medgraph/docker-compose.prod.yml at main · HieuNTg/medgraph · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
# MEDGRAPH Production Docker Compose
# Usage: docker compose -f docker-compose.prod.yml up -d
#
# Prerequisites:
#   1. Copy .env.example to .env and configure
#   2. Set MEDGRAPH_DOMAIN to your domain (or leave localhost for local testing)
#   3. Ensure ports 80/443 are open for Caddy TLS provisioning

services:
  # ── Reverse Proxy (TLS + static files) ─────────────────────────────
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"  # HTTP/3
    volumes:
      - ./deploy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data        # TLS certificates
      - caddy-config:/config
      - frontend-assets:/srv/frontend:ro
    environment:
      - MEDGRAPH_DOMAIN=${MEDGRAPH_DOMAIN:-localhost}
    depends_on:
      medgraph:
        condition: service_healthy
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
    networks:
      - medgraph-net

  # ── Application ────────────────────────────────────────────────────
  medgraph:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    volumes:
      - medgraph-data:/app/data
      - frontend-assets:/app/dashboard/dist
    env_file:
      - path: .env
        required: false
    environment:
      - MEDGRAPH_HOST=0.0.0.0
      - MEDGRAPH_PORT=8000
      - MEDGRAPH_ENV=production
      - MEDGRAPH_LOG_FORMAT=json
    healthcheck:
      test: ["CMD", "python", "-c",
             "import urllib.request; urllib.request.urlopen('http://localhost:8000/health/live')"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 1G
        reservations:
          cpus: "0.5"
          memory: 256M
    networks:
      - medgraph-net
    # Do NOT expose port 8000 — Caddy handles external traffic

  # ── Metrics (optional) ────────────────────────────────────────────
  prometheus:
    image: prom/prometheus:v2.51.0
    restart: unless-stopped
    volumes:
      - ./deploy/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.retention.time=30d"
      - "--web.console.libraries=/etc/prometheus/console_libraries"
      - "--web.console.templates=/etc/prometheus/consoles"
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512M
    networks:
      - medgraph-net
    # Not exposed externally — access via Grafana or SSH tunnel
    profiles:
      - monitoring

  # ── Dashboards (optional) ─────────────────────────────────────────
  grafana:
    image: grafana/grafana:10.4.0
    restart: unless-stopped
    volumes:
      - grafana-data:/var/lib/grafana
      - ./deploy/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./deploy/grafana/dashboards:/var/lib/grafana/dashboards:ro
    environment:
      # IMPORTANT: Change this password before deploying monitoring
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD must be set}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SERVER_ROOT_URL=${GRAFANA_ROOT_URL:-http://localhost:3000}
    ports:
      - "127.0.0.1:3000:3000"  # localhost only
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
    depends_on:
      - prometheus
    networks:
      - medgraph-net
    profiles:
      - monitoring

networks:
  medgraph-net:
    driver: bridge

volumes:
  medgraph-data:
    driver: local
  caddy-data:
    driver: local
  caddy-config:
    driver: local
  frontend-assets:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local