gabriel / musehub public
docker-compose.yml yaml
143 lines 3.9 KB
Raw
sha256:9590cee1e0ccd6c76528f005b95d634d80f5019f0dcb7c371e149adc31d1fb65 refactor: enforce gRPC framing on all MWP wire traffic Sonnet 4.6 minor ⚠ breaking 153 days ago
1 networks:
2 musehub-internal:
3 driver: bridge
4
5 services:
6 musehub:
7 build:
8 context: ..
9 dockerfile: musehub/Dockerfile
10 container_name: musehub
11 ports:
12 - "127.0.0.1:1337:1337"
13 env_file: .env
14 environment:
15 DATABASE_URL: "postgresql+asyncpg://musehub:${DB_PASSWORD:-musehub}@postgres:5432/musehub"
16 volumes:
17 - musehub_data:/data
18 # /tmp writable for uvicorn temp files; root filesystem is read-only.
19 - type: tmpfs
20 target: /tmp
21 # TLS cert for local HTTPS — enables HTTP/2 without a reverse proxy.
22 - ./deploy/local-tls:/tls:ro
23 depends_on:
24 postgres:
25 condition: service_healthy
26 networks:
27 - musehub-internal
28 restart: unless-stopped
29 # Read-only root filesystem — prevents code injection and log-file exfiltration.
30 # Explicit writable mounts: /data (object store, named volume) and /tmp (tmpfs).
31 read_only: true
32 deploy:
33 resources:
34 limits:
35 # 1 vCPU cap prevents a runaway request from starving nginx/postgres.
36 cpus: "1.0"
37 # 512 MiB covers normal operation with headroom; MemoryLogMiddleware
38 # warns at 400 MiB so we get notice before hitting the hard limit.
39 memory: 512M
40 reservations:
41 cpus: "0.25"
42 memory: 128M
43
44 worker:
45 build:
46 context: ..
47 dockerfile: musehub/Dockerfile
48 container_name: musehub_worker
49 command: ["python", "-m", "musehub.worker"]
50 env_file: .env
51 environment:
52 DATABASE_URL: "postgresql+asyncpg://musehub:${DB_PASSWORD:-musehub}@postgres:5432/musehub"
53 WORKER_POLL_INTERVAL: "1.0"
54 volumes:
55 - musehub_data:/data
56 - type: tmpfs
57 target: /tmp
58 depends_on:
59 postgres:
60 condition: service_healthy
61 healthcheck:
62 test: ["CMD-SHELL", "pgrep -f 'musehub.worker' > /dev/null || exit 1"]
63 interval: 30s
64 timeout: 5s
65 start_period: 15s
66 retries: 3
67 networks:
68 - musehub-internal
69 restart: unless-stopped
70 read_only: true
71 deploy:
72 resources:
73 limits:
74 # Worker may use more memory than the web process — symbol indexing
75 # loads commit graphs into memory. 2 GiB covers the largest repos.
76 cpus: "1.0"
77 memory: 2048M
78 reservations:
79 cpus: "0.1"
80 memory: 128M
81
82 postgres:
83 image: postgres:16-alpine
84 container_name: musehub_postgres
85 environment:
86 POSTGRES_DB: musehub
87 POSTGRES_USER: musehub
88 POSTGRES_PASSWORD: "${DB_PASSWORD:-musehub}"
89 volumes:
90 - postgres_data:/var/lib/postgresql/data
91 healthcheck:
92 test: ["CMD-SHELL", "pg_isready -U musehub -d musehub"]
93 interval: 5s
94 timeout: 5s
95 retries: 10
96 networks:
97 - musehub-internal
98 restart: unless-stopped
99 # Expose on 5434 (not 5432/5433) to avoid colliding with a locally-installed
100 # Postgres or another project's container (e.g. agentception uses 5433).
101 # This lets the local test suite and Alembic CLI reach the DB directly:
102 # DATABASE_URL=postgresql+asyncpg://musehub:musehub@localhost:5434/musehub
103 # make test (the Makefile sets this automatically)
104 # alembic upgrade head
105 ports:
106 - "127.0.0.1:5434:5432"
107 deploy:
108 resources:
109 limits:
110 cpus: "0.5"
111 memory: 256M
112 reservations:
113 cpus: "0.1"
114 memory: 64M
115
116 musehub-runner:
117 image: docker:24-dind
118 container_name: musehub_runner
119 privileged: true
120 env_file: .env
121 environment:
122 RUNNER_TOKEN: "${RUNNER_TOKEN:-}"
123 MUSEHUB_URL: "http://musehub:1337"
124 volumes:
125 - type: tmpfs
126 target: /tmp
127 depends_on:
128 - musehub
129 networks:
130 - musehub-internal
131 restart: unless-stopped
132 deploy:
133 resources:
134 limits:
135 cpus: "2.0"
136 memory: 1024M
137 reservations:
138 cpus: "0.25"
139 memory: 256M
140
141 volumes:
142 musehub_data:
143 postgres_data:
File History 1 commit
sha256:9590cee1e0ccd6c76528f005b95d634d80f5019f0dcb7c371e149adc31d1fb65 refactor: enforce gRPC framing on all MWP wire traffic Sonnet 4.6 minor ⚠ 153 days ago