influencemap/compose.opensearch.yaml at master · csmetrics/influencemap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# Standalone OpenSearch for the dedicated search server.
#
# Deploy:
#   docker compose -f compose.opensearch.yaml up -d
#
# All server-specific values come from a local `.env` file next to this
# compose file (untracked — git pull can never clobber it):
#
#   # .env example (sudo-less deployment on a shared server):
#   OPENSEARCH_DATA=/data5/opensearch
#   OPENSEARCH_BIND=127.0.0.1          # localhost-only + SSH tunnel from webapp
#   OPENSEARCH_PORT=9201
#   OPENSEARCH_ALLOW_MMAP=true         # set false if vm.max_map_count < 262144
#                                      #   and you can't get an admin to raise it
#
# Leave OPENSEARCH_UID/GID unset: the image's entrypoint and config
# files are owned by uid 1000 with 750 perms, so running as any other
# uid fails with "Permission denied" (no group-0 convention in this
# image). Instead run as the default 1000:1000 and make the data dir
# accessible to it: chmod -R o+rwX $OPENSEARCH_DATA. Tradeoff on a
# shared host: data is world-readable/writable, and files the
# container creates are owned by uid 1000 (extract later via
# docker-group tar streaming if needed).
#
# Prerequisites WITHOUT sudo:
#   - membership in the `docker` group (ask admin — the one hard requirement)
#   - vm.max_map_count >= 262144 (check: cat /proc/sys/vm/max_map_count;
#     if too low and no admin: OPENSEARCH_ALLOW_MMAP=false)
#   - mkdir -p $OPENSEARCH_DATA  (owned by your own account)

services:
  opensearch:
    image: opensearchproject/opensearch:2.11.1
    restart: unless-stopped
    user: "${OPENSEARCH_UID:-1000}:${OPENSEARCH_GID:-1000}"
    environment:
      - discovery.type=single-node
      # No auth — bind to localhost/tailnet only; never a public interface.
      - DISABLE_SECURITY_PLUGIN=true
      - DISABLE_INSTALL_DEMO_CONFIG=true
      - "OPENSEARCH_JAVA_OPTS=-Xms8g -Xmx8g"
      - node.store.allow_mmap=${OPENSEARCH_ALLOW_MMAP:-true}
      - cluster.routing.allocation.disk.watermark.low=95%
      - cluster.routing.allocation.disk.watermark.high=97%
      - cluster.routing.allocation.disk.watermark.flood_stage=98%
    ulimits:
      nofile: { soft: 65536, hard: 65536 }
    volumes:
      - ${OPENSEARCH_DATA:?set OPENSEARCH_DATA in .env}:/usr/share/opensearch/data
    ports:
      # Bind address decides exposure:
      #   127.0.0.1  -> localhost only; reach it via SSH tunnel (no sudo,
      #                 no firewall, no tailscale needed on this host)
      #   <tailscale ip> -> tailnet only (needs tailscaled running)
      - "${OPENSEARCH_BIND:?set OPENSEARCH_BIND in .env}:${OPENSEARCH_PORT:-9201}:9200"