VacciChain/docker-compose.yml at main · dev-fatima-24/VacciChain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
services:
  nginx:
    image: nginx:1.25-alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./frontend/dist:/usr/share/nginx/html:ro
      - ./certs:/etc/nginx/certs:ro
      - certbot_webroot:/var/www/certbot:ro
    depends_on:
      backend:
        condition: service_healthy
      python-service:
        condition: service_healthy
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:80"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  # Certbot for automatic Let's Encrypt certificate renewal.
  # Run once to obtain initial cert: docker compose run --rm certbot certonly ...
  certbot:
    image: certbot/certbot:latest
    volumes:
      - ./certs:/etc/letsencrypt
      - certbot_webroot:/var/www/certbot
    entrypoint: /bin/sh -c "trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot; sleep 12h & wait $${!}; done"
    restart: unless-stopped

  frontend:
    build: ./frontend
    # No ports exposed — nginx serves static assets from ./frontend/dist volume
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:80"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/log/nginx
      - /tmp
    deploy:
      resources:
        limits:
          cpus: "0.10"
          memory: 64M
        reservations:
          cpus: "0.01"
          memory: 16M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  backend:
    build: ./backend
    # No host port — only reachable via nginx on the internal network
    env_file: .env
    environment:
      - EVENT_POLL_INTERVAL_MS=${EVENT_POLL_INTERVAL_MS:-15000}
      - DATABASE_PATH=/data/vaccichain.db
    volumes:
      - vaccichain_db:/data
    depends_on:
      python-service:
        condition: service_healthy
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    deploy:
      resources:
        limits:
          cpus: "0.75"
          memory: 256M
        reservations:
          cpus: "0.10"
          memory: 128M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  python-service:
    build: ./python-service
    # No host port — only reachable via nginx on the internal network
    env_file: .env
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8001/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 128M
        reservations:
          cpus: "0.05"
          memory: 64M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

  backup:
    build: ./backup
    env_file: .env
    volumes:
      - vaccichain_db:/data
    networks:
      - vaccichain
    healthcheck:
      test: ["CMD", "sh", "-c", "test -f /data/vaccichain.db"]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 10s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped

networks:
  vaccichain:
    driver: bridge

volumes:
  vaccichain_db:
  certbot_webroot: