docker-compose.prod.yml

services:
  postgres:
    image: postgres:17
    command: postgres -c max_connections=400
    environment:
      POSTGRES_DB: projectwarehouse
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    ports:
      - "5433:5432"
    networks:
      - projectwarehouse
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d projectwarehouse"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s
    restart: unless-stopped

  projectwarehouse.server:
    image: ${REGISTRY_HOST:-local}/projectwarehouse.server:${IMAGE_TAG:-latest}
    ports:
      - "4587:8080"
    networks:
      - projectwarehouse
    environment:
      - ConnectionStrings__DefaultConnection=Host=postgres;Port=5432;Database=projectwarehouse;Username=postgres;Password=${POSTGRES_PASSWORD};Maximum Pool Size=200
      - Jwt__SecretKey=${Jwt__SecretKey}
      - Seed__AdminPassword=${Seed__AdminPassword}
    volumes:
      - dataprotection_keys:/keys
      - datafiles_storage:/data/files
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped

  # Docker creates the mount point of a named volume as root:root, and the collector image runs as
  # 10001 — without this the file exporter dies on its first write and the container restart-loops.
  otel-telemetry-init:
    image: busybox:1.37.0
    user: "0:0"
    command: ["sh", "-c", "chown 10001:10001 /telemetry && chmod 750 /telemetry"]
    volumes:
      - telemetry_data:/telemetry
    restart: "no"

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.159.0
    command: ["--config=/etc/otel/config.yaml"]
    networks:
      - projectwarehouse
    volumes:
      - ./otel/collector.prod.yaml:/etc/otel/config.yaml:ro
      - telemetry_data:/telemetry
    depends_on:
      otel-telemetry-init:
        condition: service_completed_successfully
    # memory_limiter caps the collector's own heap accounting, not the process RSS
    mem_limit: 256m
    restart: unless-stopped

networks:
  projectwarehouse:
    driver: bridge

volumes:
  postgres_data:
  # Losing this volume makes every stored marketplace Api-Key undecryptable — back it up alongside the DB.
  dataprotection_keys:
  # Not self-contained: without a DB dump the file names on disk map to nothing. Back it up together with the DB.
  datafiles_storage:
  # Holds user names and SQL text. Same handling as datafiles_storage; rotation caps it at ~2.5 GB.
  telemetry_data: