dimgigov
b6cdf8c88e
- Add Dockerfile (pre-built binary) and Dockerfile.source - Add docker-compose.yml, docker-compose.prod.yml, docker-compose.override.yml - Add docker-entrypoint.sh with non-root user support - Add .dockerignore and helper scripts (scripts/docker-build.sh, scripts/docker-run.sh) - Add docs/en/docker.md with full Docker guide - Update docs/en/deployment.md and README.md - Fix src/barabadb/core/config.nim to read BARADB_ADDRESS, BARADB_PORT, BARADB_DATA_DIR from env - Fix src/barabadb/core/httpserver.nim missing wire import
130 lines
3.2 KiB
YAML
130 lines
3.2 KiB
YAML
# BaraDB — Production Docker Compose
|
|
# Usage: docker compose -f docker-compose.prod.yml up -d
|
|
#
|
|
# Препоръчителни стъпки преди production deployment:
|
|
# 1. Създайте TLS сертификати в ./certs/
|
|
# 2. Задайте силен BARADB_JWT_SECRET
|
|
# 3. Настройте firewall правила за портовете
|
|
# 4. Конфигурирайте регулярни backups
|
|
|
|
services:
|
|
baradb:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
image: baradb:latest
|
|
container_name: baradb
|
|
hostname: baradb
|
|
restart: always
|
|
|
|
ports:
|
|
- "9472:9472" # Binary protocol
|
|
- "9912:9912" # HTTP/REST API
|
|
- "9913:9913" # WebSocket
|
|
|
|
volumes:
|
|
- baradb_data:/data
|
|
# TLS сертификати (read-only)
|
|
- ./certs:/certs:ro
|
|
# Лог файлове на хоста
|
|
- ./logs:/var/log/baradb
|
|
|
|
environment:
|
|
# Network
|
|
- BARADB_ADDRESS=0.0.0.0
|
|
- BARADB_PORT=9472
|
|
|
|
# Storage
|
|
- BARADB_DATA_DIR=/data
|
|
- BARADB_MEMTABLE_SIZE_MB=256
|
|
- BARADB_CACHE_SIZE_MB=512
|
|
|
|
# TLS (разкоментирайте когато имате сертификати)
|
|
# - BARADB_TLS_ENABLED=true
|
|
# - BARADB_CERT_FILE=/certs/server.crt
|
|
# - BARADB_KEY_FILE=/certs/server.key
|
|
|
|
# Security (ЗАДЪЛЖИТЕЛНО сменете в production!)
|
|
# - BARADB_AUTH_ENABLED=true
|
|
# - BARADB_JWT_SECRET=change-me-to-random-32-char-string
|
|
# - BARADB_RATE_LIMIT_GLOBAL=10000
|
|
# - BARADB_RATE_LIMIT_PER_CLIENT=1000
|
|
|
|
# Logging
|
|
- BARADB_LOG_LEVEL=warn
|
|
- BARADB_LOG_FILE=/var/log/baradb/baradb.log
|
|
- BARADB_LOG_FORMAT=json
|
|
|
|
# Performance
|
|
- BARADB_COMPACTION_INTERVAL_MS=30000
|
|
- BARADB_WAL_SYNC_INTERVAL_MS=10
|
|
|
|
healthcheck:
|
|
test: ["CMD", "sh", "-c", "wget -qO- http://localhost:9912/health >/dev/null 2>&1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
|
|
# Production resource limits
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '4.0'
|
|
memory: 8G
|
|
reservations:
|
|
cpus: '1.0'
|
|
memory: 1G
|
|
|
|
# Security hardening
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:noexec,nosuid,size=100m
|
|
|
|
networks:
|
|
- baradb_net
|
|
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "100m"
|
|
max-file: "5"
|
|
labels: "service_name"
|
|
|
|
# Опционален: Backup cron job
|
|
backup:
|
|
image: baradb:latest
|
|
container_name: baradb-backup
|
|
restart: unless-stopped
|
|
command: >
|
|
sh -c '
|
|
while true; do
|
|
sleep 86400;
|
|
/app/backup backup --data-dir=/data --output=/backups/baradb_$$(date +%Y%m%d_%H%M%S).tar.gz --level=6;
|
|
/app/backup cleanup --keep=7;
|
|
done
|
|
'
|
|
volumes:
|
|
- baradb_data:/data:ro
|
|
- ./backups:/backups
|
|
networks:
|
|
- baradb_net
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.5'
|
|
memory: 512M
|
|
|
|
volumes:
|
|
baradb_data:
|
|
driver: local
|
|
|
|
networks:
|
|
baradb_net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.28.0.0/16
|