docker-compose.yml

volumes:
  assets:
  config:
  database:
  storage:
  logs:
  profile-stats:
  prometheus:
  test-cache:
  test-coverage:
  uds-nginx-web:

# Ensure that no service is both connected to a non-internal network and attempts to resolve other containers by name. If a container that’s connected to a non-internal network attempts to resolve a container that’s down, it will fall back to external DNS, which is itself unwanted but could lead to worse results if resolving externally somehow succeeds: there’s no mTLS or anything, so at worst, a malicious external network could impersonate `web` to `nginx`, or `postgres`/`memcached` to `web`. This is pretty niche and unlikely, but it reflects a serious design issue.
#
# So:
# - `web` connects to `postgres`, `memcached`, and `web-outgoing` by name, but has only internal networks (and uses `web-outgoing` to make limited HTTP requests)
# - `nginx` and `prometheus` are connected to non-internal networks, but only connect to `web` via a Unix socket in the `uds-nginx-web` volume
networks:
  external-web-outgoing:
  external-nginx:
  external-prometheus:
  web-memcached:
    internal: true
  web-postgres:
    internal: true
  web-web-outgoing:
    internal: true
  test-postgres:
    internal: true
  prometheus-web:
    internal: true

services:
  nginx:
    build: containers/nginx
    volumes:
      - assets:/weasyl/build:ro
      - storage:/weasyl/static:ro
      - test-coverage:/weasyl/coverage:ro
      - uds-nginx-web:/run/uds-nginx-web
    tmpfs:
      # owner nginx:root
      - '/run/nginx:mode=700,uid=1000'
      - '/var/lib/nginx/tmp:mode=700,uid=1000'
    networks:
      - external-nginx
    ports:
      - ${WEASYL_BIND:-127.0.0.1}:8080:8080/tcp
    read_only: true

  web:
    image: weasyl
    pull_policy: never
    build: &weasyl-build
      context: .
      args:
        version: '${WEASYL_VERSION:-}'
    environment:
      https_proxy: 'socks5h://web-outgoing'
      WEASYL_STORAGE_ROOT: 'storage'
      WEASYL_RELOAD_ASSETS: 'true'
      WEASYL_RELOAD_TEMPLATES: 'true'
      WEB_CONCURRENCY: '8'
      PYTHONWARNINGS: 'd'
      PYTHONUNBUFFERED: '1'
      PROMETHEUS_MULTIPROC_DIR: '/weasyl/storage/prometheus'
    volumes:
      - assets:/weasyl/build:ro
      - config:/run/config:ro
      - storage:/weasyl/storage/static
      - logs:/weasyl/storage/log
      - profile-stats:/weasyl/storage/profile-stats
      - uds-nginx-web:/weasyl/uds-nginx-web
      - type: tmpfs
        target: /tmp
    tmpfs:
      - '/weasyl/storage/prometheus:mode=700,uid=1000'
      - '/weasyl/storage/temp:mode=700,uid=1000'
      - '/magick-tmp:mode=700,uid=1000'
    networks:
      - prometheus-web
      - web-memcached
      - web-postgres
      - web-web-outgoing
    read_only: false
    depends_on:
      - postgres
      - memcached
      - web-outgoing
    command:
      - .venv/bin/gunicorn
      - --bind
      - unix:uds-nginx-web/web.sock
    develop:
      watch:
        - action: sync+restart
          path: ./weasyl
          target: /weasyl/weasyl
          ignore:
            - templates/
            - test/
        - action: sync+restart
          path: ./libweasyl
          target: /weasyl/libweasyl
          ignore:
            - alembic/
            - test/
        - action: sync
          path: ./weasyl/templates
          target: /weasyl/weasyl/templates

  web-outgoing:
    image: ghcr.io/weasyl/netferret@sha256:67399ee7670d250eb057e3139a98387d1299a7622131d6ba049e98a5edd85fe4
    init: true
    user: '1000'
    command:
      # Turnstile
      - -a
      - challenges.cloudflare.com
      # currency conversion in `weasyl.commishinfo`
      - -a
      - www.ecb.europa.eu
      # oEmbed in `weasyl.embed` and their `thumbnail_url`s
      - -a
      - www.youtube.com
      - -a
      - i.ytimg.com
      - -a
      - vimeo.com
      - -a
      - i.vimeocdn.com
      - -a
      - soundcloud.com
      - -a
      - i1.sndcdn.com
      - -a
      - sketchfab.com
      - -a
      - media.sketchfab.com
      - -a
      - bandcamp.com
      # crossposting in `weasyl.submission` not included by default
    networks:
      - external-web-outgoing
      - web-web-outgoing
    read_only: true

  memcached:
    image: docker.io/library/memcached:1.6-alpine3.22
    command: --memory-limit=64
    networks:
      - web-memcached
    read_only: true

  postgres:
    build: containers/postgres
    environment:
      POSTGRES_HOST_AUTH_METHOD: trust
      POSTGRES_USER: weasyl
      POSTGRES_DB: weasyl
    volumes:
      - database:/var/lib/postgresql/data
      - type: tmpfs
        target: /run/postgresql
      - type: tmpfs
        target: /tmp
    networks:
      - web-postgres
      # TODO: separate postgres service for tests
      - test-postgres
    read_only: true

  mail-logger:
    build: containers/postfix-stone
    init: true
    user: '100'
    command:
      - sh
      - -c
      - |
        stunnel
        smtp-sink -D /mail/%Y-%m-%d unix:/run/user/100/smtp-sink.sock 128
    tmpfs:
      - '/mail:mode=700,uid=100'
      - '/run/user/100:mode=700,uid=100'
    networks:
      - web-postgres
    read_only: true

  prometheus:
    profiles: [ prometheus ]
    build: containers/prometheus
    entrypoint: []
    command:
      - /bin/sh
      - -c
      # Prometheus doesn’t support scraping Unix sockets:
      # https://github.com/prometheus/prometheus/issues/12024
      - |
        nc -lk -p 8080 ::1 -e nc local:/run/uds-nginx-web/web.sock &
        exec /bin/prometheus \
          --config.file=/etc/prometheus/prometheus.yml \
          --storage.tsdb.path=/prometheus
    volumes:
      - prometheus:/prometheus
      - uds-nginx-web:/run/uds-nginx-web
    networks:
      - external-prometheus
      - prometheus-web
    ports:
      - ${WEASYL_BIND:-127.0.0.1}:9090:9090/tcp
    read_only: true

  configure:
    profiles: [ configure ]
    image: docker.io/library/alpine:3.22
    entrypoint:
      - sh
      - -c
      - cat >| "/run/config/$$1"
      - sh
    volumes:
      - config:/run/config
    network_mode: none
    read_only: true

  build-assets:
    profiles: [ build-assets ]
    build:
      context: .
      target: asset-builder
    init: true
    command:
      - sh
      - -ec
      - |
        deno run \
          --cached-only \
          --frozen \
          --allow-env \
          --allow-read \
          --allow-write \
          --allow-run \
          build.ts \
          --assets=./assets/ \
          --output=/weasyl-assets/
    volumes:
      - assets:/weasyl-assets
    network_mode: none

  build-assets-watch:
    profiles: [ build-assets-watch ]
    build:
      context: .
      target: asset-builder
    init: true
    command:
      - sh
      - -ec
      - |
        deno run \
          --cached-only \
          --frozen \
          --allow-env \
          --allow-read \
          --allow-write \
          --allow-run \
          build.ts \
          --assets=./assets/ \
          --output=/weasyl-assets/ \
          --watch
    volumes:
      - assets:/weasyl-assets
    network_mode: none
    develop:
      watch:
        - action: sync
          path: ./assets
          target: /weasyl-build/assets

  migrate:
    profiles: [ migrate ]
    image: weasyl
    pull_policy: never
    build: *weasyl-build
    command:
      - ash
      - -c
      - |
        i=0
        while true; do
          if test $$i -ge 8; then
            exit 1
          fi
          if test -n "$$(.venv/bin/alembic current 2> /dev/null)"; then
            break
          fi
          i=$$((i + 1))
          printf 'checking if postgres is up in %i seconds...\n' $$i
          sleep $$i
        done
        exec .venv/bin/alembic upgrade heads
    environment:
      # needed for revision f30dc3b5856a
      WEASYL_STORAGE_ROOT: '/fakepath'
      ALEMBIC_CONFIG: '/run/config/alembic.ini'
    volumes:
      - config:/run/config:ro
    networks:
      - web-postgres
    read_only: true
    depends_on:
      - postgres
    tty: true

  revision:
    profiles: [ revision ]
    image: weasyl
    pull_policy: never
    build: *weasyl-build
    entrypoint:
      - ash
      - -euc
      - |
        rev_id="$$(python3 -c 'import secrets; print(secrets.token_hex(6))')"
        .venv/bin/alembic -c /run/config/alembic.ini revision --rev-id "$$rev_id" "$$@" >&2
        tar c libweasyl/alembic/versions/"$$rev_id"_*
      - ash
    volumes:
      - config:/run/config:ro
    networks:
      - web-postgres
    depends_on:
      - postgres
    tty: true

  test:
    profiles: [ test ]
    build:
      context: .
      target: test
      args:
        version: '${WEASYL_VERSION:-}'
    environment:
      WEASYL_TEST_SQLALCHEMY_URL: 'postgresql+psycopg2://weasyl@postgres/weasyl_test'
    volumes:
      - config:/run/config:ro
      - test-cache:/weasyl/.pytest_cache
      - test-coverage:/weasyl/coverage
      - type: tmpfs
        target: /weasyl/testing
      - type: tmpfs
        target: /tmp
      - type: tmpfs
        target: /magick-tmp
    networks:
      - test-postgres
    read_only: true
    depends_on:
      - postgres
    tty: true

  flake8:
    profiles: [ flake8 ]
    build:
      context: .
      target: flake8
    init: true
    command:
      - sleep
      - infinity
    network_mode: none