EvoBGP/deploy/compose/docker-compose.yaml

# EvoBGP Compose: профили `reference` (эталон) и `microvps` (одна VPS).
#
# Образы EvoBGP тянутся из Container Registry (не собираются здесь). Префикс и тег — .env (см. .env.example):
#   EVOBGP_REGISTRY=git.shx.one/<owner>   EVOBGP_IMAGE_TAG=latest
# Перед up: docker login git.shx.one  &&  docker compose pull
#
# Запуск:
#   docker compose --profile reference up -d
#   docker compose --profile microvps up -d
#   microVPS ~1 ГиБ + Web UI — docs/quickstart.md и docker-compose.microvps-full.yaml
#
# reference: 5× Go (api + scheduler + ingest + render + deploy) + postgres + NATS JetStream + bird2 + agent + web.
# Async jobs выполняются in-process в evobgp-api (jobs.Registry); NATS — задел под брокер (см. docs/architecture.md).
# microvps: evobgp-all + postgres + bird2 + agent (без брокера и без UI).
# microvps-full: как microvps + evobgp-web-microvps (порт 3000) + nats + prometheus-microvps (порт 9090).
#
# Опция microVPS_sqlite из плана (без контейнера Postgres): требует реализации store на SQLite в приложении;
# пока используйте microvps с контейнерным Postgres (единые миграции).
#
# Профиль reference: Web UI на http://localhost:3000 (nginx → /v1 и /metrics на evobgp-api:8080).
#
# Очистка неиспользуемых данных Docker (PowerShell; осторожно с -v):
#   docker system prune -f
#   docker volume prune -f
#
# Входящий BGP (TCP/179): на Linux для публичного пира часто нужен network_mode: host у bird2
# или macvlan/ipvlan — см. архитектурный план §4.1. Здесь опубликован порт 179 для отладки.
name: evobgp

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "3"

x-env-ref: &env-ref
  EVOBGP_DATABASE_URL: postgres://evobgp:evobgp@postgres:5432/evobgp?sslmode=disable
  EVOBGP_BROKER_URL: nats://nats:4222

x-env-micro: &env-micro
  EVOBGP_DATABASE_URL: postgres://evobgp:evobgp@postgres:5432/evobgp?sslmode=disable

services:
  postgres:
    profiles: ["reference", "microvps", "microvps-full"]
    image: postgres:16-alpine
    restart: unless-stopped
    # Дефолтный /dev/shm в Docker (64 МиБ) мало для Postgres; иначе ошибки shared memory при старте.
    shm_size: "256mb"
    environment:
      POSTGRES_USER: evobgp
      POSTGRES_PASSWORD: evobgp
      POSTGRES_DB: evobgp
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U evobgp -d evobgp"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 45s
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 384M

  nats:
    profiles: ["reference", "microvps-full"]
    image: nats:2.10-alpine
    restart: unless-stopped
    command: ["-js", "-m", "8222"]
    ports:
      - "4222:4222"
    logging: *default-logging
    deploy:
      resources:
        limits:
          memory: 256M

  evobgp-api:
    profiles: ["reference"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-api:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_started
      bird2:
        condition: service_started
    ports:
      - "8080:8080"
    environment:
      <<: *env-ref
      EVOBGP_HTTP_ADDR: ":8080"
      EVOBGP_SEED_DEMO: "1"
      # DEV ONLY — не для production. Bearer dev + слабые demo-секреты (см. docs/access.md).
      EVOBGP_DEV_INSECURE: "1"
      EVOBGP_BIRDC_SOCKET: /run/bird/bird.ctl
      EVOBGP_BIRDC_INTERVAL: 30s
      EVOBGP_BIRD_ACTIVE_DIR: /etc/bird
      EVOBGP_BIRD_STAGING_DIR: /tmp/evobgp-bird-staging
      EVOBGP_CORS_ORIGINS: "http://localhost:5173,http://127.0.0.1:5173,http://localhost:3000,http://127.0.0.1:3000"
    volumes:
      - bird_etc:/etc/bird
      - bird_run:/run/bird:ro
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M

  evobgp-scheduler:
    profiles: ["reference"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-scheduler:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_started
      evobgp-api:
        condition: service_started
    environment:
      <<: *env-ref
      # Split deploy: scheduler must enqueue jobs via API, not in-process Registry (ARCH-04).
      EVOBGP_SCHEDULER_STANDALONE: "1"
      EVOBGP_CONTROL_PLANE_URL: http://evobgp-api:8080
      EVOBGP_SCHEDULER_BEARER: dev
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 128M

  evobgp-ingest:
    profiles: ["reference"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-ingest:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_started
    environment:
      <<: *env-ref
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 128M

  evobgp-render:
    profiles: ["reference"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-render:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_started
    environment:
      <<: *env-ref
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 128M

  evobgp-deploy:
    profiles: ["reference"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-deploy:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_started
    environment:
      <<: *env-ref
      EVOBGP_BIRD_ACTIVE_DIR: /etc/bird
    volumes:
      - bird_etc:/etc/bird:ro
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 128M

  evobgp-web:
    profiles: ["reference"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-web:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      - evobgp-api
    ports:
      - "3000:80"
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 128M

  evobgp-all:
    profiles: ["microvps", "microvps-full"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-all:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      bird2:
        condition: service_started
    ports:
      - "8080:8080"
    environment:
      <<: *env-micro
      EVOBGP_HTTP_ADDR: ":8080"
      EVOBGP_SEED_DEMO: "1"
      EVOBGP_BIRDC_SOCKET: /run/bird/bird.ctl
      EVOBGP_BIRDC_INTERVAL: 30s
      EVOBGP_BIRD_ACTIVE_DIR: /etc/bird
      EVOBGP_BIRD_STAGING_DIR: /tmp/evobgp-bird-staging
    volumes:
      - bird_etc:/etc/bird
      - bird_run:/run/bird:ro
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M

  # Web UI → evobgp-all (образ evobgp-web-all из реестра). Reference: сервис evobgp-web → evobgp-api.
  evobgp-web-microvps:
    profiles: ["microvps-full"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-web-all:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      - evobgp-all
    labels:
      - traefik.enable=true
      # Публичные firewall-эндпоинты — без WEBUI_IP_WHITELIST (установка с произвольных серверов).
      - traefik.http.routers.evobgp-firewall-public.rule=Host(`${WEBUI_DOMAIN}`) && (Path(`/v1/firewall/install.sh`) || Path(`/v1/firewall/sync-script`) || PathPrefix(`/v1/firewall/enroll`))
      - traefik.http.routers.evobgp-firewall-public.entrypoints=websecure
      - traefik.http.routers.evobgp-firewall-public.tls=true
      - traefik.http.routers.evobgp-firewall-public.tls.certresolver=letsencrypt
      - traefik.http.routers.evobgp-firewall-public.priority=100
      - traefik.http.routers.evobgp-firewall-public.service=evobgp-web
      - traefik.http.routers.evobgp-web.rule=Host(`${WEBUI_DOMAIN}`)
      - traefik.http.routers.evobgp-web.entrypoints=websecure
      - traefik.http.routers.evobgp-web.tls=true
      - traefik.http.routers.evobgp-web.tls.certresolver=letsencrypt
      - traefik.http.routers.evobgp-web.priority=10
      - traefik.http.routers.evobgp-web.middlewares=webui-ipwhitelist@docker
      - traefik.http.middlewares.webui-ipwhitelist.ipallowlist.sourcerange=${WEBUI_IP_WHITELIST}
      - traefik.http.services.evobgp-web.loadbalancer.server.port=80
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 128M

  evobgp-edge:
    profiles: ["microvps-full"]
    image: traefik:latest
    restart: unless-stopped
    depends_on:
      - evobgp-web-microvps
    ports:
      - "80:80"
      - "443:443"
    environment:
      DOCKER_API_VERSION: "1.44"
      CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN}
    command:
      - --api.dashboard=false
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=15
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_letsencrypt:/letsencrypt
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "0.35"
          memory: 128M

  prometheus-microvps:
    profiles: ["microvps-full"]
    image: prom/prometheus:v2.54.1
    restart: unless-stopped
    depends_on:
      - evobgp-all
    ports:
      - "9090:9090"
    volumes:
      - ../prometheus/prometheus-microvps.yml:/etc/prometheus/prometheus.yml:ro
      - ../prometheus/alerts.yml:/etc/prometheus/alerts.yml:ro
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=7d
      - --web.enable-lifecycle
    logging: *default-logging
    deploy:
      resources:
        limits:
          cpus: "0.35"
          memory: 256M

  bird2:
    profiles: ["reference", "microvps", "microvps-full"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-bird2:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    sysctls:
      net.ipv4.ip_forward: "1"
      net.ipv6.conf.all.forwarding: "1"
    volumes:
      - bird_etc:/etc/bird
      - bird_run:/run/bird
    ports:
      - "179:179/tcp"
    logging: *default-logging
    deploy:
      resources:
        limits:
          memory: 256M

  evobgp-agent:
    profiles: ["reference", "microvps", "microvps-full"]
    image: ${EVOBGP_REGISTRY:-git.shx.one/denozord}/evobgp-agent:${EVOBGP_IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      - bird2
    cap_add:
      - NET_ADMIN
    volumes:
      - bird_etc:/etc/bird
      - bird_run:/run/bird
    entrypoint: ["/usr/local/bin/evobgp-agent"]
    command: ["watch", "-socket=/run/bird/bird.ctl", "-watch-interval=30s"]
    logging: *default-logging
    deploy:
      resources:
        limits:
          memory: 128M

  prometheus:
    profiles: ["reference"]
    image: prom/prometheus:v2.54.1
    restart: unless-stopped
    depends_on:
      - evobgp-api
    ports:
      - "9090:9090"
    volumes:
      - ../prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ../prometheus/alerts.yml:/etc/prometheus/alerts.yml:ro
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=15d
      - --web.enable-lifecycle
    logging: *default-logging
    deploy:
      resources:
        limits:
          memory: 512M

volumes:
  pgdata:
  bird_etc:
  bird_run:
  traefik_letsencrypt: