groundwork/compose.yaml at main · ARSHIYASHAFIZADE/groundwork · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
# Local dev services for groundwork (task 005). Dev-only credentials match
# the Settings defaults in src/groundwork/config.py — never reuse in prod.
# Ports bind to 127.0.0.1 only; tests/test_compose_safety.py enforces this,
# pinned image tags, no privileged mode, healthchecks, and named volumes.
name: groundwork

services:
  postgres:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_USER: groundwork
      POSTGRES_PASSWORD: groundwork
      POSTGRES_DB: groundwork
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U groundwork -d groundwork"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s

  redis:
    image: redis:7-alpine
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  # --- observability profile (task 041, ADR 0024) ---------------------------
  # Opt-in: `docker compose --profile observability up -d`. Nothing below starts
  # with a plain `docker compose up`, so the default dev loop stays two
  # containers. Both scrape/serve on loopback only and hold no credentials.
  #
  # Config files arrive as compose `configs` (read-only, defined at the bottom
  # of this file) rather than bind mounts: tests/test_compose_safety.py forbids
  # host bind mounts, and a config cannot be written back to the repo by a
  # container.
  prometheus:
    image: prom/prometheus:v2.53.3
    profiles: ["observability"]
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=15d
      # No --web.enable-admin-api and no --web.enable-lifecycle: nothing on the
      # box should be able to delete series or reload config over HTTP.
      - --web.listen-address=0.0.0.0:9090
    ports:
      - "127.0.0.1:9090:9090"
    # The API is not a compose service — it runs on the host under uvicorn — so
    # the scrape target in ops/prometheus/prometheus.yml resolves through the
    # host gateway.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    configs:
      - source: prometheus-config
        target: /etc/prometheus/prometheus.yml
    volumes:
      - prometheus-data:/prometheus
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9090/-/healthy"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s

  grafana:
    image: grafana/grafana:11.3.0
    profiles: ["observability"]
    depends_on:
      prometheus:
        condition: service_healthy
    environment:
      # No credentials are set here (CLAUDE.md #2): Grafana keeps its stock
      # admin/admin and forces a password change at first login, on a port that
      # is only reachable from this machine. Never expose this profile publicly.
      GF_ANALYTICS_REPORTING_ENABLED: "false"
      GF_ANALYTICS_CHECK_FOR_UPDATES: "false"
      GF_USERS_ALLOW_SIGN_UP: "false"
    ports:
      - "127.0.0.1:3000:3000"
    configs:
      - source: grafana-datasource
        target: /etc/grafana/provisioning/datasources/prometheus.yml
      - source: grafana-dashboard-provider
        target: /etc/grafana/provisioning/dashboards/groundwork.yml
      - source: grafana-dashboard-groundwork
        target: /etc/grafana/dashboards/groundwork.json
    volumes:
      - grafana-data:/var/lib/grafana
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://localhost:3000/api/health || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 15s

configs:
  prometheus-config:
    file: ./ops/prometheus/prometheus.yml
  grafana-datasource:
    file: ./ops/grafana/provisioning/datasources/prometheus.yml
  grafana-dashboard-provider:
    file: ./ops/grafana/provisioning/dashboards/groundwork.yml
  grafana-dashboard-groundwork:
    file: ./ops/grafana/dashboards/groundwork.json

volumes:
  postgres-data:
  redis-data:
  prometheus-data:
  grafana-data: