cycles-server-admin/docker-compose.full-stack.prod.yml at main · runcycles/cycles-server-admin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

services:
  redis:
    logging: *default-logging
    image: redis:7-alpine
    restart: unless-stopped
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
    volumes:
      - redis-data:/data
    command: ["sh", "-c", "redis-server --appendonly yes --requirepass \"$${REDIS_PASSWORD}\""]
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a \"$${REDIS_PASSWORD}\" ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  cycles-admin:
    logging: *default-logging
    image: ghcr.io/runcycles/cycles-server-admin:0.1.25.54
    restart: unless-stopped
    ports:
      - "7979:7979"
    environment:
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
      ADMIN_API_KEY: ${ADMIN_API_KEY:?ADMIN_API_KEY must be set}
      WEBHOOK_SECRET_ENCRYPTION_KEY: ${WEBHOOK_SECRET_ENCRYPTION_KEY:?WEBHOOK_SECRET_ENCRYPTION_KEY must be set}
      WEBHOOK_SECRET_ALLOW_PLAINTEXT: "false"
      EVENT_TTL_DAYS: ${EVENT_TTL_DAYS:-90}
      DELIVERY_TTL_DAYS: ${DELIVERY_TTL_DAYS:-14}
      AUDIT_SAMPLE_UNAUTHENTICATED: ${AUDIT_SAMPLE_UNAUTHENTICATED:-100}
      AUTH_FAILURE_RATE_LIMIT_ENABLED: "true"
      AUTH_FAILURE_RATE_LIMIT_MAX_PER_MINUTE: ${AUTH_FAILURE_RATE_LIMIT_MAX_PER_MINUTE:-300}
      JAVA_OPTS: "-XX:MaxRAMPercentage=75 -XX:+UseG1GC -XX:+UseStringDeduplication"
      # Dashboard CORS origin(s). Comma-separated list. Set to your production
      # dashboard URL, e.g. https://dash.example.com. Default localhost:5173 is
      # the Vite dev server and will NOT work in production.
      DASHBOARD_CORS_ORIGIN: ${DASHBOARD_CORS_ORIGIN:-http://localhost:5173}
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:7979/actuator/health/readiness"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    depends_on:
      redis:
        condition: service_healthy

  cycles-server:
    logging: *default-logging
    image: ghcr.io/runcycles/cycles-server:0.1.25.48
    restart: unless-stopped
    ports:
      - "7878:7878"
    environment:
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
      ADMIN_API_KEY: ${ADMIN_API_KEY:?ADMIN_API_KEY must be set}
      WEBHOOK_SECRET_ENCRYPTION_KEY: ${WEBHOOK_SECRET_ENCRYPTION_KEY:?WEBHOOK_SECRET_ENCRYPTION_KEY must be set}
      CYCLES_METRICS_TENANT_TAG_ENABLED: "false"
      SPRINGDOC_API_DOCS_ENABLED: "false"
      SPRINGDOC_SWAGGER_UI_ENABLED: "false"
      JAVA_OPTS: "-XX:MaxRAMPercentage=75 -XX:+UseG1GC -XX:+UseStringDeduplication"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:7878/actuator/health/readiness"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    depends_on:
      redis:
        condition: service_healthy

  cycles-events:
    logging: *default-logging
    image: ghcr.io/runcycles/cycles-server-events:0.1.25.23
    restart: unless-stopped
    # Management port 9980 (health + Prometheus) is deliberately NOT published
    # to the host: the events worker's actuator is unauthenticated by design
    # (the separate management port is its isolation mechanism - see
    # cycles-server-events OPERATIONS.md). Prometheus scrapes over the compose
    # network; the container healthcheck probes in-container.
    environment:
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
      MANAGEMENT_PORT: 9980
      WEBHOOK_SECRET_ENCRYPTION_KEY: ${WEBHOOK_SECRET_ENCRYPTION_KEY:?WEBHOOK_SECRET_ENCRYPTION_KEY must be set}
      WEBHOOK_SECRET_ALLOW_PLAINTEXT: "false"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:9980/actuator/health/readiness"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    depends_on:
      redis:
        condition: service_healthy

volumes:
  redis-data: