docker-compose.yml - master - nasya/SafeDrop

docker-compose.yml
359 строк12 KB
nasya
Initial commit
24 май 2026, 16:12
24 май 2026, 16:1216bc032
name: safedrop

x-public-env: &public-env
  AUTH_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
  PUBLIC_AUTH_URL: ${PUBLIC_BASE_URL:-http://localhost}
  PUBLIC_HYDRA_URL: ${PUBLIC_BASE_URL:-http://localhost}
  PUBLIC_HYDRA_CLIENT_ID: ${PUBLIC_HYDRA_CLIENT_ID:-safedrop-web}
  HYDRA_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
  WEB_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}

x-db-env: &db-env
  DATABASE_URL: postgresql://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:-safedrop}@postgres:5432/${POSTGRES_DB:-safedrop}?options=-c%20search_path%3Dpublic

x-object-storage-env: &object-storage-env
  OBJECT_STORAGE_ENDPOINT: ${OBJECT_STORAGE_ENDPOINT:-http://minio:9000}
  OBJECT_STORAGE_PUBLIC_ENDPOINT: ${PUBLIC_BASE_URL:-http://localhost}
  OBJECT_STORAGE_REGION: ${OBJECT_STORAGE_REGION:-us-east-1}
  OBJECT_STORAGE_ACCESS_KEY: ${OBJECT_STORAGE_ACCESS_KEY:-safedrop}
  OBJECT_STORAGE_SECRET_KEY: ${OBJECT_STORAGE_SECRET_KEY:-safedrop-password}
  OBJECT_STORAGE_BUCKET: ${OBJECT_STORAGE_BUCKET:-safedrop-files}
  OBJECT_STORAGE_FORCE_PATH_STYLE: ${OBJECT_STORAGE_FORCE_PATH_STYLE:-true}

x-node-env: &node-env
  NODE_ENV: development
  NODE_OPTIONS: --conditions=development
  AUTH_MODE: ${AUTH_MODE:-hydra}
  SERVICE_SHARED_SECRET: ${SERVICE_SHARED_SECRET:-dev-service-secret-change-me}

x-node-dev: &node-dev
  image: safedrop-node-dev:latest
  build:
    context: .
    dockerfile: infra/docker/node-dev.Dockerfile
  working_dir: /repo

x-fastify-health: &fastify-health
  interval: 10s
  timeout: 5s
  retries: 20
  start_period: 10s

services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-safedrop}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-safedrop}
      POSTGRES_DB: ${POSTGRES_DB:-safedrop}
    ports:
      - "5432:5432"
    volumes:
      - safedrop-postgres-dev:/var/lib/postgresql
      - ./infra/docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-safedrop} -d ${POSTGRES_DB:-safedrop}"]
      interval: 10s
      timeout: 5s
      retries: 10

  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${OBJECT_STORAGE_ACCESS_KEY:-safedrop}
      MINIO_ROOT_PASSWORD: ${OBJECT_STORAGE_SECRET_KEY:-safedrop-password}
      MINIO_API_CORS_ALLOW_ORIGIN: ${PUBLIC_BASE_URL:-http://localhost},http://127.0.0.1,http://localhost:5173,http://127.0.0.1:5173
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - safedrop-minio-dev:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 10

  minio-init:
    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
    entrypoint: ["/bin/sh"]
    command:
      - -ec
      - |
        mc alias set local http://minio:9000 ${OBJECT_STORAGE_ACCESS_KEY:-safedrop} ${OBJECT_STORAGE_SECRET_KEY:-safedrop-password}
        mc mb --ignore-existing local/${OBJECT_STORAGE_BUCKET:-safedrop-files}
        mc anonymous set none local/${OBJECT_STORAGE_BUCKET:-safedrop-files}
    depends_on:
      minio:
        condition: service_healthy

  node-deps:
    <<: *node-dev
    command: bun run --cwd packages/db db:generate

  safedrop-migrate:
    <<: *node-dev
    command: bun run --cwd packages/db db:migrate:deploy
    environment:
      <<: [*node-env, *db-env]
    depends_on:
      node-deps:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy

  maildev:
    image: maildev/maildev:2.1.0
    ports:
      - "1080:1080"
      - "1025:1025"

  kratos-migrate:
    image: oryd/kratos:v1.2.0
    command: migrate sql -e --yes
    environment:
      DSN: postgres://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:-safedrop}@postgres:5432/${POSTGRES_DB:-safedrop}?sslmode=disable&search_path=kratos
    volumes:
      - ./infra/docker/ory/kratos:/etc/config/kratos:ro
    depends_on:
      postgres:
        condition: service_healthy

  kratos:
    image: oryd/kratos:v1.2.0
    entrypoint: ["sh", "-c"]
    command:
      - sh /usr/local/bin/render-config.sh /etc/config/kratos/kratos.yml /tmp/kratos.yml && kratos serve --dev --config /tmp/kratos.yml
    environment:
      DSN: postgres://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:-safedrop}@postgres:5432/${POSTGRES_DB:-safedrop}?sslmode=disable&search_path=kratos
      COURIER_SMTP_CONNECTION_URI: smtp://maildev:1025/?disable_starttls=true
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-replace-me}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-replace-me}
      YANDEX_CLIENT_ID: ${YANDEX_CLIENT_ID:-replace-me}
      YANDEX_CLIENT_SECRET: ${YANDEX_CLIENT_SECRET:-replace-me}
      AUTH_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
      WEB_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
      KRATOS_COOKIE_SECRET: ${KRATOS_COOKIE_SECRET:-dev-kratos-cookie-secret-change-me}
      KRATOS_CIPHER_SECRET: ${KRATOS_CIPHER_SECRET:-32-byte-long-dev-cipher-secret-1}
      KRATOS_LOG_LEVEL: debug
      KRATOS_LEAK_SENSITIVE_VALUES: "true"
      TELEGRAM_OIDC_ISSUER_URL: http://telegram-oidc-bridge:3005
    ports:
      - "4433:4433"
      - "4434:4434"
    volumes:
      - ./infra/docker/ory/kratos:/etc/config/kratos:ro
      - ./infra/docker/ory/render-config.sh:/usr/local/bin/render-config.sh:ro
    depends_on:
      kratos-migrate:
        condition: service_completed_successfully
      telegram-oidc-bridge:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4434/health/ready"]
      interval: 10s
      timeout: 5s
      retries: 20

  hydra-migrate:
    image: oryd/hydra:v2.2.0
    command: migrate sql -e --yes
    environment:
      DSN: postgres://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:-safedrop}@postgres:5432/${POSTGRES_DB:-safedrop}?sslmode=disable&search_path=hydra
    depends_on:
      postgres:
        condition: service_healthy

  hydra:
    image: oryd/hydra:v2.2.0
    entrypoint: ["sh", "-c"]
    command:
      - sh /usr/local/bin/render-config.sh /etc/config/hydra/hydra.yml /tmp/hydra.yml && hydra serve all --dev --config /tmp/hydra.yml
    environment:
      DSN: postgres://${POSTGRES_USER:-safedrop}:${POSTGRES_PASSWORD:-safedrop}@postgres:5432/${POSTGRES_DB:-safedrop}?sslmode=disable&search_path=hydra
      SECRETS_SYSTEM: ${SECRETS_SYSTEM:-dev-hydra-system-secret-change-me}
      URLS_SELF_ISSUER: ${PUBLIC_BASE_URL:-http://localhost}
      URLS_LOGIN: ${PUBLIC_BASE_URL:-http://localhost}/login
      URLS_CONSENT: ${PUBLIC_BASE_URL:-http://localhost}/consent
      WEB_PUBLIC_URL: ${PUBLIC_BASE_URL:-http://localhost}
      HYDRA_LOG_LEVEL: debug
      HYDRA_EXPOSE_INTERNAL_ERRORS: "true"
    ports:
      - "4444:4444"
      - "4445:4445"
    volumes:
      - ./infra/docker/ory/hydra:/etc/config/hydra:ro
      - ./infra/docker/ory/render-config.sh:/usr/local/bin/render-config.sh:ro
    depends_on:
      hydra-migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4445/health/ready"]
      interval: 10s
      timeout: 5s
      retries: 20

  hydra-client-init:
    <<: *node-dev
    command: bun run hydra:init-client
    environment:
      <<: [*node-env, *public-env]
      HYDRA_ADMIN_URL: http://hydra:4445
      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost}
    depends_on:
      node-deps:
        condition: service_completed_successfully
      hydra:
        condition: service_healthy

  telegram-oidc-bridge:
    <<: *node-dev
    command: bun run --cwd apps/telegram-oidc-bridge dev
    environment:
      <<: [*node-env]
      TELEGRAM_BRIDGE_PUBLIC_URL: http://telegram-oidc-bridge:3005
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
    ports:
      - "3005:3005"
    depends_on:
      node-deps:
        condition: service_completed_successfully
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3005/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  api-gateway:
    <<: *node-dev
    command: bun run --cwd apps/api-gateway dev
    environment:
      <<: [*node-env, *public-env]
      FILE_SERVICE_URL: http://file-service:3001
      KEY_SERVICE_URL: http://key-service:3002
      SHARE_SERVICE_URL: http://share-service:3003
      HYDRA_ADMIN_URL: http://hydra:4445
    ports:
      - "8080:8080"
    depends_on:
      hydra-client-init:
        condition: service_completed_successfully
      key-service:
        condition: service_healthy
      file-service:
        condition: service_healthy
      share-service:
        condition: service_healthy
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  file-service:
    <<: *node-dev
    command: bun run --cwd apps/file-service dev
    environment:
      <<: [*node-env, *db-env, *object-storage-env]
    ports:
      - "3001:3001"
    depends_on:
      safedrop-migrate:
        condition: service_completed_successfully
      minio-init:
        condition: service_completed_successfully
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3001/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  key-service:
    <<: *node-dev
    command: bun run --cwd apps/key-service dev
    environment:
      <<: [*node-env, *db-env]
    ports:
      - "3002:3002"
    depends_on:
      safedrop-migrate:
        condition: service_completed_successfully
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3002/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  share-service:
    <<: *node-dev
    command: bun run --cwd apps/share-service dev
    environment:
      <<: [*node-env, *db-env, *object-storage-env]
      SHARE_CLEANUP_LIMIT: ${SHARE_CLEANUP_LIMIT:-100}
      SHARE_CLEANUP_INTERVAL_SECONDS: ${SHARE_CLEANUP_INTERVAL_SECONDS:-60}
    ports:
      - "3003:3003"
    depends_on:
      safedrop-migrate:
        condition: service_completed_successfully
      minio-init:
        condition: service_completed_successfully
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3003/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  auth-ui:
    <<: *node-dev
    command: bun run --cwd apps/auth-ui dev
    environment:
      <<: [*node-env, *public-env, *db-env]
      KRATOS_INTERNAL_URL: http://kratos:4433
      HYDRA_ADMIN_URL: http://hydra:4445
    ports:
      - "3004:3004"
    depends_on:
      safedrop-migrate:
        condition: service_completed_successfully
      kratos:
        condition: service_healthy
      hydra:
        condition: service_healthy
    healthcheck:
      <<: *fastify-health
      test: ["CMD", "node", "-e", "fetch('http://localhost:3004/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

  web-app:
    <<: *node-dev
    command: bun run --cwd apps/web dev
    environment:
      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost}
      PUBLIC_API_URL: ${PUBLIC_BASE_URL:-http://localhost}
      PUBLIC_AUTH_URL: ${PUBLIC_BASE_URL:-http://localhost}
      PUBLIC_HYDRA_URL: ${PUBLIC_BASE_URL:-http://localhost}
      PUBLIC_HYDRA_CLIENT_ID: ${PUBLIC_HYDRA_CLIENT_ID:-safedrop-web}
    ports:
      - "5173:5173"
    depends_on:
      api-gateway:
        condition: service_healthy

  reverse-proxy:
    image: traefik:v3
    command:
      - --entrypoints.web.address=:80
      - --providers.file.filename=/etc/traefik/dynamic.yml
      - --providers.file.watch=true
      - --api.dashboard=false
      - --log.level=INFO
    ports:
      - "80:80"
    volumes:
      - ./infra/docker/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
    depends_on:
      web-app:
        condition: service_started
      api-gateway:
        condition: service_healthy
      auth-ui:
        condition: service_healthy
      hydra:
        condition: service_healthy
      minio:
        condition: service_healthy

volumes:
  safedrop-postgres-dev:
  safedrop-minio-dev: