82 lines
3.0 KiB
YAML
82 lines
3.0 KiB
YAML
# A self-contained stack for the userservice: its own PostgreSQL (a separate
|
|
# database from the coordinator's — different bounded context), a one-shot
|
|
# migration step, and the service. The project name and host ports differ from
|
|
# the coordinator's so both stacks can run side by side on one machine.
|
|
name: scimesh-users
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-scimesh}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-scimesh}
|
|
POSTGRES_DB: ${POSTGRES_DB:-scimesh_users}
|
|
ports:
|
|
# 5433 on the host, so it never clashes with the coordinator's 5432.
|
|
- "${POSTGRES_PORT:-5433}:5432"
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
# Everything else waits on this, so the check must prove the server
|
|
# accepts queries — not merely that the port is open.
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-scimesh} -d ${POSTGRES_DB:-scimesh_users}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
start_period: 5s
|
|
|
|
# One-shot: applies migrations, then exits. Schema changes stay an explicit
|
|
# deployment step — the service binary never migrates on startup.
|
|
migrate:
|
|
image: migrate/migrate:v4.17.1
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ./migrations:/migrations:ro
|
|
command:
|
|
- -path=/migrations
|
|
- -database=postgres://${POSTGRES_USER:-scimesh}:${POSTGRES_PASSWORD:-scimesh}@postgres:5432/${POSTGRES_DB:-scimesh_users}?sslmode=disable
|
|
- up
|
|
restart: on-failure
|
|
|
|
userservice:
|
|
build:
|
|
context: .
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
# Start only once the schema exists, otherwise the first query fails.
|
|
migrate:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
USERSERVICE_ADDR: ":8081"
|
|
# Host is the service name: compose resolves it on the project network.
|
|
DATABASE_URL: postgres://${POSTGRES_USER:-scimesh}:${POSTGRES_PASSWORD:-scimesh}@postgres:5432/${POSTGRES_DB:-scimesh_users}?sslmode=disable
|
|
# MUST match the coordinator's JWT secret so it can verify these tokens.
|
|
JWT_SECRET: ${JWT_SECRET:-dev-secret-change-me-at-least-32-bytes}
|
|
JWT_TTL: ${JWT_TTL:-24h}
|
|
DB_MAX_CONNS: "10"
|
|
REQUEST_TIMEOUT: "15s"
|
|
LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
# Logs are teed to stdout (docker logs) and this rotated file on a named
|
|
# volume, so they survive a rebuild.
|
|
LOG_FILE: /var/log/scimesh/userservice.log
|
|
ports:
|
|
- "${USERSERVICE_PORT:-8081}:8081"
|
|
# A named volume (not a host bind mount): it inherits the image's directory
|
|
# ownership, so the non-root process can write to it.
|
|
volumes:
|
|
- userservice_logs:/var/log/scimesh
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8081/health"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 3
|
|
start_period: 5s
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
pgdata:
|
|
userservice_logs:
|