ystp/docker/docker-compose.prod.yml

name: imageforge

x-imageforge-environment: &imageforge-environment
  DATABASE_URL: postgres://imageforge:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@postgres:5432/imageforge
  DATABASE_MAX_CONNECTIONS: ${DATABASE_MAX_CONNECTIONS:-16}
  REDIS_URL: redis://redis:6379
  JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
  JWT_EXPIRY_HOURS: ${JWT_EXPIRY_HOURS:-168}
  API_KEY_PEPPER: ${API_KEY_PEPPER:?API_KEY_PEPPER is required}
  BILLING_PROVIDER: ${BILLING_PROVIDER:-stripe}
  STORAGE_PATH: /app/uploads
  PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:8080}
  WORKER_TASK_CONCURRENCY: ${WORKER_TASK_CONCURRENCY:-4}
  WORKER_CONCURRENCY: ${WORKER_CONCURRENCY:-2}
  IMAGE_PROCESSING_CONCURRENCY: ${IMAGE_PROCESSING_CONCURRENCY:-2}
  ALLOW_ANONYMOUS_UPLOAD: ${ALLOW_ANONYMOUS_UPLOAD:-true}
  ANON_MAX_FILE_SIZE_MB: ${ANON_MAX_FILE_SIZE_MB:-5}
  ANON_MAX_FILES_PER_BATCH: ${ANON_MAX_FILES_PER_BATCH:-5}
  ANON_DAILY_UNITS: ${ANON_DAILY_UNITS:-10}
  ANON_RETENTION_HOURS: ${ANON_RETENTION_HOURS:-24}
  MAX_IMAGE_PIXELS: ${MAX_IMAGE_PIXELS:-40000000}
  IDEMPOTENCY_TTL_HOURS: ${IDEMPOTENCY_TTL_HOURS:-24}
  TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
  RUST_LOG: ${RUST_LOG:-info,tower_http=info,imageforge=info}

services:
  postgres:
    image: postgres:16-alpine
    mem_limit: ${POSTGRES_MEMORY_LIMIT:-2g}
    pids_limit: 256
    environment:
      POSTGRES_DB: imageforge
      POSTGRES_USER: imageforge
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U imageforge -d imageforge"]
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    mem_limit: ${REDIS_MEMORY_LIMIT:-1g}
    pids_limit: 128
    command: ["redis-server", "--appendonly", "yes", "--maxmemory", "${REDIS_MAXMEMORY:-768mb}", "--maxmemory-policy", "noeviction"]
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  api:
    image: imageforge:${IMAGEFORGE_TAG:-local}
    mem_limit: ${API_MEMORY_LIMIT:-3g}
    pids_limit: 256
    build:
      context: ..
      dockerfile: docker/Dockerfile
      args:
        DEBIAN_MIRROR: ${DEBIAN_MIRROR:-http://deb.debian.org/debian}
        CARGO_REGISTRY_MIRROR: ${CARGO_REGISTRY_MIRROR:-}
    init: true
    environment:
      <<: *imageforge-environment
      IMAGEFORGE_ROLE: api
      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
      ADMIN_USERNAME: ${ADMIN_USERNAME:-}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
      STRIPE_SECRET_KEY: "${STRIPE_SECRET_KEY:-}"
      STRIPE_WEBHOOK_SECRET: "${STRIPE_WEBHOOK_SECRET:-}"
      MAIL_ENABLED: ${MAIL_ENABLED:-false}
      MAIL_LOG_LINKS_WHEN_DISABLED: ${MAIL_LOG_LINKS_WHEN_DISABLED:-false}
      MAIL_PROVIDER: ${MAIL_PROVIDER:-qq}
      MAIL_FROM: ${MAIL_FROM:-noreply@example.com}
      MAIL_PASSWORD: "${MAIL_PASSWORD:-}"
      MAIL_FROM_NAME: ${MAIL_FROM_NAME:-ImageForge}
      MAIL_SMTP_HOST: "${MAIL_SMTP_HOST:-}"
      MAIL_SMTP_PORT: "${MAIL_SMTP_PORT:-}"
      MAIL_SMTP_ENCRYPTION: "${MAIL_SMTP_ENCRYPTION:-}"
    ports:
      - "${IMAGEFORGE_BIND_ADDRESS:-127.0.0.1}:${IMAGEFORGE_PORT:-8080}:8080"
    volumes:
      - uploads:/app/uploads
    tmpfs:
      - /tmp:size=256m,mode=1777
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:8080/health"]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 20s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    restart: unless-stopped

  worker:
    image: imageforge:${IMAGEFORGE_TAG:-local}
    mem_limit: ${WORKER_MEMORY_LIMIT:-8g}
    pids_limit: 512
    init: true
    environment:
      <<: *imageforge-environment
      IMAGEFORGE_ROLE: worker
    volumes:
      - uploads:/app/uploads
    tmpfs:
      - /tmp:size=256m,mode=1777
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      api:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data:
  uploads: