feat: run DTF stack with Cloudflare R2

2026-09-18 11:51:54 -03:00
parent dabb4db2e3
commit e3e37f674d
7 changed files with 216 additions and 156 deletions
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,157 +1,183 @@
-x-app: &app
-  image: ${API_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-api}:${IMAGE_TAG:-latest}
-  environment: &environment
-    APP_ENV: ${APP_ENV:-local}
-    DATABASE_URL: postgresql://${APP_DB_USER:-dtf_app}:${APP_DB_PASSWORD:-local-app-database-only}@db:5432/${POSTGRES_DB:-dtf_local}
-    S3_ENDPOINT: http://storage:9000
-    S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:9000}
-    S3_BUCKET: ${S3_BUCKET:-dtf-local-artwork}
-    AWS_ACCESS_KEY_ID: ${S3_APP_USER:-dtf_app}
-    AWS_SECRET_ACCESS_KEY: ${S3_APP_PASSWORD:-local-app-storage-only}
-    AWS_DEFAULT_REGION: us-east-1
-    OPERATOR_USER: ${OPERATOR_USER:-operator}
-    OPERATOR_PASSWORD: ${OPERATOR_PASSWORD:-local-operator-only}
-    PAYMENT_ADAPTER: ${PAYMENT_ADAPTER:-fake}
-    FREIGHT_ADAPTER: ${FREIGHT_ADAPTER:-fake}
-    TINY_ADAPTER: ${TINY_ADAPTER:-fake}
-    WHATSAPP_ADAPTER: ${WHATSAPP_ADAPTER:-fake}
-    STORAGE_ADAPTER: ${STORAGE_ADAPTER:-s3-local}
-    MOCK_FREIGHT_CENTS: ${MOCK_FREIGHT_CENTS:-1500}
-    MAX_UPLOAD_BYTES: ${MAX_UPLOAD_BYTES:-5368709120}
-    UPLOAD_PART_BYTES: ${UPLOAD_PART_BYTES:-8388608}
-    STORAGE_QUOTA_BYTES: ${STORAGE_QUOTA_BYTES:-53687091200}
-    OWNER_UPLOAD_QUOTA_BYTES: ${OWNER_UPLOAD_QUOTA_BYTES:-10737418240}
-    MAX_PENDING_UPLOADS: ${MAX_PENDING_UPLOADS:-10}
-    SCAN_MAX_BYTES: ${SCAN_MAX_BYTES:-134217728}
-  networks: [local]
-  init: true
-  security_opt: [no-new-privileges:true]
-  cap_drop: [ALL]
-  read_only: true
-  tmpfs: [/tmp]
-  logging:
-    driver: json-file
-    options: {max-size: "10m", max-file: "3"}
-  deploy:
-    resources:
-      limits:
-        pids: 128
+version: "3.8"
+
+x-app-environment: &app-environment
+  APP_ENV: production
+  DATABASE_URL: postgresql://dtf_app:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/dtf
+  S3_ENDPOINT: ${R2_ENDPOINT:?set R2_ENDPOINT}
+  S3_PUBLIC_ENDPOINT: ${R2_ENDPOINT:?set R2_ENDPOINT}
+  S3_BUCKET: ${R2_BUCKET:?set R2_BUCKET}
+  AWS_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID:?set R2_ACCESS_KEY_ID}
+  AWS_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY:?set R2_SECRET_ACCESS_KEY}
+  AWS_DEFAULT_REGION: auto
+  OPERATOR_USER: operator
+  OPERATOR_PASSWORD: ${OPERATOR_PASSWORD:?set OPERATOR_PASSWORD}
+  PAYMENT_ADAPTER: fake
+  FREIGHT_ADAPTER: fake
+  TINY_ADAPTER: fake
+  WHATSAPP_ADAPTER: fake
+  STORAGE_ADAPTER: s3-r2
+  PUBLIC_ORIGIN: https://${SITE_DOMAIN:?set SITE_DOMAIN}
+  PUBLIC_HOST: ${SITE_DOMAIN:?set SITE_DOMAIN}
+  ALLOWED_HOSTS: ${SITE_DOMAIN:?set SITE_DOMAIN},${KANBAN_DOMAIN:?set KANBAN_DOMAIN}
+  ALLOWED_ORIGINS: https://${SITE_DOMAIN:?set SITE_DOMAIN},https://${KANBAN_DOMAIN:?set KANBAN_DOMAIN}
+  COOKIE_SECURE: "true"
+  MAX_UPLOAD_BYTES: "5368709120"
+  UPLOAD_PART_BYTES: "8388608"
+  STORAGE_QUOTA_BYTES: "53687091200"
+  OWNER_UPLOAD_QUOTA_BYTES: "10737418240"
+  MAX_PENDING_UPLOADS: "10"
+  SCAN_MAX_BYTES: "134217728"
+
 services:
-  scanner:
-    image: clamav/clamav@sha256:9cb27d7660bdf66e9878c832cb433dd8aa152cfbe16f3c2c0084c80b04ae22b4
-    entrypoint: [clamd, --foreground=true, --config-file=/etc/clamav/clamd.conf]
-    volumes: [./local/clamd.conf:/etc/clamav/clamd.conf:ro]
-    networks: [local]
-    security_opt: [no-new-privileges:true]
+  db:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: dtf
+      POSTGRES_USER: dtf_admin
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
+    volumes: [postgres-data:/var/lib/postgresql/data]
+    networks: [backend]
    healthcheck:
-      test: [CMD, clamdscan, --config-file=/etc/clamav/clamd.conf, --ping, "3"]
-      start_period: 60s
+      test: [CMD-SHELL, 'pg_isready -U "$$POSTGRES_USER" -d "$$POSTGRES_DB"']
      interval: 10s
      timeout: 5s
-      retries: 30
+      retries: 12
+      start_period: 20s
    deploy:
-      resources:
-        limits:
-          memory: 3G
-          pids: 128
+      replicas: 1
+      restart_policy: {condition: on-failure, delay: 10s}
+
  db-init:
    image: ${API_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-api}:${IMAGE_TAG:-latest}
    command: python -m local.bootstrap
    environment:
-      DATABASE_ADMIN_URL: postgresql://${POSTGRES_USER:-dtf_local}:${POSTGRES_PASSWORD:-local-database-only}@db:5432/${POSTGRES_DB:-dtf_local}
-      APP_DB_USER: ${APP_DB_USER:-dtf_app}
-      APP_DB_PASSWORD: ${APP_DB_PASSWORD:-local-app-database-only}
-    networks: [local]
-    depends_on: [db]
-  storage-init:
-    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
-    entrypoint: [/bin/sh, /init.sh]
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-dtf_local}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-local-storage-only}
-      S3_APP_USER: ${S3_APP_USER:-dtf_app}
-      S3_APP_PASSWORD: ${S3_APP_PASSWORD:-local-app-storage-only}
-      S3_BUCKET: ${S3_BUCKET:-dtf-local-artwork}
-    volumes:
-      - ./local/storage-init.sh:/init.sh:ro
-      - ./local/storage-policy.json:/policy.json:ro
-      - ./local/storage-lifecycle.json:/lifecycle.json:ro
-    networks: [local]
-    depends_on: [storage]
-  db:
-    image: postgres:17-alpine
-    environment:
-      POSTGRES_DB: ${POSTGRES_DB:-dtf_local}
-      POSTGRES_USER: ${POSTGRES_USER:-dtf_local}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-local-database-only}
-    volumes: [postgres-data:/var/lib/postgresql/data]
-    networks: [local]
+      DATABASE_ADMIN_URL: postgresql://dtf_admin:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/dtf
+      APP_DB_USER: dtf_app
+      APP_DB_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
+    networks: [backend]
+    deploy:
+      replicas: 1
+      restart_policy: {condition: on-failure, delay: 5s, max_attempts: 20}
+
+  scanner:
+    image: clamav/clamav@sha256:9cb27d7660bdf66e9878c832cb433dd8aa152cfbe16f3c2c0084c80b04ae22b4
+    entrypoint: [clamd, --foreground=true, --config-file=/etc/clamav/clamd.conf]
+    configs:
+      - source: clamd_config
+        target: /etc/clamav/clamd.conf
+        mode: 0444
+    networks: [backend]
    healthcheck:
-      test: [CMD-SHELL, 'pg_isready -U "$$POSTGRES_USER" -d "$$POSTGRES_DB"']
-      interval: 5s
-      timeout: 3s
-      retries: 30
-  storage:
-    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
-    command: server /data --console-address :9001
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-dtf_local}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-local-storage-only}
-    ports: ["127.0.0.1:9000:9000", "127.0.0.1:9001:9001"]
-    volumes: [storage-data:/data]
-    networks: [local, edge]
-    healthcheck:
-      test: [CMD, curl, -f, http://localhost:9000/minio/health/ready]
-      interval: 5s
-      timeout: 3s
-      retries: 30
+      test: [CMD, clamdscan, --config-file=/etc/clamav/clamd.conf, --ping, "3"]
+      interval: 15s
+      timeout: 5s
+      retries: 20
+      start_period: 90s
+    deploy:
+      replicas: 1
+      restart_policy: {condition: on-failure, delay: 10s}
+      resources:
+        limits: {memory: 3G}
+
  api:
-    <<: *app
-    command: uvicorn local.app:app --host 0.0.0.0 --port 8000 --no-access-log
-    depends_on: [db-init, storage-init]
+    image: ${API_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-api}:${IMAGE_TAG:-latest}
+    environment: *app-environment
+    networks: [backend, egress]
+    read_only: true
+    tmpfs: [/tmp]
    healthcheck:
-      test: [CMD, python, -c, "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
-      interval: 5s
-      timeout: 3s
-      retries: 30
-  worker:
-    <<: *app
-    command: python -m local.worker
-    depends_on: [api, scanner]
-    healthcheck:
-      test: [CMD, python, -c, "import urllib.request; urllib.request.urlopen('http://localhost:8002/health')"]
-      interval: 5s
-      timeout: 3s
+      test: [CMD-SHELL, 'python -c "import os,urllib.request; r=urllib.request.Request(\"http://localhost:8000/health\",headers={\"Host\":os.environ[\"PUBLIC_HOST\"]}); urllib.request.urlopen(r,timeout=3)"']
+      interval: 15s
+      timeout: 5s
      retries: 12
+      start_period: 30s
+    deploy:
+      replicas: 1
+      restart_policy: {condition: on-failure, delay: 5s}
+
+  worker:
+    image: ${API_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-api}:${IMAGE_TAG:-latest}
+    command: python -m local.worker
+    environment: *app-environment
+    networks: [backend, egress]
+    read_only: true
+    tmpfs: [/tmp]
+    healthcheck:
+      test: [CMD, python, -c, "import urllib.request; urllib.request.urlopen('http://localhost:8002/health',timeout=3)"]
+      interval: 15s
+      timeout: 5s
+      retries: 12
+      start_period: 90s
+    deploy:
+      replicas: 1
+      restart_policy: {condition: on-failure, delay: 5s}
+
  site:
    image: ${WEB_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-web}:${IMAGE_TAG:-latest}
    environment:
-      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:9000}
-    ports: ["127.0.0.1:${SITE_PORT:-8080}:80", "127.0.0.1:${API_PORT:-8000}:81"]
-    networks: [local, edge]
-    depends_on: [api]
+      WEB_INDEX: index.html
+      PUBLIC_HOST: ${SITE_DOMAIN:?set SITE_DOMAIN}
+      S3_PUBLIC_ENDPOINT: ${R2_ENDPOINT:?set R2_ENDPOINT}
+    networks: [backend]
+    ports:
+      - target: 8080
+        published: ${SITE_PORT:-18080}
+        protocol: tcp
+        mode: ingress
+    read_only: true
+    tmpfs:
+      - /tmp:uid=101,gid=101,mode=0750
+      - /var/cache/nginx:uid=101,gid=101,mode=0750
+      - /var/run:uid=101,gid=101,mode=0750
+      - /etc/nginx/conf.d:uid=101,gid=101,mode=0750
    healthcheck:
-      test: [CMD, wget, -q, -O, /dev/null, http://127.0.0.1/health]
-      interval: 5s
-      timeout: 3s
+      test: [CMD-SHELL, 'wget -q --header="Host: $$PUBLIC_HOST" -O /dev/null http://127.0.0.1:8080/health']
+      interval: 15s
+      timeout: 5s
      retries: 12
+      start_period: 15s
+    deploy:
+      replicas: 1
+      restart_policy: {condition: on-failure, delay: 5s}
+
  kanban:
    image: ${WEB_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-web}:${IMAGE_TAG:-latest}
    environment:
      WEB_INDEX: kanban.html
-      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:9000}
-    ports: ["127.0.0.1:${KANBAN_PORT:-8081}:80"]
-    networks: [local, edge]
-    depends_on: [api]
+      PUBLIC_HOST: ${KANBAN_DOMAIN:?set KANBAN_DOMAIN}
+      S3_PUBLIC_ENDPOINT: ${R2_ENDPOINT:?set R2_ENDPOINT}
+    networks: [backend]
+    ports:
+      - target: 8080
+        published: ${KANBAN_PORT:-18081}
+        protocol: tcp
+        mode: ingress
+    read_only: true
+    tmpfs:
+      - /tmp:uid=101,gid=101,mode=0750
+      - /var/cache/nginx:uid=101,gid=101,mode=0750
+      - /var/run:uid=101,gid=101,mode=0750
+      - /etc/nginx/conf.d:uid=101,gid=101,mode=0750
    healthcheck:
-      test: [CMD, wget, -q, -O, /dev/null, http://127.0.0.1/health]
-      interval: 5s
-      timeout: 3s
+      test: [CMD-SHELL, 'wget -q --header="Host: $$PUBLIC_HOST" -O /dev/null http://127.0.0.1:8080/health']
+      interval: 15s
+      timeout: 5s
      retries: 12
+      start_period: 15s
+    deploy:
+      replicas: 1
+      restart_policy: {condition: on-failure, delay: 5s}
+
+configs:
+  clamd_config:
+    file: ./local/clamd.conf
+
 volumes:
  postgres-data:
-  storage-data:
+
 networks:
-  local:
+  backend:
+    driver: overlay
    internal: true
-  edge:
+  egress:
+    driver: overlay