gabriel / musehub public
docker-compose.yml yaml
148 lines 4.2 KB
Raw
sha256:a34090cc4a394a78bd72cbbe34b08cc59525141e19135b6c0ab154f10611b9ef debug(push/stream): instrument O-frame decode path with INF… Sonnet 4.6 patch 121 days ago
1 networks:
2 musehub-internal:
3 driver: bridge
4
5 services:
6 musehub:
7 build:
8 context: ..
9 dockerfile: musehub/Dockerfile
10 image: musehub/musehub
11 container_name: musehub
12 ports:
13 - "127.0.0.1:1337:1337"
14 env_file: .env
15 environment:
16 DATABASE_URL: "postgresql+asyncpg://musehub:${DB_PASSWORD:-musehub}@postgres:5432/musehub"
17 volumes:
18 - musehub_data:/data
19 # /tmp writable for uvicorn temp files; root filesystem is read-only.
20 - type: tmpfs
21 target: /tmp
22 # TLS cert for local HTTPS — enables HTTP/2 without a reverse proxy.
23 # Certs live outside the repo at ~/.config/musehub/local-tls/ so they
24 # survive repo cleans, checkouts, and directory recreations.
25 # First-time setup: mkcert localhost 127.0.0.1 ::1 (run in that dir).
26 - ${HOME}/.config/musehub/local-tls:/tls:ro
27 depends_on:
28 postgres:
29 condition: service_healthy
30 networks:
31 - musehub-internal
32 restart: unless-stopped
33 # Read-only root filesystem — prevents code injection and log-file exfiltration.
34 # Explicit writable mounts: /data (object store, named volume) and /tmp (tmpfs).
35 read_only: true
36 deploy:
37 resources:
38 limits:
39 # 1 vCPU cap prevents a runaway request from starving nginx/postgres.
40 cpus: "1.0"
41 # 512 MiB covers normal operation with headroom; MemoryLogMiddleware
42 # warns at 400 MiB so we get notice before hitting the hard limit.
43 memory: 512M
44 reservations:
45 cpus: "0.25"
46 memory: 128M
47
48 worker:
49 build:
50 context: ..
51 dockerfile: musehub/Dockerfile
52 image: musehub/musehub
53 container_name: musehub_worker
54 command: ["python", "-m", "musehub.worker"]
55 env_file: .env
56 environment:
57 DATABASE_URL: "postgresql+asyncpg://musehub:${DB_PASSWORD:-musehub}@postgres:5432/musehub"
58 WORKER_POLL_INTERVAL: "1.0"
59 volumes:
60 - musehub_data:/data
61 - type: tmpfs
62 target: /tmp
63 depends_on:
64 postgres:
65 condition: service_healthy
66 healthcheck:
67 test: ["CMD-SHELL", "pgrep -f 'musehub.worker' > /dev/null || exit 1"]
68 interval: 30s
69 timeout: 5s
70 start_period: 15s
71 retries: 3
72 networks:
73 - musehub-internal
74 restart: unless-stopped
75 read_only: true
76 deploy:
77 resources:
78 limits:
79 # Worker may use more memory than the web process — symbol indexing
80 # loads commit graphs into memory. 2 GiB covers the largest repos.
81 cpus: "1.0"
82 memory: 2048M
83 reservations:
84 cpus: "0.1"
85 memory: 128M
86
87 postgres:
88 image: postgres:16-alpine
89 container_name: musehub_postgres
90 environment:
91 POSTGRES_DB: musehub
92 POSTGRES_USER: musehub
93 POSTGRES_PASSWORD: "${DB_PASSWORD:-musehub}"
94 volumes:
95 - postgres_data:/var/lib/postgresql/data
96 healthcheck:
97 test: ["CMD-SHELL", "pg_isready -U musehub -d musehub"]
98 interval: 5s
99 timeout: 5s
100 retries: 10
101 networks:
102 - musehub-internal
103 restart: unless-stopped
104 # Expose on 5434 (not 5432/5433) to avoid colliding with a locally-installed
105 # Postgres or another project's container (e.g. agentception uses 5433).
106 # This lets the local test suite and Alembic CLI reach the DB directly:
107 # DATABASE_URL=postgresql+asyncpg://musehub:musehub@localhost:5434/musehub
108 # make test (the Makefile sets this automatically)
109 # alembic upgrade head
110 ports:
111 - "127.0.0.1:5434:5432"
112 deploy:
113 resources:
114 limits:
115 cpus: "0.5"
116 memory: 256M
117 reservations:
118 cpus: "0.1"
119 memory: 64M
120
121 musehub-runner:
122 image: docker:24-dind
123 container_name: musehub_runner
124 privileged: true
125 env_file: .env
126 environment:
127 RUNNER_TOKEN: "${RUNNER_TOKEN:-}"
128 MUSEHUB_URL: "http://musehub:1337"
129 volumes:
130 - type: tmpfs
131 target: /tmp
132 depends_on:
133 - musehub
134 networks:
135 - musehub-internal
136 restart: unless-stopped
137 deploy:
138 resources:
139 limits:
140 cpus: "2.0"
141 memory: 1024M
142 reservations:
143 cpus: "0.25"
144 memory: 256M
145
146 volumes:
147 musehub_data:
148 postgres_data:
File History 1 commit
sha256:a34090cc4a394a78bd72cbbe34b08cc59525141e19135b6c0ab154f10611b9ef debug(push/stream): instrument O-frame decode path with INF… Sonnet 4.6 patch 121 days ago