Add Docker deployment support with compose, entrypoint and docs

- Add Dockerfile (pre-built binary) and Dockerfile.source - Add docker-compose.yml, docker-compose.prod.yml, docker-compose.override.yml - Add docker-entrypoint.sh with non-root user support - Add .dockerignore and helper scripts (scripts/docker-build.sh, scripts/docker-run.sh) - Add docs/en/docker.md with full Docker guide - Update docs/en/deployment.md and README.md - Fix src/barabadb/core/config.nim to read BARADB_ADDRESS, BARADB_PORT, BARADB_DATA_DIR from env - Fix src/barabadb/core/httpserver.nim missing wire import
2026-05-06 23:58:43 +03:00
parent 9b7ed1fca8
commit b6cdf8c88e
14 changed files with 764 additions and 80 deletions
@@ -0,0 +1,129 @@
+# BaraDB — Production Docker Compose
+# Usage: docker compose -f docker-compose.prod.yml up -d
+#
+# Препоръчителни стъпки преди production deployment:
+#   1. Създайте TLS сертификати в ./certs/
+#   2. Задайте силен BARADB_JWT_SECRET
+#   3. Настройте firewall правила за портовете
+#   4. Конфигурирайте регулярни backups
+
+services:
+  baradb:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: baradb:latest
+    container_name: baradb
+    hostname: baradb
+    restart: always
+
+    ports:
+      - "9472:9472"   # Binary protocol
+      - "9912:9912"   # HTTP/REST API
+      - "9913:9913"   # WebSocket
+
+    volumes:
+      - baradb_data:/data
+      # TLS сертификати (read-only)
+      - ./certs:/certs:ro
+      # Лог файлове на хоста
+      - ./logs:/var/log/baradb
+
+    environment:
+      # Network
+      - BARADB_ADDRESS=0.0.0.0
+      - BARADB_PORT=9472
+
+      # Storage
+      - BARADB_DATA_DIR=/data
+      - BARADB_MEMTABLE_SIZE_MB=256
+      - BARADB_CACHE_SIZE_MB=512
+
+      # TLS (разкоментирайте когато имате сертификати)
+      # - BARADB_TLS_ENABLED=true
+      # - BARADB_CERT_FILE=/certs/server.crt
+      # - BARADB_KEY_FILE=/certs/server.key
+
+      # Security (ЗАДЪЛЖИТЕЛНО сменете в production!)
+      # - BARADB_AUTH_ENABLED=true
+      # - BARADB_JWT_SECRET=change-me-to-random-32-char-string
+      # - BARADB_RATE_LIMIT_GLOBAL=10000
+      # - BARADB_RATE_LIMIT_PER_CLIENT=1000
+
+      # Logging
+      - BARADB_LOG_LEVEL=warn
+      - BARADB_LOG_FILE=/var/log/baradb/baradb.log
+      - BARADB_LOG_FORMAT=json
+
+      # Performance
+      - BARADB_COMPACTION_INTERVAL_MS=30000
+      - BARADB_WAL_SYNC_INTERVAL_MS=10
+
+    healthcheck:
+      test: ["CMD", "sh", "-c", "wget -qO- http://localhost:9912/health >/dev/null 2>&1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+
+    # Production resource limits
+    deploy:
+      resources:
+        limits:
+          cpus: '4.0'
+          memory: 8G
+        reservations:
+          cpus: '1.0'
+          memory: 1G
+
+    # Security hardening
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
+    tmpfs:
+      - /tmp:noexec,nosuid,size=100m
+
+    networks:
+      - baradb_net
+
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
+        labels: "service_name"
+
+  # Опционален: Backup cron job
+  backup:
+    image: baradb:latest
+    container_name: baradb-backup
+    restart: unless-stopped
+    command: >
+      sh -c '
+        while true; do
+          sleep 86400;
+          /app/backup backup --data-dir=/data --output=/backups/baradb_$$(date +%Y%m%d_%H%M%S).tar.gz --level=6;
+          /app/backup cleanup --keep=7;
+        done
+      '
+    volumes:
+      - baradb_data:/data:ro
+      - ./backups:/backups
+    networks:
+      - baradb_net
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 512M
+
+volumes:
+  baradb_data:
+    driver: local
+
+networks:
+  baradb_net:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.28.0.0/16