docker-compose.yml

# Volume anchors - reusable volume definitions
x-pg-hba: &pg-hba
  ./configs/postgres/conf/pg_hba.conf:/pg_hba.conf

x-pg-conf: &pg-conf
  ./configs/postgres/conf/postgresql.conf:/postgresql.conf

x-pg-init: &pg-init
  ./configs/postgres/init/:/docker-entrypoint-initdb.d

volumes:
  pgdata:

services:
  postgres:
    # Drop every capability, then add back only what the official entrypoint needs:
    # CHOWN/FOWNER for fresh-volume PGDATA ownership; SETUID/SETGID to drop to the
    # postgres user; DAC_READ_SEARCH so the root entrypoint can inspect an existing
    # PGDATA tree owned by postgres on restart (verified on Linux containers).
    cap_add:
      - CHOWN
      - FOWNER
      - SETGID
      - SETUID
      - DAC_READ_SEARCH
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    init: true
    command:
      - /usr/local/bin/docker-entrypoint.sh
      - -c
      - config_file=/postgresql.conf
    environment:
      PGDATA: /data/pg
      POSTGRES_DB: ${XPGDATABASE}
      POSTGRES_PASSWORD: ${XPGPASSWORD}
      POSTGRES_USER: ${XPGUSER}
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready --host localhost -U $$POSTGRES_USER -d $$POSTGRES_DB
      interval: 1s
      timeout: 1s
      retries: 5
      start_period: 30s
    image: registry.hub.docker.com/library/postgres:18
    shm_size: 1024M
    deploy:
      resources:
        limits:
          memory: ${POSTGRES_MEM_LIMIT:-3g}
    memswap_limit: ${POSTGRES_MEM_LIMIT:-3g}
    ulimits:
      core: 0
    volumes:
      - *pg-hba
      - *pg-conf
      - *pg-init
      - pgdata:/data/pg
      - ${HOME}/.psqlrc:/var/lib/postgresql/.psqlrc:ro
      - ${HOME}/.psql_history:/var/lib/postgresql/.psql_history

  apiservice:
    build:
      context: ./
      dockerfile: ./api/Dockerfile
      args:
        GIT_SHA: ${GIT_SHA:-unknown}
        GIT_BRANCH: ${GIT_BRANCH:-unknown}
    pull_policy: never
    image: sylvan_librarian/apiservice:${IMAGE_TAG:-latest}
    shm_size: 3000M
    # Non-root API binds one port and needs no Linux capabilities in practice.
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    command:
      - dumb-init
      - --
      - python
      - -m
      - api.entrypoint
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
      CDN_URL: ${CDN_URL:-https://d1hot9ps2xugbc.cloudfront.net}
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-}
      ENABLE_CACHE: ${ENABLE_CACHE:-false}
      ENABLE_ENGINE: ${ENABLE_ENGINE:-false}
      ENVIRONMENT: ${ENVIRONMENT:-dev}
      HONEYBADGER_API_KEY: ${HONEYBADGER_API_KEY:-}
      HOSTNAME: ${HOSTNAME}
      PGDATABASE: ${XPGDATABASE}
      PGHOST: postgres
      PGPASSWORD: ${XPGPASSWORD}
      PGUSER: ${XPGUSER}
      PREFER_SCORE_BACKFILL_TIMEOUT_MS: ${PREFER_SCORE_BACKFILL_TIMEOUT_MS:-120000}
      PYTHONUNBUFFERED: true
      SHARED_CACHE_PATH: ${SHARED_CACHE_PATH:-/tmp/sylvan.cache}
    healthcheck:
      test:
        - CMD
        - curl
        - --fail
        - --user-agent
        - healthcheck
        - localhost:8080/get_pid
      interval: 5s
      timeout: 1s
      retries: 60
      start_period: 40s
    deploy:
      resources:
        limits:
          memory: 2813m
    memswap_limit: 2813m
    ports:
      # Loopback by default: Docker's published ports are DNAT'd ahead of the INPUT chain, so a
      # host firewall (ufw/firewalld) does NOT restrict them. Binding 0.0.0.0 would expose the API
      # to anything that can route here while looking firewalled. Override with BIND_ADDR — see
      # "Binding and reverse proxies" in the README.
      - "${BIND_ADDR:-127.0.0.1}:${API_PORT:-28080}:8080"
    ulimits:
      core: 0
    user: 1000:1000
    volumes:
      - ./data/api/${APP_ENV:-dev}/:/data/api
      - ./api/static:/app/api/static

  client:
    build:
      context: ./
      dockerfile: ./client/Dockerfile
    pull_policy: never
    image: sylvan_librarian/client:${IMAGE_TAG:-latest}
    command:
      - dumb-init
      - --
      - sleep
      - infinity
    depends_on:
      apiservice:
        condition: service_started
    environment:
      API_URL: http://apiservice:8080
      BATCH_SIZE: ${BATCH_SIZE:-50}
      CORPUS: ${CORPUS:-}
      PYTHONUNBUFFERED: true
      QUERY_DELAY: ${QUERY_DELAY:-0.1}
      QUERY_MODE: ${QUERY_MODE:-realistic}
    deploy:
      resources:
        limits:
          memory: 8m
    memswap_limit: 8m
    ulimits:
      core: 0
    user: 1000:1000