compose.yaml

name: clavis
services:
  db:
    image: postgres:18.6@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
    environment:
      POSTGRES_USER: clavis
      POSTGRES_PASSWORD: clavis-local-only
      POSTGRES_DB: clavis
    ports:
      - "127.0.0.1:${CLAVIS_DB_PORT:-5432}:5432"
    volumes:
      - postgres-data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U clavis -d clavis"]
      interval: 2s
      timeout: 3s
      retries: 30
    stop_grace_period: 5s
  # A single-node VictoriaMetrics for smoke and development. The short maximum
  # query duration caps the forwarded timeout at a development-sized bound;
  # nothing is persisted.
  victoriametrics:
    image: victoriametrics/victoria-metrics:v1.151.0@sha256:6d164540a04f49ba4e696cbdb70f9fee78be1e94b8f2a1292743a0b1ab8275bd
    command:
      - -search.maxQueryDuration=5s
      - -search.latencyOffset=1s
      - -retentionPeriod=1d
    ports:
      - "127.0.0.1:${CLAVIS_VM_PORT:-8428}:8428"
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8428/health"]
      interval: 2s
      timeout: 3s
      retries: 30
    stop_grace_period: 5s
  # A single-node VictoriaLogs for smoke and development. The short maximum
  # query duration caps the forwarded timeout at a development-sized bound;
  # nothing is persisted.
  victorialogs:
    image: victoriametrics/victoria-logs:v1.52.0@sha256:47b820890d64c4575a2a0a46415dcd8a4fd59a0f1fcd6a377693d7aea639442e
    command:
      - -search.maxQueryDuration=5s
      - -retentionPeriod=1d
    ports:
      - "127.0.0.1:${CLAVIS_VL_PORT:-9428}:9428"
    # The image ships no shell or wget, so there is no container health check;
    # smoke waits on /health over HTTP from the host instead.
    stop_grace_period: 5s
  # The built server image against the compose database, for `make smoke-image`
  # only. Nothing else activates the profile, so `make dev-db`, `make down` and
  # `make smoke` never start or stop this service.
  app:
    image: ${CLAVIS_APP_IMAGE:-clavis:local}
    profiles: [app]
    depends_on:
      db:
        condition: service_healthy
    environment:
      CLAVIS_DATABASE_URL: postgres://clavis:clavis-local-only@db:5432/clavis?sslmode=disable
      # A deployment terminates TLS in front of the container, so the public
      # origin is HTTPS. The image smoke signs in through the real browser
      # flow with that origin, the way a request through the proxy arrives.
      CLAVIS_PUBLIC_URL: https://clavis.local
      CLAVIS_ENCRYPTION_KEY_FILE: /run/secrets/clavis/encryption-key
      CLAVIS_BOOTSTRAP_USERNAME: ${CLAVIS_APP_BOOTSTRAP_USERNAME:-smoke-admin}
      CLAVIS_BOOTSTRAP_PASSWORD_FILE: /run/secrets/clavis/bootstrap-password
    volumes:
      # Compose interpolates the whole file whatever the active profile, so a
      # required variable here would break `make dev-db`. The placeholder names
      # the missing setting instead; the smoke script always supplies the path.
      - ${CLAVIS_APP_SECRETS_DIR:-./.local/CLAVIS_APP_SECRETS_DIR-is-unset}:/run/secrets/clavis:ro
    ports:
      - "127.0.0.1:${CLAVIS_APP_PORT:-8081}:8080"
    read_only: true
    user: "65532:65532"
    # The mounted files are group-readable, not world-readable; the caller
    # passes the gid owning them so the container process joins that group.
    group_add: ["${CLAVIS_APP_SECRETS_GID:-65532}"]
    # distroless ships no shell, so the service has no container health check;
    # the smoke script probes /livez over the published port from the host.
    stop_grace_period: 15s
volumes:
  postgres-data: