweb:
    build: images/fakeweb/
    image: ${DOCKER_REG_ORG}/fakeweb
    profiles: [e2etests]
    # Now included in the image instead:  [fakeweb_mount_nothing]
    #volumes:
    #  - ./images/fakeweb/app/:/app/:ro
    #  - ./volumes/fakeweb-deno-dir:/deno-dir
    ports:
      # So the Webdriverio e2e tests can ask this server what HTTP requests
      # the Ty server has sent. E.g. outgoing webhooks, or anti spam service queries.
      - '8090:8090'
    logging: *default_logging
    networks:
      test_ext_net:
        ipv4_address: ${TEST_EXT_NET_FAKEWEB_IP}

  # Dummy SMTP server, for testing.
  # fakemail:
  #   build: images/fakemail/mailslurper
  #   image: ${DOCKER_REG_ORG}/fakemail
  #   restart: 'no'
  #   profiles: [e2etests]
  #   volumes:
  #     - ./images/fakemail/mailslurper-config.json:/config.json
  #     - ./images/fakemail/fakemail-publ-test-self-signed.key:/smtp-server.key
  #     - ./images/app/fakemail-publ-test-self-signed.crt:/smtp-server.crt  # yes, in app-dev [26UKWD2]
  #   ports:
  #    - '8025:8025'  # smtp, '80' + 25 (25 = old standard port, 587 = new for STARTTLS)
  #    - '8026:8026'  # admin interface,  '80' + 25 + 1
  #    - '8027:8027'  # service port = api requests or what? '80' + 25 + 2
  #   logging: *default_logging
  #   networks:
  #     test_int_net:
  #       ipv4_address: ${TEST_INT_NET_FAKEMAIL_IP}
  #     test_pub_net:  or  test_ext_net  ?
  #       ipv4_address: ${TEST_PUB_NET_FAKEMAIL_IP}

  # Jaeger Tracing. Access at http://localhost:16686.
  # Not currently in use.
  #tracer:
  #  image: jaegertracing/all-in-one:1.7
  #  ports:               # Component. What. (https://www.jaegertracing.io/docs/1.6/getting-started/)
  #    #- '5775:5775/udp' # Agent. accept zipkin.thrift over compact thrift protocol
  #    - '6831:6831/udp'  # Agent. accept jaeger.thrift over compact thrift protocol
  #    - '6832:6832/udp'  # Agent. accept jaeger.thrift over binary thrift protocol
  #    - '5778:5778'      # Agent. serve configs
  #    - '16686:16686'    # Query. Web interface + find traces.
  #    - '14268:14268'    # Collector. accept jaeger.thrift directly from clients
  #    #- '9411:9411'     # Collector. Zipkin compatible endpoint
  #  networks:
  #    be_int_net:  # or where?
  #      ipv4_address: ${BE_INT_NET_TRACER_IP}

  # The same as the 'test' container, except that 'nodejs' won't start the rest of
  # the stack, instead it just transpiles Typescript and Stylus.
  nodejs:
    build: images/nodejs/
    image: ${DOCKER_REG_ORG}/talkyard-nodejs
    restart: 'no'
    profiles: [build]
    tty: true  # colored logs
    volumes:
      - ./:/opt/talkyard/server/   # [NODEHOME]
    #command: ['yarn install && gulp watch']
    # But 'exit 0' won't work — not an executable file,
    command: ['echo']
    logging: *default_logging

  # Ghost e2e test container — move it to  docker-compose.it.yml  later.
  #
  # Ghost integration test. Docs, over at Ghost:
  # https://ghost.org/integrations/talkyard/
  #
  # Can start like so:
  # docker run -d --name ty-ghost-test -p 3001:2368 \
  #      -v (this-repo-dir)/tests/int-w/ghost/content:/var/lib/ghost/content ghost:4.34.0
  #
  # But let's include here, and use Ghost's default port 2368?
  it-ghost:
    # Image docs: https://hub.docker.com/_/ghost/
    image: ghost:4.34.0
    restart: 'no'
    profiles: [e2etests]
    # Won't work in Prod tests — so, incl in image instead of mounting?  [ghost_prod_test_img]
    volumes:
      - ./tests/int-w/ghost/casper-post.hbs:/var/lib/ghost/current/content/themes/casper/post.hbs
    logging: *default_logging
    ports:
      # Why does Ghost like this port? Who knows
      - '2368:2368'
    networks:
      test_ext_net:
        ipv4_address: ${TEST_EXT_NET_GHOST_IP}


# vim: et ts=2 sw=2