netrunner-backend/docker-compose.prod.yml

# =====================================================================
# PRODUCTION — VPS только тянет готовый образ из GHCR и запускает его.
# Никакой компиляции Rust на сервере. Деплой = pull + migrate + up.
# =====================================================================
services:
  # One-shot: применяет миграции и завершается. Требует только DATABASE_URL.
  migrate:
    image: ${IMAGE:-ghcr.io/nineap/netrunner-control-plane:latest}
    container_name: netrunner-migrate
    command: ["./netrunner-control-plane", "--migrate"]
    environment:
      - DATABASE_URL=postgres://${DB_USER}:${DB_PASSWORD}@db:5432/${DB_NAME}
    depends_on:
      db:
        condition: service_healthy
    restart: "no"
    networks:
      - netrunner_grid

  app:
    image: ${IMAGE:-ghcr.io/nineap/netrunner-control-plane:latest}
    container_name: netrunner-app
    restart: always
    ports:
      - "8080:8080"
    env_file:
      - .env
    environment:
      - APP_ENV=production
      - FRONTEND_DIR=/app/frontend/dist
      - DATABASE_URL=postgres://${DB_USER}:${DB_PASSWORD}@db:5432/${DB_NAME}
    volumes:
      - ./keys:/app/keys:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    networks:
      - netrunner_grid

  db:
    image: postgres:16-alpine
    container_name: netrunner-db
    restart: always
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_DB: ${DB_NAME}
    volumes:
      - netrunner_db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - netrunner_grid

  redis:
    image: redis:7-alpine
    container_name: netrunner-redis
    restart: always
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
    networks:
      - netrunner_grid

  # Периодический pg_dump + опциональная офсайт-копия через rclone (см.
  # scripts/backup.sh). RCLONE_REMOTE/RCLONE_CONFIG — задать в .env, если нужна
  # копия за пределы этого VPS (настоятельно рекомендуется — единственная
  # локальная копия на volume ничем не защищена от падения диска этой машины).
  backup:
    image: postgres:16-alpine
    container_name: netrunner-backup
    restart: always
    entrypoint: ["/bin/sh", "/scripts/backup.sh"]
    environment:
      - DATABASE_URL=postgres://${DB_USER}:${DB_PASSWORD}@db:5432/${DB_NAME}
      - BACKUP_DIR=/backups
      - BACKUP_INTERVAL_SEC=${BACKUP_INTERVAL_SEC:-21600}
      - BACKUP_RETENTION_DAYS=${BACKUP_RETENTION_DAYS:-14}
      - RCLONE_REMOTE=${RCLONE_REMOTE:-}
      - RCLONE_CONFIG_CONTENT=${RCLONE_CONFIG_CONTENT:-}
    volumes:
      - ./scripts/backup.sh:/scripts/backup.sh:ro
      - netrunner_db_backups:/backups
    depends_on:
      db:
        condition: service_healthy
    networks:
      - netrunner_grid

  # ==========================================
  # МОНИТОРИНГ
  # ==========================================
  prometheus:
    image: prom/prometheus:latest
    container_name: netrunner-prometheus
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
    ports:
      - "127.0.0.1:9090:9090"
    restart: always
    networks:
      - netrunner_grid

  loki:
    image: grafana/loki:latest
    container_name: netrunner-loki
    volumes:
      - ./loki-config.yml:/etc/loki/local-config.yaml:ro
    ports:
      - "127.0.0.1:3100:3100"
    command: -config.file=/etc/loki/local-config.yaml
    restart: always
    networks:
      - netrunner_grid

  promtail:
    image: grafana/promtail:latest
    container_name: netrunner-promtail
    volumes:
      - ./promtail-config.yml:/etc/promtail/config.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command: -config.file=/etc/promtail/config.yml
    restart: always
    user: root
    depends_on:
      - loki
    networks:
      - netrunner_grid

  grafana:
    image: grafana/grafana:latest
    container_name: netrunner-grafana
    ports:
      - "127.0.0.1:3030:3000"
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana-datasources.yml:/etc/grafana/provisioning/datasources/datasources.yml:ro
    depends_on:
      - prometheus
      - loki
    restart: always
    networks:
      - netrunner_grid

networks:
  netrunner_grid:
    # Явное имя (не дефолтный <project>_netrunner_grid) — на этот же bridge
    # снаружи подключается netrunner-data/docker-compose.yml (Vaultwarden) как
    # external-сеть, ссылаясь по этому фиксированному имени.
    name: netrunner_grid
    driver: bridge

volumes:
  netrunner_db_data:
  netrunner_db_backups:
  grafana_data: