spb/internetpressure
Public
1# InternetPressure.io — production stack (BHS64b, OVH Beauharnois) and dev stores.2#3# prod: docker compose -f infra/compose.yml --env-file deploy/.env up -d --remove-orphans4# dev: docker compose -f infra/compose.yml --profile dev up -d clickhouse postgres redis (stores only, host ports 5433/8124/6380)5#6# Public traffic arrives from the BHS64 gateway over WireGuard wg1: edge Caddy :8350 is bound to ${WG_IP} only.7# Nothing is bound to 0.0.0.0 in production. The stores are only reachable from the compose network.8name: ip910x-logging: &logging11 driver: json-file12 options: { max-size: "50m", max-file: "5" }1314x-app: &app15 image: ip/backend:${IP_TAG:-latest}16 build:17 context: ..18 dockerfile: infra/docker/Dockerfile.backend19 restart: unless-stopped20 logging: *logging21 environment: &app-env22 IP_ENV: production23 IP_LOG_LEVEL: ${IP_LOG_LEVEL:-info}24 IP_SITE_URL: ${IP_SITE_URL:-https://www.internetpressure.io}25 IP_PG_DSN: postgresql://ip:${POSTGRES_PASSWORD}@postgres:5432/ip26 IP_CH_URL: http://clickhouse:812327 IP_CH_DB: ip28 IP_CH_USER: ip29 IP_CH_PASSWORD: ${CLICKHOUSE_PASSWORD}30 IP_REDIS_URL: redis://redis:6379/031 IP_ADMIN_TOKEN: ${IP_ADMIN_TOKEN}32 IP_TRUST_PROXY: "true"33 IP_CONFIG_PATH: /app/packages/config/pressure.yaml34 IP_REGIONS_PATH: /app/data/regions.yaml35 IP_TARGETS_PATH: /app/data/targets/targets.yaml36 IP_SERVICES_PATH: /app/data/seed/services.yaml37 IP_PROBES_PATH: /app/data/seed/probes.yaml38 IP_DATA_DIR: /var/lib/ip39 IP_RELEASES_DIR: /releases40 IP_RIS_COLLECTORS: ${IP_RIS_COLLECTORS:-}41 IP_BGP_STORE_RAW: ${IP_BGP_STORE_RAW:-true}42 TZ: UTC43 volumes:44 - ip-data:/var/lib/ip45 - ./releases:/releases:ro46 depends_on:47 postgres: { condition: service_healthy }48 clickhouse: { condition: service_healthy }49 redis: { condition: service_healthy }5051services:52 # ───────────────────────────── edge (the only thing the gateway talks to)53 edge:54 image: caddy:2.10-alpine55 restart: unless-stopped56 logging: *logging57 ports:58 - "${WG_IP:-127.0.0.1}:8350:8350"59 volumes:60 - ./edge/Caddyfile:/etc/caddy/Caddyfile:ro61 - caddy-data:/data62 depends_on: [web, api]63 healthcheck:64 test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8350/api/v1/status"]65 interval: 30s66 timeout: 5s67 retries: 368 start_period: 30s69 mem_limit: 256m7071 # ───────────────────────────── application72 web:73 image: ip/web:${IP_TAG:-latest}74 build:75 context: ..76 dockerfile: apps/web/Dockerfile77 args:78 NEXT_PUBLIC_SITE_URL: ${IP_SITE_URL:-https://www.internetpressure.io}79 restart: unless-stopped80 logging: *logging81 environment:82 NODE_ENV: production83 PORT: "8351"84 HOSTNAME: 0.0.0.085 API_URL: http://api:835286 API_URL_INTERNAL: http://api:835287 NEXT_PUBLIC_SITE_URL: ${IP_SITE_URL:-https://www.internetpressure.io}88 TZ: UTC89 depends_on: [api]90 mem_limit: 2g9192 api:93 <<: *app94 command: ["ip", "api"]95 environment:96 <<: *app-env97 IP_API_PORT: "8352"98 healthcheck:99 test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8352/api/v1/health', timeout=3).status==200 else 1)"]100 interval: 20s101 timeout: 5s102 retries: 3103 start_period: 40s104 mem_limit: 2g105106 engine:107 <<: *app108 command: ["ip", "engine"]109 mem_limit: 2g110111 bgp:112 <<: *app113 command: ["ip", "bgp"]114 mem_limit: 1g115116 corroboration:117 <<: *app118 command: ["ip", "corroboration"]119 mem_limit: 512m120121 migrate:122 <<: *app123 command: ["sh", "-c", "ip migrate && ip seed"]124 restart: "no"125 profiles: [ops]126127 cli:128 <<: *app129 entrypoint: ["ip"]130 restart: "no"131 profiles: [ops]132133 # ───────────────────────────── stores134 postgres:135 image: postgres:17-alpine136 restart: unless-stopped137 logging: *logging138 environment:139 POSTGRES_DB: ip140 POSTGRES_USER: ip141 POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ip}142 TZ: UTC143 volumes:144 - pg-data:/var/lib/postgresql/data145 healthcheck:146 test: ["CMD-SHELL", "pg_isready -U ip -d ip"]147 interval: 10s148 timeout: 5s149 retries: 6150 mem_limit: 2g151152 clickhouse:153 image: clickhouse/clickhouse-server:25.8154 restart: unless-stopped155 logging: *logging156 ulimits:157 nofile: { soft: 262144, hard: 262144 }158 environment:159 CLICKHOUSE_DB: ip160 CLICKHOUSE_USER: ip161 CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-ip}162 CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"163 TZ: UTC164 volumes:165 - ch-data:/var/lib/clickhouse166 - ./clickhouse/config.d:/etc/clickhouse-server/config.d:ro167 healthcheck:168 test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8123/ping"]169 interval: 10s170 timeout: 5s171 retries: 10172 start_period: 20s173 mem_limit: ${CLICKHOUSE_MEM:-12g}174175 redis:176 image: redis:7-alpine177 restart: unless-stopped178 logging: *logging179 command: ["redis-server", "--save", "60", "1000", "--appendonly", "no", "--maxmemory", "512mb", "--maxmemory-policy", "allkeys-lru"]180 volumes:181 - redis-data:/data182 healthcheck:183 test: ["CMD", "redis-cli", "ping"]184 interval: 10s185 timeout: 3s186 retries: 5187 mem_limit: 768m188189 # dev-only host port publication of the stores (profile "dev")190 dev-ports:191 image: alpine/socat:1.8.0.0192 profiles: [dev]193 command: ["-d", "TCP-LISTEN:1,fork,reuseaddr", "TCP:localhost:1"]194 network_mode: "service:postgres"195196volumes:197 pg-data:198 ch-data:199 redis-data:200 ip-data:201 caddy-data:202