thread-master/deploy/prod/compose/docker-compose.yml

name: haixun-prod

services:
  mongo:
    image: mongo:7.0.24
    restart: unless-stopped
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USER:?MONGO_ROOT_USER is required}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD:?MONGO_ROOT_PASSWORD is required}
      MONGO_INITDB_DATABASE: ${MONGO_DATABASE:-haixun}
    command: ["mongod", "--bind_ip_all", "--auth"]
    ports:
      - "127.0.0.1:${MONGO_PORT:-27017}:27017"
    volumes:
      - mongo_data:/data/db
      - mongo_config:/data/configdb
    healthcheck:
      test: ["CMD-SHELL", "mongosh --quiet --host 127.0.0.1 --username \"$$MONGO_INITDB_ROOT_USERNAME\" --password \"$$MONGO_INITDB_ROOT_PASSWORD\" --authenticationDatabase admin --eval \"db.adminCommand('ping').ok\" | grep 1"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 40s
    stop_grace_period: 60s
    networks: [data]

  redis:
    image: redis:7.4.5-alpine
    restart: unless-stopped
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    command:
      - sh
      - -ec
      - exec redis-server --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD"
    ports:
      - "127.0.0.1:${REDIS_PORT:-6379}:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD-SHELL", "REDISCLI_AUTH=\"$$REDIS_PASSWORD\" redis-cli ping | grep PONG"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    stop_grace_period: 30s
    networks: [data]

  minio:
    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
    restart: unless-stopped
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER is required}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      MINIO_BROWSER_REDIRECT_URL: ${MINIO_BROWSER_REDIRECT_URL:?MINIO_BROWSER_REDIRECT_URL is required}
      MINIO_SERVER_URL: ${MINIO_SERVER_URL:?MINIO_SERVER_URL is required}
    ports:
      - "127.0.0.1:${MINIO_API_PORT:-9000}:9000"
      - "127.0.0.1:${MINIO_CONSOLE_PORT:-9001}:9001"
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9000/minio/health/live"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 30s
    stop_grace_period: 60s
    networks: [data]

  prometheus:
    image: prom/prometheus:v3.5.0
    restart: unless-stopped
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=${PROMETHEUS_RETENTION:-30d}
      - --storage.tsdb.wal-compression
      - --web.enable-lifecycle
    ports:
      - "127.0.0.1:${PROMETHEUS_PORT:-9090}:9090"
    volumes:
      - ../monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ../monitoring/prometheus/rules:/etc/prometheus/rules:ro
      - ../monitoring/prometheus/targets:/etc/prometheus/targets:ro
      - prometheus_data:/prometheus
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9090/-/healthy"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 20s
    depends_on:
      alertmanager:
        condition: service_started
      node-exporter:
        condition: service_started
      cadvisor:
        condition: service_started
      blackbox-exporter:
        condition: service_started
    networks: [monitoring]

  grafana:
    image: grafana/grafana:12.0.2
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:?GRAFANA_ADMIN_USER is required}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD is required}
      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:?GRAFANA_ROOT_URL is required}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      # Grafana is localhost-only and reached through an SSH tunnel.
      GF_SECURITY_COOKIE_SECURE: "false"
      GF_SECURITY_COOKIE_SAMESITE: strict
      GF_ANALYTICS_REPORTING_ENABLED: "false"
      GF_ANALYTICS_CHECK_FOR_UPDATES: "false"
      GF_LOG_MODE: console
    ports:
      - "127.0.0.1:${GRAFANA_PORT:-3000}:3000"
    volumes:
      - ../monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - grafana_data:/var/lib/grafana
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:3000/api/health"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 30s
    depends_on:
      prometheus:
        condition: service_healthy
      loki:
        condition: service_started
    networks: [monitoring]

  loki:
    image: grafana/loki:3.5.1
    restart: unless-stopped
    command: ["-config.file=/etc/loki/loki.yml"]
    ports:
      - "127.0.0.1:${LOKI_PORT:-3100}:3100"
    volumes:
      - ../monitoring/loki/loki.yml:/etc/loki/loki.yml:ro
      - loki_data:/loki
    networks: [monitoring]

  alloy:
    image: grafana/alloy:v1.9.1
    restart: unless-stopped
    command:
      - run
      - --server.http.listen-addr=0.0.0.0:12345
      - --storage.path=/var/lib/alloy/data
      - /etc/alloy/config.alloy
    ports:
      - "127.0.0.1:${ALLOY_PORT:-12345}:12345"
    volumes:
      - ../monitoring/alloy/config.alloy:/etc/alloy/config.alloy:ro
      - alloy_data:/var/lib/alloy/data
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/log/journal:/var/log/journal:ro
      - /run/log/journal:/run/log/journal:ro
      - /etc/machine-id:/etc/machine-id:ro
    depends_on:
      loki:
        condition: service_started
    networks: [monitoring]

  alertmanager:
    image: prom/alertmanager:v0.28.1
    restart: unless-stopped
    command:
      - --config.file=/etc/alertmanager/alertmanager.yml
      - --storage.path=/alertmanager
    ports:
      - "127.0.0.1:${ALERTMANAGER_PORT:-9093}:9093"
    volumes:
      - ../monitoring/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - ../monitoring/alertmanager/templates:/etc/alertmanager/templates:ro
      - alertmanager_data:/alertmanager
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9093/-/healthy"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 20s
    networks: [monitoring]

  node-exporter:
    image: prom/node-exporter:v1.9.1
    restart: unless-stopped
    command:
      - --path.procfs=/host/proc
      - --path.sysfs=/host/sys
      - --path.rootfs=/rootfs
      - --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)
      - --collector.textfile.directory=/var/lib/node_exporter/textfile_collector
    ports:
      - "127.0.0.1:${NODE_EXPORTER_PORT:-9100}:9100"
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro,rslave
      - ../backup/status:/var/lib/node_exporter/textfile_collector:ro
    read_only: true
    security_opt: [no-new-privileges:true]
    networks: [monitoring]

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.52.1
    restart: unless-stopped
    command: ["--docker_only=true", "--housekeeping_interval=30s"]
    ports:
      - "127.0.0.1:${CADVISOR_PORT:-8080}:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
    devices:
      - /dev/kmsg:/dev/kmsg
    privileged: true
    networks: [monitoring]

  blackbox-exporter:
    image: prom/blackbox-exporter:v0.27.0
    restart: unless-stopped
    command: ["--config.file=/etc/blackbox_exporter/blackbox.yml"]
    ports:
      - "127.0.0.1:${BLACKBOX_EXPORTER_PORT:-9115}:9115"
    volumes:
      - ../monitoring/blackbox/blackbox.yml:/etc/blackbox_exporter/blackbox.yml:ro
    read_only: true
    security_opt: [no-new-privileges:true]
    extra_hosts:
      - host.docker.internal:host-gateway
    networks: [monitoring]

volumes:
  mongo_data:
  mongo_config:
  redis_data:
  minio_data:
  prometheus_data:
  grafana_data:
  loki_data:
  alloy_data:
  alertmanager_data:

networks:
  data:
  monitoring: