dimgigov
09f462f467
CI / test (push) Has been cancelled
CI / verify (push) Has been cancelled
Clients CI / build-server (push) Has been cancelled
Clients CI / test-python (push) Has been cancelled
Clients CI / test-javascript (push) Has been cancelled
Clients CI / test-nim (push) Has been cancelled
Clients CI / test-rust (push) Has been cancelled
- known-limitations, deployment runbook, release checklist - prod compose requires JWT secret; BARADB_ENV=production fail-closed - scripts/backup-restore-drill.sh (backup → wipe → restore → verify) - version bump 1.2.0 (nimble, Dockerfile, health, CHANGELOG dated)
127 lines
3.1 KiB
YAML
127 lines
3.1 KiB
YAML
# BaraDB — Production Docker Compose (v1.2.0 GA)
|
|
#
|
|
# Usage:
|
|
# export BARADB_JWT_SECRET="$(openssl rand -hex 32)"
|
|
# docker compose -f docker-compose.prod.yml up -d --build
|
|
#
|
|
# Required:
|
|
# BARADB_JWT_SECRET — strong secret (compose fails if unset)
|
|
#
|
|
# Ports (BARADB_PORT=9472):
|
|
# 9472 binary wire
|
|
# 9912 HTTP (= TCP + 440)
|
|
# 9913 WebSocket (= TCP + 441)
|
|
#
|
|
# Notes:
|
|
# - Auth is ON. Obtain a token via POST /auth before /query.
|
|
# - `deploy.resources` applies under Swarm; plain Compose ignores limits.
|
|
# - Raft is optional/experimental — not enabled here (single-node GA).
|
|
|
|
services:
|
|
baradb:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
image: baradb:1.2.0
|
|
container_name: baradb
|
|
hostname: baradb
|
|
restart: always
|
|
|
|
ports:
|
|
- "9472:9472" # Binary protocol
|
|
- "9912:9912" # HTTP REST (TCP+440)
|
|
- "9913:9913" # WebSocket (TCP+441)
|
|
|
|
volumes:
|
|
- baradb_data:/data
|
|
- ./certs:/certs:ro
|
|
- ./logs:/var/log/baradb
|
|
|
|
environment:
|
|
- BARADB_ENV=production
|
|
- BARADB_ADDRESS=0.0.0.0
|
|
- BARADB_PORT=9472
|
|
|
|
- BARADB_DATA_DIR=/data
|
|
- BARADB_MEMTABLE_SIZE_MB=256
|
|
- BARADB_CACHE_SIZE_MB=512
|
|
|
|
# Security — fail closed without a real secret
|
|
- BARADB_AUTH_ENABLED=true
|
|
- BARADB_JWT_SECRET=${BARADB_JWT_SECRET:?Set BARADB_JWT_SECRET to a strong random value}
|
|
- BARADB_RATE_LIMIT_GLOBAL=10000
|
|
- BARADB_RATE_LIMIT_PER_CLIENT=1000
|
|
|
|
# TLS (uncomment when certs exist under ./certs)
|
|
# - BARADB_TLS_ENABLED=true
|
|
# - BARADB_CERT_FILE=/certs/server.crt
|
|
# - BARADB_KEY_FILE=/certs/server.key
|
|
|
|
- BARADB_LOG_LEVEL=warn
|
|
- BARADB_LOG_FILE=/var/log/baradb/baradb.log
|
|
- BARADB_LOG_FORMAT=json
|
|
|
|
- BARADB_COMPACTION_INTERVAL_MS=30000
|
|
# Match config.nim env names
|
|
- BARADB_WAL_SYNC_MODE=group
|
|
- BARADB_WAL_GROUP_EVERY=64
|
|
|
|
healthcheck:
|
|
test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:9912/health >/dev/null 2>&1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "4.0"
|
|
memory: 8G
|
|
reservations:
|
|
cpus: "1.0"
|
|
memory: 1G
|
|
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:noexec,nosuid,size=100m
|
|
|
|
networks:
|
|
- baradb_net
|
|
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "100m"
|
|
max-file: "5"
|
|
|
|
# Optional offline-style backup sidecar (shares data volume read-only)
|
|
backup:
|
|
image: baradb:1.2.0
|
|
container_name: baradb-backup
|
|
restart: unless-stopped
|
|
profiles: ["backup"]
|
|
command: >
|
|
sh -c '
|
|
while true; do
|
|
sleep 86400;
|
|
/app/backup backup --all-databases --data-root=/data/databases --output=/backups/baradb_$$(date +%Y%m%d_%H%M%S).tar.gz --level=6 || true;
|
|
/app/backup cleanup --data-root=/data/databases --keep=7 || true;
|
|
done
|
|
'
|
|
volumes:
|
|
- baradb_data:/data:ro
|
|
- ./backups:/backups
|
|
networks:
|
|
- baradb_net
|
|
|
|
volumes:
|
|
baradb_data:
|
|
driver: local
|
|
|
|
networks:
|
|
baradb_net:
|
|
driver: bridge
|