Signals/examples/docker-compose.yml at main · Elevarq/Signals · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
# Elevarq Signals quick start (LOCAL DEV ONLY)
#
# This compose file is for local development. SIGNALS_ENV=dev so the
# weak-token rule (#135 / config.WeakAPITokenReason) emits a
# WARNING and lets the deployment start. In SIGNALS_ENV=prod the same
# token would HARD-FAIL startup. Production deployments MUST mint
# a strong token (e.g. `openssl rand -base64 32`) and supply it
# via SIGNALS_API_TOKEN_FILE or a Kubernetes Secret — see
# docs/security/access-control.md.
#
# Start Elevarq Signals alongside a PostgreSQL 16 instance:
#   docker compose -f examples/docker-compose.yml up -d
#
# Trigger a collection (dev-only token shown):
#   curl -X POST http://localhost:8081/collect/now \
#     -H "Authorization: Bearer dev-local-only-replace-in-prod-32chars"
#
# Export snapshots:
#   curl -o snapshot.zip http://localhost:8081/export \
#     -H "Authorization: Bearer dev-local-only-replace-in-prod-32chars"

services:
  signals:
    build:
      context: ..
      dockerfile: Dockerfile
    environment:
      SIGNALS_TARGET_HOST: postgres
      SIGNALS_TARGET_PORT: "5432"
      SIGNALS_TARGET_USER: signals
      SIGNALS_TARGET_DBNAME: postgres
      SIGNALS_TARGET_PASSWORD_ENV: PG_PASSWORD
      PG_PASSWORD: monitor_pass
      SIGNALS_POLL_INTERVAL: 1m
      # Dev-only API token. The 39-char value passes the #135 strength
      # validator AND is obviously a placeholder. Replace before any
      # production use — see docs/security/access-control.md.
      SIGNALS_API_TOKEN: dev-local-only-replace-in-prod-32chars
      # Default listen addr is 127.0.0.1 (safe); in the dev stack we
      # need it reachable via the port mapping, hence 0.0.0.0.
      SIGNALS_LISTEN_ADDR: "0.0.0.0:8081"
      SIGNALS_ALLOW_INSECURE_PG_TLS: "true"
      SIGNALS_ENV: dev
    ports:
      - "8081:8081"
    volumes:
      - signals-data:/data
    depends_on:
      postgres:
        condition: service_healthy

  postgres:
    image: postgres:16-alpine
    # Preload pg_stat_statements so init.sql's CREATE EXTENSION works
    # and the Elevarq Signals pg_stat_statements_v1 / pgss_reset_check_v1
    # collectors can actually read the view.
    command: ["postgres", "-c", "shared_preload_libraries=pg_stat_statements"]
    environment:
      POSTGRES_PASSWORD: postgres_pass
      POSTGRES_DB: postgres
    ports:
      - "5432:5432"
    volumes:
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 3s
      retries: 5

volumes:
  signals-data: