compose.shared.yml

# Shared infra — one copy across ALL git worktrees.
#
# The Presidio analyzer is a stateless /analyze HTTP service: it holds no
# per-worktree state and loads a ~1 GB spaCy model, so running one copy per
# worktree wasted the most memory of anything in the stack. It lives here under
# a FIXED project name instead of the per-worktree `COMPOSE_PROJECT_NAME` used
# by compose.yml.
#
# The LGTM observability stack lives here for the same reason. It used to be
# per-worktree, on the grounds that same-commit worktrees emit identical
# Prometheus series and intermixed traces. That is true only while the signals
# are indistinguishable — so instead of paying ~560 MB per worktree for a second
# copy (the single most expensive container in the stack, and the main reason
# several concurrent worktrees exhausted host memory), every worktree now tags
# its telemetry with OTEL_RESOURCE_ATTRIBUTES=worktree=$COMPOSE_PROJECT_NAME.
# `git:workinit` writes that; `mise.toml` holds the main tree's default. Filter
# by the `worktree` label in Grafana to get one worktree's signals back.
#
# Always manage this file with an explicit fixed project so a worktree's
# COMPOSE_PROJECT_NAME cannot fork it into a second copy:
#
#   docker compose -f compose.shared.yml -p gram-shared up -d
#   docker compose -f compose.shared.yml -p gram-shared down
#
# The host port is a hardcoded literal, NOT ${PRESIDIO_PORT}. As a single
# shared singleton it must land on the same fixed host port no matter which
# worktree starts it — interpolating per-worktree env would let a worktree that
# still carries a stale PRESIDIO_PORT remap (not yet cleaned by git:worksync)
# recreate this container republished on a different port, fragmenting the
# shared stack for everyone else. Keep this literal in sync with PRESIDIO_PORT's
# default in mise.toml (5050), which is what every worktree's app connects to.
#
# Bound to 127.0.0.1: Presidio is an unauthenticated PII-analysis service and
# only ever called by local host processes, so it must not be reachable on the
# host's external interfaces.
name: gram-shared

services:
  gram-presidio:
    image: mcr.microsoft.com/presidio-analyzer:2.2.362
    restart: unless-stopped
    ports:
      - "127.0.0.1:5050:3000"
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://localhost:3000/health')",
        ]
      interval: 10s
      timeout: 5s
      retries: 5

  # Tempo only makes a trace searchable once it has idled the trace out and cut
  # a block — seconds to a minute. Lookup by trace ID is immediate.
  lgtm:
    image: grafana/otel-lgtm:0.30.1@sha256:bb182ac3174a20923fa58f00d1790fa71eb06cc0150078c0b0e8feb9e6611492
    restart: unless-stopped
    # Bound to 127.0.0.1 for the same reason as Presidio: every one of these
    # APIs is unauthenticated, and this container now holds every worktree's
    # traces and metrics. All consumers are local host processes
    # (OTEL_EXPORTER_OTLP_ENDPOINT points at localhost), so nothing needs it on
    # the host's external interfaces.
    ports:
      - "127.0.0.1:13000:3000" # Grafana UI
      - "127.0.0.1:13200:3200" # Tempo HTTP API
      - "127.0.0.1:13100:3100" # Loki HTTP API
      - "127.0.0.1:9099:9090" # Prometheus UI/API
      - "127.0.0.1:4317:4317" # OTLP gRPC receiver
      - "127.0.0.1:4318:4318" # OTLP HTTP receiver
    volumes:
      # Runs as root, so wipe this from inside the container rather than sudo:
      # docker compose -f compose.shared.yml -p gram-shared exec lgtm \
      #   sh -c 'rm -rf /data/*'
      #
      # A named volume, not ./local/lgtm: this stack is started by whichever
      # worktree happens to run infra:start first, so a relative bind mount
      # would put the data wherever that tree is — letting which worktree
      # booted the machine silently decide where everyone's telemetry lives.
      - lgtm_data:/data
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:3000/api/health"]
      interval: 10s
      timeout: 5s
      retries: 12

volumes:
  lgtm_data:
    driver: local