docker-compose.yml

name: chatsift-v3

services:
  # caddy:
  #   build:
  #     context: ./build/caddy
  #     dockerfile: ./Dockerfile
  #   env_file:
  #     - ./.env.private
  #   ports:
  #     - '80:80'
  #     - '443:443'

  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: 'chatsift'
      POSTGRES_PASSWORD: 'admin'
      POSTGRES_DB: 'chatsift'
    volumes:
      - postgres-data:/var/lib/postgresql/data
      # Only runs against a fresh data directory - already-provisioned volumes need the manual
      # one-time step documented in docs/workflow.md.
      - ./build/postgres/init:/docker-entrypoint-initdb.d:ro
    command:
      - '-c'
      - 'shared_preload_libraries=pg_stat_statements'
      - '-c'
      - 'pg_stat_statements.track=all'
      - '-c'
      - 'pg_stat_statements.max=5000'
      - '-c'
      - 'log_min_duration_statement=${POSTGRES_SLOW_QUERY_LOG_MS:-200}'
      # Bound parameter *values* would otherwise be logged alongside a slow statement (Postgres's
      # default) - queries here are parameterized user/message data (Discord IDs, ticket content,
      # snippet text, ...), so only the query shape ($1, $2, ...) goes to dozzle, never the values.
      - '-c'
      - 'log_parameter_max_length=0'
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    ports:
      - 127.0.0.1:${LOCAL_DATABASE_PORT}:5432
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U chatsift']
      interval: 10s
      timeout: 5s

  postgres-exporter:
    image: quay.io/prometheuscommunity/postgres-exporter:v0.20.1
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    environment:
      DATA_SOURCE_NAME: '${DATABASE_URL_PROD}?sslmode=disable'
    command:
      - '--collector.stat_statements'
      - '--collector.stat_statements.include_query'
      - '--collector.stat_statements.query_length=200'
      - '--collector.stat_statements.limit=20'
    depends_on:
      - postgres

  dozzle:
    image: amir20/dozzle:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dozzle-data:/data
    environment:
      DOZZLE_ENABLE_ACTIONS: true
      # Dozzle's own built-in auth (bcrypt users.yml in the dozzle-data volume). One-time setup
      # since dozzle-data is a named volume, not a bind mount:
      #   docker run --rm amir20/dozzle generate <username> --password '<password>' \
      #     | docker run -i --rm -v chatsift-v3-dozzle-data:/data alpine sh -c 'cat > /data/users.yml'
      DOZZLE_AUTH_PROVIDER: simple
    ports:
      - 127.0.0.1:${LOCAL_DOZZLE_PORT}:8080

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.49.1
    restart: unless-stopped
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
      - /dev/disk:/dev/disk:ro
      # cAdvisor's own docker client needs this directly for container discovery - its remote/
      # TCP docker-host support is flaky. Already privileged with deep host mounts above, so
      # the marginal risk of this on top is small; not internet-facing regardless.
      - /var/run/docker.sock:/var/run/docker.sock:ro

  node-exporter:
    image: prom/node-exporter:v1.8.2
    restart: unless-stopped
    pid: host
    volumes:
      - /:/host:ro,rslave
    command:
      - '--path.rootfs=/host'

  prometheus:
    image: prom/prometheus:v2.55.1
    restart: unless-stopped
    volumes:
      - ./build/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./build/prometheus/metrics_secret:/etc/prometheus/metrics_secret:ro
      - prometheus-data:/prometheus
    depends_on:
      - api
      - cadvisor
      - node-exporter
      - postgres-exporter

  grafana:
    image: grafana/grafana:11.4.0
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    environment:
      GF_SERVER_ROOT_URL: https://grafana.automoderator.app/
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      GF_AUTH_ANONYMOUS_ENABLED: 'false'
      GF_USERS_ALLOW_SIGN_UP: 'false'
      # Discord OAuth is the only sign-in path - GRAFANA_ADMIN_PASSWORD still exists as a
      # break-glass account, just not reachable via login UI or basic auth. Recovery if OAuth
      # ever misconfigures: flip these back via SSH and `./compose up -d --force-recreate grafana`.
      GF_AUTH_DISABLE_LOGIN_FORM: 'true'
      GF_AUTH_BASIC_ENABLED: 'false'
      # Discord's OAuth2 has no `sub` claim (just a plain `id` field), so Grafana can't match
      # returning users the normal way and tries to recreate them on every re-login, colliding
      # with the existing account. This falls back to matching by email. Safe here specifically
      # because ROLE_ATTRIBUTE_STRICT + the ADMINS-derived allowlist above is the actual access
      # boundary - only already-allowlisted Discord IDs ever get a role at all.
      GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP: 'true'
      GF_AUTH_GENERIC_OAUTH_ENABLED: 'true'
      GF_AUTH_GENERIC_OAUTH_NAME: Discord
      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ${OAUTH_DISCORD_CLIENT_ID}
      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${OAUTH_DISCORD_CLIENT_SECRET}
      GF_AUTH_GENERIC_OAUTH_SCOPES: 'identify email'
      GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://discord.com/api/oauth2/authorize
      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://discord.com/api/oauth2/token
      GF_AUTH_GENERIC_OAUTH_API_URL: https://discord.com/api/users/@me
      GF_AUTH_GENERIC_OAUTH_USE_PKCE: 'true'
      GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: 'true'
      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT: 'true'
      # Derived from ADMINS by ./compose - only those Discord user IDs can log in.
      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: ${GRAFANA_OAUTH_ROLE_ATTRIBUTE_PATH}
    volumes:
      - ./build/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./build/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - grafana-data:/var/lib/grafana
    ports:
      - 127.0.0.1:${LOCAL_GRAFANA_PORT}:3000
    depends_on:
      - prometheus

  redis:
    image: redis:6-alpine
    restart: unless-stopped
    # Nothing in the stack treats Redis as a source of truth (GuildList/instance snapshots republish on an
    # interval, PendingTicketStore mirrors the durable `pending_tickets` table, grant-token claims are
    # best-effort) -- so it runs fully in-memory: no RDB snapshotting (`--save ''`), no AOF. Removes the only
    # disk-backed state that would otherwise need at-rest encryption, and skips the fsync/bgsave overhead.
    command: ['redis-server', '--save', '', '--appendonly', 'no']
    healthcheck:
      test: ['CMD-SHELL', 'redis-cli ping']
      interval: 10s
      timeout: 5s
    ports:
      - 127.0.0.1:6379:6379

  # The single rate-limit accountant in front of Discord's REST API -- see
  # docs/roadmap/01-architecture.md §9. Every bot token is in use from two processes (its own `*-bot`
  # service and `api`), and `@discordjs/rest` keeps bucket state per instance, so without this each token
  # has two accountants that each only see half of what it actually sent. One process serves every token:
  # it partitions its state by the inbound `Authorization` header, which is also why onboarding a custom
  # ModMail instance (with its own token, added at runtime) needs no change here.
  #
  # Deliberately not published to the host, unlike `api`/`redis`: bot tokens cross this hop.
  discord-proxy:
    image: chatsift/chatsift-next:discord-proxy
    build:
      context: ./
      dockerfile: ./Dockerfile
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    command: ['node', '--enable-source-maps', './services/discord-proxy/dist/bin.js']
    healthcheck:
      test: ['CMD-SHELL', 'wget -q -O /dev/null http://127.0.0.1:${DISCORD_PROXY_PORT}/health']
      interval: 10s
      timeout: 5s
    volumes:
      - ./logs/discord-proxy:/usr/chatsift/logs/discord-proxy

  api:
    image: chatsift/chatsift-next:api
    build:
      context: ./
      dockerfile: ./Dockerfile
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    # Every client waits for the proxy rather than racing it: `REST` clients are built at import time, and a
    # base URL that isn't listening yet would have the process flap on startup. Note this stays in place even
    # when the proxy is switched off -- the kill switch is unsetting `DISCORD_PROXY_URL_PROD`, which sends
    # every client straight back to discord.com while this container keeps sitting there idle.
    depends_on:
      discord-proxy:
        condition: service_healthy
    command: ['node', '--enable-source-maps', './services/api/dist/bin.js']
    ports:
      - 127.0.0.1:${API_PORT}:${API_PORT}
    volumes:
      - ./logs/api:/usr/chatsift/logs/api

  ama-bot:
    image: chatsift/chatsift-next:ama
    build:
      context: ./
      dockerfile: ./Dockerfile
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    depends_on:
      discord-proxy:
        condition: service_healthy
    # Maps the per-bot value from the env files onto the generic name bot-core reads, so `./compose` can
    # size this service's replica count from it while the container itself stays bot-agnostic. Unset means
    # one replica running every shard. `./compose up` computes `--scale` from the same value.
    environment:
      SHARDS_PER_REPLICA: ${AMA_SHARDS_PER_REPLICA:-}
    command: ['node', '--enable-source-maps', './services/ama-bot/dist/bin.js']
    volumes:
      - ./logs/ama-bot:/usr/chatsift/logs/ama-bot

  modmail-bot:
    image: chatsift/chatsift-next:modmail
    build:
      context: ./
      dockerfile: ./Dockerfile
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    depends_on:
      discord-proxy:
        condition: service_healthy
    environment:
      SHARDS_PER_REPLICA: ${MODMAIL_SHARDS_PER_REPLICA:-}
    command: ['node', '--enable-source-maps', './services/modmail-bot/dist/bin.js']
    volumes:
      - ./logs/modmail-bot:/usr/chatsift/logs/modmail-bot

  social-bot:
    image: chatsift/chatsift-next:social
    build:
      context: ./
      dockerfile: ./Dockerfile
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    depends_on:
      discord-proxy:
        condition: service_healthy
    environment:
      SHARDS_PER_REPLICA: ${SOCIAL_SHARDS_PER_REPLICA:-}
    command: ['node', '--enable-source-maps', './services/social-bot/dist/bin.js']
    volumes:
      - ./logs/social-bot:/usr/chatsift/logs/social-bot

  # Template for a branded, single-guild ModMail deployment (#216) -- see
  # docs/roadmap/01-architecture.md §8 and the onboarding/offboarding runbook in
  # docs/workflow.md. Copy this block once per approved partner (one block per instance -- these are
  # hand-managed, not self-serve, see decision 1 in the roadmap doc), replacing `<partner-slug>`
  # throughout with that partner's `modmail_instances.id` row. Everything else (image, build context,
  # env files) is identical to the public `modmail-bot` service above; `MODMAIL_INSTANCE_ID` is the only
  # thing that locks this process to that one guild/token.
  # modmail-bot-<partner-slug>:
  #   image: chatsift/chatsift-next:modmail
  #   build:
  #     context: ./
  #     dockerfile: ./Dockerfile
  #   restart: unless-stopped
  #   env_file:
  #     - ./.env.public
  #     - ./.env.private
  #   environment:
  #     MODMAIL_INSTANCE_ID: '<partner-slug>'
  #   depends_on:
  #     discord-proxy:
  #       condition: service_healthy
  #   command: ['node', '--enable-source-maps', './services/modmail-bot/dist/bin.js']
  #   volumes:
  #     - ./logs/modmail-bot-<partner-slug>:/usr/chatsift/logs/modmail-bot-<partner-slug>

  # First real instance of the template above, and the first partner onboarded with pre-existing
  # legacy history (migrated 2026-08-12, `--source nascar`). Runs as their *legacy* application's
  # bot user rather than a fresh one, so their members keep the same DM correspondent -- which means
  # their old self-hosted deployment must never run again: same token, same gateway identity.
  modmail-bot-nascar:
    image: chatsift/chatsift-next:modmail
    build:
      context: ./
      dockerfile: ./Dockerfile
    restart: unless-stopped
    env_file:
      - ./.env.public
      - ./.env.private
    environment:
      MODMAIL_INSTANCE_ID: 'nascar'
    depends_on:
      discord-proxy:
        condition: service_healthy
    command: ['node', '--enable-source-maps', './services/modmail-bot/dist/bin.js']
    volumes:
      - ./logs/modmail-bot-nascar:/usr/chatsift/logs/modmail-bot-nascar

volumes:
  postgres-data:
    name: 'chatsift-v3-postgres-data'
  dozzle-data:
    name: 'chatsift-v3-dozzle-data'
  prometheus-data:
    name: 'chatsift-v3-prometheus-data'
  grafana-data:
    name: 'chatsift-v3-grafana-data'

networks:
  default:
    name: chatsift-v3