docker-compose.database.yml

# Generated by: ./scripts/generate-compose.sh
# Profile: database - Database services (redis, mongodb, clickhouse)
#
# Includes Traefik for TLS termination (opt-in with: --profile tls)
# Enable with: docker compose --profile tls up

name: currents_database

# This core Currents application services

# Redis service configuration
# Almost always included - provides caching and pub/sub messaging
services:
  # Currents services depend on redis
  director:
    hostname: director
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}director:${DC_CURRENTS_IMAGE_TAG:-staging}
    ports:
      - ${DC_DIRECTOR_PORT:-1234}:1234
    restart: unless-stopped
    env_file:
      - .env
    networks:
      - default
    environment:
      CURRENTS_ENV: onprem
      EMAIL_TRANSPORTER: smtp
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  api:
    hostname: api
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}api:${DC_CURRENTS_IMAGE_TAG:-staging}
    ports:
      - ${DC_API_PORT:-4000}:4000
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      INCLUDE_DASHBOARD: onprem
      BETTER_AUTH_ENABLED: "true"
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_CURRENTS_PASSWORD}
      EMAIL_TRANSPORTER: smtp
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  changestreams-worker:
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}change-streams:${DC_CURRENTS_IMAGE_TAG:-staging}
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_CURRENTS_PASSWORD}
      EMAIL_TRANSPORTER: smtp
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  # Currents services depend on clickhouse
  write-worker:
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}writer:${DC_CURRENTS_IMAGE_TAG:-staging}
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_CURRENTS_PASSWORD}
      EMAIL_TRANSPORTER: smtp
    depends_on:
      clickhouse:
        condition: service_healthy
        required: false
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  scheduler:
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}scheduler:${DC_CURRENTS_IMAGE_TAG:-staging}
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_CURRENTS_PASSWORD}
      RUN_STARTUP_TASKS: "true"
      EMAIL_TRANSPORTER: smtp
    volumes:
      - ${DC_SCHEDULER_STARTUP_VOLUME:-./data/startup}:/app/packages/scheduler/dist/.startup
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  webhooks:
    image: ${DC_CURRENTS_IMAGE_REPOSITORY:-currents-}webhooks:${DC_CURRENTS_IMAGE_TAG:-staging}
    restart: unless-stopped
    networks:
      - default
    env_file:
      - .env
    environment:
      CURRENTS_ENV: onprem
      EMAIL_TRANSPORTER: smtp
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_started
        required: false
  traefik:
    hostname: traefik
    image: ${DC_TRAEFIK_IMAGE:-traefik:v3.3}
    restart: unless-stopped
    profiles:
      - tls
    environment:
      TRAEFIK_ENABLE_STORAGE: ${TRAEFIK_ENABLE_STORAGE:-false}
      TRAEFIK_GENERATE_TEMP_CERTS: ${TRAEFIK_GENERATE_TEMP_CERTS:-false}
    ports:
      - ${DC_TRAEFIK_HTTP_PORT:-80}:80
      - ${DC_TRAEFIK_HTTPS_PORT:-443}:443
    networks:
      - default
    volumes:
      - ${DC_TRAEFIK_CERTS_DIR:-./data/traefik/certs}:/certs
      - ${DC_TRAEFIK_CONFIG_DIR:-./data/traefik/config}:/traefik-config:ro
    command:
      # Entrypoints
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      # HTTP to HTTPS redirect
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      # TLS configuration (file-based certificates)
      - --entrypoints.websecure.http.tls=true
      # File provider for dynamic configuration
      - --providers.file.filename=${DC_TRAEFIK_DYNAMIC_CONFIG_PATH:-/etc/traefik/dynamic.yml}
      - --providers.file.watch=true
      # Enable API for healthcheck (insecure mode, internal only)
      - --api.insecure=true
      - --api.dashboard=false
      # Health check endpoint
      - --ping=true
    configs:
      - source: traefik_dynamic
        target: /etc/traefik/dynamic.yml
    healthcheck:
      test: ['CMD', 'traefik', 'healthcheck', '--ping']
      interval: 10s
      timeout: 5s
      retries: 3
  clickhouse:
    hostname: clickhouse
    image: ${DC_CLICKHOUSE_IMAGE:-clickhouse/clickhouse-server:25.8}
    restart: unless-stopped
    environment:
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: '1'
    healthcheck:
      test:
        - 'CMD-SHELL'
        - 'wget --spider -q clickhouse:8123/ping'
      interval: 2s
      timeout: 5s
      retries: 10
    env_file:
      - .env
    ports:
      - ${DC_CLICKHOUSE_HTTP_PORT:-127.0.0.1:8123}:8123 # HTTP Interface
      - ${DC_CLICKHOUSE_TCP_PORT:-127.0.0.1:9123}:9000 # TCP Interface
    networks:
      - default
    configs:
      - source: clickhouse_users
        target: /etc/clickhouse-server/users.d/users.xml
    volumes:
      - ${DC_CLICKHOUSE_VOLUME:-./data/clickhouse}:/var/lib/clickhouse
  mongodb:
    hostname: mongodb
    image: ${DC_MONGODB_IMAGE:-mongo:8.2.3}
    ports:
      - ${DC_MONGODB_PORT:-127.0.0.1:27017}:27017
    restart: unless-stopped
    entrypoint:
      - bash
      - -c
      - |
        # Generate keyFile if it doesn't exist
        KEYFILE=/data/db/replica.key
        if [ ! -f "$$KEYFILE" ]; then
          echo "Generating MongoDB replica set keyFile..."
          openssl rand -base64 756 > "$$KEYFILE"
        fi
        chmod 400 "$$KEYFILE"
        chown mongodb:mongodb "$$KEYFILE"

        # Call original Docker entrypoint (handles MONGO_INITDB_* user creation)
        exec docker-entrypoint.sh mongod --bind_ip_all --replSet rs0 --auth --keyFile "$$KEYFILE"
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGODB_USERNAME}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD}
    networks:
      - default
    healthcheck:
      test:
        - CMD-SHELL
        - |
          mongosh -u "$$MONGO_INITDB_ROOT_USERNAME" -p "$$MONGO_INITDB_ROOT_PASSWORD" --authenticationDatabase admin --quiet --eval "
          try {
            const status = rs.status();
            if (status.myState === 1) { quit(0); }
            quit(1);
          } catch (err) {
            if (err.codeName === 'NotYetInitialized') {
              rs.initiate({_id:'rs0', members:[{_id:0, host:'mongodb:27017'}]});
            }
            quit(1);
          }"
      interval: 5s
      timeout: 10s
      retries: 30
      start_period: 10s
    volumes:
      - ${DC_MONGODB_VOLUME:-./data/mongodb}:/data/db
  redis:
    hostname: redis
    image: ${DC_REDIS_IMAGE:-redis/redis-stack-server:7.4.0-v8}
    ports:
      - ${DC_REDIS_PORT:-127.0.0.1:6379}:6379
    restart: unless-stopped
    networks:
      - default
    volumes:
      - ${DC_REDIS_VOLUME:-./data/redis}:/data
networks:
  default: null
configs:
  traefik_dynamic:
    content: |
      # Traefik dynamic configuration (supports Go templating with sprig)
      {{- if ne (env "TRAEFIK_GENERATE_TEMP_CERTS") "true" }}
      tls:
        certificates:
          - certFile: /certs/wildcard.crt
            keyFile: /certs/wildcard.key
      {{- end }}

      http:
        routers:
          # API / Dashboard service
          api:
            rule: "Host(`${TRAEFIK_API_SUBDOMAIN:-currents-app}.${TRAEFIK_DOMAIN}`)"
            service: api
            entryPoints:
              - websecure
            tls: {}

          # Director service (record API)
          director:
            rule: "Host(`${TRAEFIK_DIRECTOR_SUBDOMAIN:-currents-record}.${TRAEFIK_DOMAIN}`)"
            service: director
            entryPoints:
              - websecure
            tls: {}

          {{- if eq (env "TRAEFIK_ENABLE_STORAGE") "true" }}
          # RustFS S3 API (conditionally enabled)
          storage:
            rule: "Host(`${TRAEFIK_STORAGE_SUBDOMAIN:-currents-storage}.${TRAEFIK_DOMAIN}`)"
            service: rustfs
            entryPoints:
              - websecure
            tls: {}
          {{- end }}

        services:
          api:
            loadBalancer:
              servers:
                - url: "http://api:4000"

          director:
            loadBalancer:
              servers:
                - url: "http://director:1234"

          {{- if eq (env "TRAEFIK_ENABLE_STORAGE") "true" }}
          rustfs:
            loadBalancer:
              servers:
                - url: "http://rustfs:9000"
          {{- end }}
  clickhouse_users:
    content: |
      <?xml version="1.0"?>
      <clickhouse>
          <users>
              <!-- Default user with password from environment (local access only) -->
              <default>
                  <password>${CLICKHOUSE_DEFAULT_PASSWORD}</password>
                  <networks>
                      <ip>::1</ip>
                      <ip>127.0.0.1</ip>
                  </networks>
                  <profile>default</profile>
                  <quota>default</quota>
                  <access_management>1</access_management>
              </default>
              <!-- Currents application user -->
              <currents>
                  <password>${CLICKHOUSE_CURRENTS_PASSWORD}</password>
                  <networks>
                      <ip>::/0</ip>
                  </networks>
                  <profile>default</profile>
                  <quota>default</quota>
              </currents>
          </users>
      </clickhouse>