name: haixun-prod services: mongo: image: mongo:7.0.24 restart: unless-stopped environment: MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USER:?MONGO_ROOT_USER is required} MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD:?MONGO_ROOT_PASSWORD is required} MONGO_INITDB_DATABASE: ${MONGO_DATABASE:-haixun} command: ["mongod", "--bind_ip_all", "--auth"] ports: - "127.0.0.1:${MONGO_PORT:-27017}:27017" volumes: - mongo_data:/data/db - mongo_config:/data/configdb healthcheck: test: ["CMD-SHELL", "mongosh --quiet --host 127.0.0.1 --username \"$$MONGO_INITDB_ROOT_USERNAME\" --password \"$$MONGO_INITDB_ROOT_PASSWORD\" --authenticationDatabase admin --eval \"db.adminCommand('ping').ok\" | grep 1"] interval: 15s timeout: 10s retries: 10 start_period: 40s stop_grace_period: 60s networks: [data] redis: image: redis:7.4.5-alpine restart: unless-stopped environment: REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD is required} command: - sh - -ec - exec redis-server --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD" ports: - "127.0.0.1:${REDIS_PORT:-6379}:6379" volumes: - redis_data:/data healthcheck: test: ["CMD-SHELL", "REDISCLI_AUTH=\"$$REDIS_PASSWORD\" redis-cli ping | grep PONG"] interval: 10s timeout: 5s retries: 10 start_period: 15s stop_grace_period: 30s networks: [data] minio: image: minio/minio:RELEASE.2025-04-22T22-12-26Z restart: unless-stopped command: ["server", "/data", "--console-address", ":9001"] environment: MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required} MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required} MINIO_BROWSER_REDIRECT_URL: ${MINIO_BROWSER_REDIRECT_URL:?MINIO_BROWSER_REDIRECT_URL is required} MINIO_SERVER_URL: ${MINIO_SERVER_URL:?MINIO_SERVER_URL is required} ports: - "127.0.0.1:${MINIO_API_PORT:-9000}:9000" - "127.0.0.1:${MINIO_CONSOLE_PORT:-9001}:9001" volumes: - minio_data:/data healthcheck: test: ["CMD", "curl", "-f", "http://127.0.0.1:9000/minio/health/live"] interval: 15s timeout: 10s retries: 10 start_period: 30s stop_grace_period: 60s networks: [data] prometheus: image: prom/prometheus:v3.5.0 restart: unless-stopped command: - --config.file=/etc/prometheus/prometheus.yml - --storage.tsdb.path=/prometheus - --storage.tsdb.retention.time=${PROMETHEUS_RETENTION:-30d} - --storage.tsdb.wal-compression - --web.enable-lifecycle ports: - "127.0.0.1:${PROMETHEUS_PORT:-9090}:9090" volumes: - ../monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro - ../monitoring/prometheus/rules:/etc/prometheus/rules:ro - ../monitoring/prometheus/targets:/etc/prometheus/targets:ro - prometheus_data:/prometheus healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9090/-/healthy"] interval: 15s timeout: 5s retries: 10 start_period: 20s depends_on: alertmanager: condition: service_started node-exporter: condition: service_started cadvisor: condition: service_started blackbox-exporter: condition: service_started networks: [monitoring] grafana: image: grafana/grafana:12.0.2 restart: unless-stopped environment: GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:?GRAFANA_ADMIN_USER is required} GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD is required} GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:?GRAFANA_ROOT_URL is required} GF_USERS_ALLOW_SIGN_UP: "false" GF_AUTH_ANONYMOUS_ENABLED: "false" # Grafana is localhost-only and reached through an SSH tunnel. GF_SECURITY_COOKIE_SECURE: "false" GF_SECURITY_COOKIE_SAMESITE: strict GF_ANALYTICS_REPORTING_ENABLED: "false" GF_ANALYTICS_CHECK_FOR_UPDATES: "false" GF_LOG_MODE: console ports: - "127.0.0.1:${GRAFANA_PORT:-3000}:3000" volumes: - ../monitoring/grafana/provisioning:/etc/grafana/provisioning:ro - grafana_data:/var/lib/grafana healthcheck: test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:3000/api/health"] interval: 15s timeout: 5s retries: 10 start_period: 30s depends_on: prometheus: condition: service_healthy loki: condition: service_started networks: [monitoring] loki: image: grafana/loki:3.5.1 restart: unless-stopped command: ["-config.file=/etc/loki/loki.yml"] ports: - "127.0.0.1:${LOKI_PORT:-3100}:3100" volumes: - ../monitoring/loki/loki.yml:/etc/loki/loki.yml:ro - loki_data:/loki networks: [monitoring] alloy: image: grafana/alloy:v1.9.1 restart: unless-stopped command: - run - --server.http.listen-addr=0.0.0.0:12345 - --storage.path=/var/lib/alloy/data - /etc/alloy/config.alloy ports: - "127.0.0.1:${ALLOY_PORT:-12345}:12345" volumes: - ../monitoring/alloy/config.alloy:/etc/alloy/config.alloy:ro - alloy_data:/var/lib/alloy/data - /var/run/docker.sock:/var/run/docker.sock:ro - /var/log/journal:/var/log/journal:ro - /run/log/journal:/run/log/journal:ro - /etc/machine-id:/etc/machine-id:ro depends_on: loki: condition: service_started networks: [monitoring] alertmanager: image: prom/alertmanager:v0.28.1 restart: unless-stopped command: - --config.file=/etc/alertmanager/alertmanager.yml - --storage.path=/alertmanager ports: - "127.0.0.1:${ALERTMANAGER_PORT:-9093}:9093" volumes: - ../monitoring/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro - ../monitoring/alertmanager/templates:/etc/alertmanager/templates:ro - alertmanager_data:/alertmanager healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9093/-/healthy"] interval: 15s timeout: 5s retries: 10 start_period: 20s networks: [monitoring] node-exporter: image: prom/node-exporter:v1.9.1 restart: unless-stopped command: - --path.procfs=/host/proc - --path.sysfs=/host/sys - --path.rootfs=/rootfs - --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/) - --collector.textfile.directory=/var/lib/node_exporter/textfile_collector ports: - "127.0.0.1:${NODE_EXPORTER_PORT:-9100}:9100" volumes: - /proc:/host/proc:ro - /sys:/host/sys:ro - /:/rootfs:ro,rslave - ../backup/status:/var/lib/node_exporter/textfile_collector:ro read_only: true security_opt: [no-new-privileges:true] networks: [monitoring] cadvisor: image: gcr.io/cadvisor/cadvisor:v0.52.1 restart: unless-stopped command: ["--docker_only=true", "--housekeeping_interval=30s"] ports: - "127.0.0.1:${CADVISOR_PORT:-8080}:8080" volumes: - /:/rootfs:ro - /var/run:/var/run:ro - /sys:/sys:ro - /var/lib/docker:/var/lib/docker:ro devices: - /dev/kmsg:/dev/kmsg privileged: true networks: [monitoring] blackbox-exporter: image: prom/blackbox-exporter:v0.27.0 restart: unless-stopped command: ["--config.file=/etc/blackbox_exporter/blackbox.yml"] ports: - "127.0.0.1:${BLACKBOX_EXPORTER_PORT:-9115}:9115" volumes: - ../monitoring/blackbox/blackbox.yml:/etc/blackbox_exporter/blackbox.yml:ro read_only: true security_opt: [no-new-privileges:true] extra_hosts: - host.docker.internal:host-gateway networks: [monitoring] volumes: mongo_data: mongo_config: redis_data: minio_data: prometheus_data: grafana_data: loki_data: alloy_data: alertmanager_data: networks: data: monitoring: