spb/internetpressure

1# InternetPressure.io — production stack (BHS64b, OVH Beauharnois) and dev stores.2#3#   prod:  docker compose -f infra/compose.yml --env-file deploy/.env up -d --remove-orphans4#   dev:   docker compose -f infra/compose.yml --profile dev up -d clickhouse postgres redis   (stores only, host ports 5433/8124/6380)5#6# Public traffic arrives from the BHS64 gateway over WireGuard wg1: edge Caddy :8350 is bound to ${WG_IP} only.7# Nothing is bound to 0.0.0.0 in production. The stores are only reachable from the compose network.8name: ip910x-logging: &logging11  driver: json-file12  options: { max-size: "50m", max-file: "5" }1314x-app: &app15  image: ip/backend:${IP_TAG:-latest}16  build:17    context: ..18    dockerfile: infra/docker/Dockerfile.backend19  restart: unless-stopped20  logging: *logging21  environment: &app-env22    IP_ENV: production23    IP_LOG_LEVEL: ${IP_LOG_LEVEL:-info}24    IP_SITE_URL: ${IP_SITE_URL:-https://www.internetpressure.io}25    IP_PG_DSN: postgresql://ip:${POSTGRES_PASSWORD}@postgres:5432/ip26    IP_CH_URL: http://clickhouse:812327    IP_CH_DB: ip28    IP_CH_USER: ip29    IP_CH_PASSWORD: ${CLICKHOUSE_PASSWORD}30    IP_REDIS_URL: redis://redis:6379/031    IP_ADMIN_TOKEN: ${IP_ADMIN_TOKEN}32    IP_TRUST_PROXY: "true"33    IP_CONFIG_PATH: /app/packages/config/pressure.yaml34    IP_REGIONS_PATH: /app/data/regions.yaml35    IP_TARGETS_PATH: /app/data/targets/targets.yaml36    IP_SERVICES_PATH: /app/data/seed/services.yaml37    IP_PROBES_PATH: /app/data/seed/probes.yaml38    IP_DATA_DIR: /var/lib/ip39    IP_RELEASES_DIR: /releases40    IP_RIS_COLLECTORS: ${IP_RIS_COLLECTORS:-}41    IP_BGP_STORE_RAW: ${IP_BGP_STORE_RAW:-true}42    TZ: UTC43  volumes:44    - ip-data:/var/lib/ip45    - ./releases:/releases:ro46  depends_on:47    postgres: { condition: service_healthy }48    clickhouse: { condition: service_healthy }49    redis: { condition: service_healthy }5051services:52  # ───────────────────────────── edge (the only thing the gateway talks to)53  edge:54    image: caddy:2.10-alpine55    restart: unless-stopped56    logging: *logging57    ports:58      - "${WG_IP:-127.0.0.1}:8350:8350"59    volumes:60      - ./edge/Caddyfile:/etc/caddy/Caddyfile:ro61      - caddy-data:/data62    depends_on: [web, api]63    healthcheck:64      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8350/api/v1/status"]65      interval: 30s66      timeout: 5s67      retries: 368      start_period: 30s69    mem_limit: 256m7071  # ───────────────────────────── application72  web:73    image: ip/web:${IP_TAG:-latest}74    build:75      context: ..76      dockerfile: apps/web/Dockerfile77      args:78        NEXT_PUBLIC_SITE_URL: ${IP_SITE_URL:-https://www.internetpressure.io}79    restart: unless-stopped80    logging: *logging81    environment:82      NODE_ENV: production83      PORT: "8351"84      HOSTNAME: 0.0.0.085      API_URL: http://api:835286      API_URL_INTERNAL: http://api:835287      NEXT_PUBLIC_SITE_URL: ${IP_SITE_URL:-https://www.internetpressure.io}88      TZ: UTC89    depends_on: [api]90    mem_limit: 2g9192  api:93    <<: *app94    command: ["ip", "api"]95    cap_add: [SYS_PTRACE]   # lets `py-spy dump --pid 1` profile the process from `docker exec -u root`96    environment:97      <<: *app-env98      IP_API_PORT: "8352"99    healthcheck:100      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8352/api/v1/health', timeout=3).status==200 else 1)"]101      interval: 20s102      timeout: 5s103      retries: 3104      start_period: 40s105    mem_limit: 2g106107  engine:108    <<: *app109    command: ["ip", "engine"]110    mem_limit: 6g111112  bgp:113    <<: *app114    command: ["ip", "bgp"]115    mem_limit: 1g116117  corroboration:118    <<: *app119    command: ["ip", "corroboration"]120    mem_limit: 512m121122  migrate:123    <<: *app124    command: ["sh", "-c", "ip migrate && ip seed"]125    restart: "no"126    profiles: [ops]127128  cli:129    <<: *app130    entrypoint: ["ip"]131    restart: "no"132    profiles: [ops]133134  # ───────────────────────────── stores135  postgres:136    image: postgres:17-alpine137    restart: unless-stopped138    logging: *logging139    environment:140      POSTGRES_DB: ip141      POSTGRES_USER: ip142      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ip}143      TZ: UTC144    volumes:145      - pg-data:/var/lib/postgresql/data146    healthcheck:147      test: ["CMD-SHELL", "pg_isready -U ip -d ip"]148      interval: 10s149      timeout: 5s150      retries: 6151    mem_limit: 2g152153  clickhouse:154    image: clickhouse/clickhouse-server:25.8155    restart: unless-stopped156    logging: *logging157    ulimits:158      nofile: { soft: 262144, hard: 262144 }159    environment:160      CLICKHOUSE_DB: ip161      CLICKHOUSE_USER: ip162      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-ip}163      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"164      TZ: UTC165    volumes:166      - ch-data:/var/lib/clickhouse167      - ./clickhouse/config.d:/etc/clickhouse-server/config.d:ro168    healthcheck:169      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8123/ping"]170      interval: 10s171      timeout: 5s172      retries: 10173      start_period: 20s174    mem_limit: ${CLICKHOUSE_MEM:-20g}175176  redis:177    image: redis:7-alpine178    restart: unless-stopped179    logging: *logging180    command: ["redis-server", "--save", "60", "1000", "--appendonly", "no", "--maxmemory", "3gb", "--maxmemory-policy", "volatile-lru"]181    volumes:182      - redis-data:/data183    healthcheck:184      test: ["CMD", "redis-cli", "ping"]185      interval: 10s186      timeout: 3s187      retries: 5188    mem_limit: 3500m189190  # dev-only host port publication of the stores (profile "dev")191  dev-ports:192    image: alpine/socat:1.8.0.0193    profiles: [dev]194    command: ["-d", "TCP-LISTEN:1,fork,reuseaddr", "TCP:localhost:1"]195    network_mode: "service:postgres"196197volumes:198  pg-data:199  ch-data:200  redis-data:201  ip-data:202  caddy-data:203