BitMexBot/compose.remote.yml at master · meidielo/BitMexBot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
name: bitmexbot-safe

x-default-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "3"

x-runtime-hardening: &runtime-hardening
  read_only: true
  cap_drop:
    - ALL
  security_opt:
    - no-new-privileges:true
  tmpfs:
    - /tmp:rw,noexec,nosuid,nodev,size=32m,mode=1777
  restart: unless-stopped
  logging: *default-logging

services:
  secure-dns:
    image: bitmexbot-dns:20260714
    build:
      context: .
      dockerfile: Dockerfile.dns
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /run:rw,noexec,nosuid,nodev,size=8m,mode=0755
      - /tmp:rw,noexec,nosuid,nodev,size=8m,mode=1777
    restart: unless-stopped
    pids_limit: 64
    mem_limit: 128m
    cpus: 0.50
    logging: *default-logging
    networks:
      bitmexbot:
        ipv4_address: 10.254.53.53

  ledger-init:
    image: bitmexbot-runner:20260714
    command:
      - python
      - trade_ledger.py
      - --init
      - --path
      - /app/data/trades_v2.db
    network_mode: none
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777
    restart: "no"
    pids_limit: 64
    mem_limit: 256m
    cpus: 0.50
    logging: *default-logging
    volumes:
      - bitmexbot-data:/app/data

  runner:
    <<: *runtime-hardening
    image: bitmexbot-runner:20260714
    build:
      context: .
      dockerfile: Dockerfile
    env_file:
      - path: .env.runner
        format: raw
    depends_on:
      secure-dns:
        condition: service_healthy
      ledger-init:
        condition: service_completed_successfully
    networks:
      bitmexbot:
    dns:
      - 10.254.53.53
    pids_limit: 128
    mem_limit: 1536m
    cpus: 2.00
    volumes:
      - bitmexbot-data:/app/data
      - bitmexbot-logs:/app/logs
    healthcheck:
      test: ["CMD", "python", "healthcheck.py", "runner"]
      interval: 60s
      timeout: 10s
      start_period: 120s
      retries: 3
    stop_grace_period: 30s

  watchdog:
    <<: *runtime-hardening
    profiles: ["watchdog"]
    image: bitmexbot-runner:20260714
    command: ["python", "exchange_watchdog.py"]
    env_file:
      - path: .env.watchdog
        format: raw
        required: false
    depends_on:
      secure-dns:
        condition: service_healthy
      ledger-init:
        condition: service_completed_successfully
    networks:
      bitmexbot:
    dns:
      - 10.254.53.53
    pids_limit: 96
    mem_limit: 256m
    cpus: 0.75
    volumes:
      - watchdog-status:/app/data
    healthcheck:
      test: ["CMD", "python", "healthcheck.py", "watchdog"]
      interval: 20s
      timeout: 10s
      start_period: 60s
      retries: 3

  snapshot:
    <<: *runtime-hardening
    image: bitmexbot-runner:20260714
    command:
      - python
      - operator_snapshot.py
      - --heartbeat
      - /app/data/runner_status.json
      - --watchdog
      - /watchdog/watchdog_status.json
      - --output
      - /snapshot/operator_status.json
      - --poll-seconds
      - "15"
    environment:
      BITMEX_SNAPSHOT_STATUS_PATH: /snapshot/operator_status.json
    depends_on:
      ledger-init:
        condition: service_completed_successfully
      runner:
        condition: service_started
    volumes:
      - bitmexbot-data:/app/data:ro
      - watchdog-status:/watchdog:ro
      - dashboard-snapshot:/snapshot
    network_mode: none
    pids_limit: 64
    mem_limit: 384m
    cpus: 0.75
    healthcheck:
      test: ["CMD", "python", "healthcheck.py", "snapshot"]
      interval: 20s
      timeout: 10s
      start_period: 30s
      retries: 3

  dashboard:
    image: bitmexbot-dashboard:20260714
    build:
      context: .
      dockerfile: Dockerfile.dashboard
    env_file:
      - path: .env.dashboard
        format: raw
    environment:
      DASH_SNAPSHOT_PATH: /snapshot/operator_status.json
    depends_on:
      snapshot:
        condition: service_healthy
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=32m,mode=1777
    restart: unless-stopped
    pids_limit: 96
    mem_limit: 256m
    cpus: 0.75
    logging: *default-logging
    ports:
      - "100.110.79.52:5000:8080"
    volumes:
      - dashboard-snapshot:/snapshot:ro
    networks:
      dashboard:
        ipv4_address: 10.254.54.10

networks:
  bitmexbot:
    driver: bridge
    ipam:
      config:
        - subnet: 10.254.53.0/24
  dashboard:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.enable_ip_masquerade: "false"
    ipam:
      config:
        - subnet: 10.254.54.0/24

volumes:
  bitmexbot-data:
    name: bitmexbot-safe-data
  bitmexbot-logs:
    name: bitmexbot-safe-logs
  watchdog-status:
    name: bitmexbot-safe-watchdog-status
  dashboard-snapshot:
    name: bitmexbot-safe-dashboard-snapshot