docker-compose.hub.yml

# CodeBox - single-file deployment.
#
# Everything needed is in this one file: it pulls prebuilt images from Docker
# Hub and carries the Caddy and Prometheus configs inline, so there is nothing
# to clone and nothing to build.
#
#   1. Save this file on your server as docker-compose.yml
#   2. Create a .env beside it (see the block at the bottom of this file)
#   3. docker compose up -d
#
# Requires Docker Compose v2.23+ for inline configs. Check with:
#   docker compose version

services:
  caddy:
    image: caddy:2-alpine
    ports:
      - "80:80"
      - "443:443"
    environment:
      # Blank/unset DOMAIN => ":80" => plain HTTP on the server's IP, no SSL.
      - SITE_ADDRESS=${DOMAIN:-:80}
      - "METRICS_TOKEN=${METRICS_TOKEN:?METRICS_TOKEN must be set (generate one with openssl rand -hex 16)}"
    configs:
      - source: caddyfile
        target: /etc/caddy/Caddyfile
    volumes:
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - api
    restart: always
    deploy:
      resources:
        limits:
          cpus: '${CADDY_CPUS:-0.25}'
          memory: ${CADDY_MEMORY:-128M}

  api:
    image: ${CODEBOX_IMAGE_NAMESPACE:-hiteshchoudhary}/codebox-api:${CODEBOX_VERSION:-latest}
    environment:
      - NODE_ENV=production
      - REDIS_URL=redis://redis:6379
      - "AUTH_TOKEN=${AUTH_TOKEN:?AUTH_TOKEN must be set - an empty token disables auth entirely}"
      - PORT=3000
      - BODY_LIMIT=50mb
      - RATE_LIMIT_MAX_REQUESTS=${RATE_LIMIT_MAX_REQUESTS:-200}
    depends_on:
      - redis
    restart: always
    deploy:
      resources:
        limits:
          cpus: '${API_CPUS:-0.25}'
          memory: ${API_MEMORY:-256M}

  worker:
    image: ${CODEBOX_IMAGE_NAMESPACE:-hiteshchoudhary}/codebox-worker:${CODEBOX_VERSION:-latest}
    command: node src/queue/worker.js
    privileged: true
    # isolate writes to /sys/fs/cgroup/cgroup.subtree_control; the host cgroup
    # namespace is required for that to take effect.
    cgroup: host
    environment:
      - NODE_ENV=production
      - REDIS_URL=redis://redis:6379
      - EXECUTOR_TYPE=isolate
      - WORKER_CONCURRENCY=${WORKER_CONCURRENCY:-2}
      - DEFAULT_MEMORY_LIMIT=${DEFAULT_MEMORY_LIMIT:-256000}
      - MAX_MEMORY_LIMIT=${MAX_MEMORY_LIMIT:-512000}
      - RESULT_CACHE_TTL=${RESULT_CACHE_TTL:-1800}
    depends_on:
      - redis
    restart: always
    deploy:
      resources:
        limits:
          # Must not exceed the host's vCPU count or Docker refuses to start it.
          cpus: '${WORKER_CPUS:-1.5}'
          memory: ${WORKER_MEMORY:-4G}

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes --maxmemory ${REDIS_MAXMEMORY:-256mb} --maxmemory-policy noeviction
    restart: always
    deploy:
      resources:
        limits:
          cpus: '${REDIS_CPUS:-0.25}'
          memory: ${REDIS_MEMORY:-384M}

  prometheus:
    image: prom/prometheus:latest
    configs:
      - source: prometheus_yml
        target: /etc/prometheus/prometheus.yml
    volumes:
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=${PROMETHEUS_RETENTION:-7d}'
    restart: always
    deploy:
      resources:
        limits:
          cpus: '${PROMETHEUS_CPUS:-0.25}'
          memory: ${PROMETHEUS_MEMORY:-512M}

  grafana:
    image: grafana/grafana:latest
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      - "GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:?GRAFANA_PASSWORD must be set}"
      - GF_USERS_ALLOW_SIGN_UP=false
    restart: always
    deploy:
      resources:
        limits:
          cpus: '${GRAFANA_CPUS:-0.25}'
          memory: ${GRAFANA_MEMORY:-256M}

configs:
  caddyfile:
    content: |
      # DOMAIN blank -> ":80" -> plain HTTP on the server IP, no certificate.
      # DOMAIN set   -> that hostname -> automatic HTTPS via Let's Encrypt.
      {$$SITE_ADDRESS::80} {
          @metrics {
              path /metrics/*
              header X-Metrics-Token {$$METRICS_TOKEN}
          }
          handle @metrics {
              uri strip_prefix /metrics
              reverse_proxy prometheus:9090
          }
          handle /metrics/* {
              respond "Unauthorized" 401
          }

          reverse_proxy api:3000

          encode gzip

          header {
              X-Content-Type-Options nosniff
              X-Frame-Options DENY
              Referrer-Policy strict-origin-when-cross-origin
              -Server
          }

          log {
              output stdout
              format json
          }
      }

  prometheus_yml:
    content: |
      global:
        scrape_interval: 15s
        evaluation_interval: 15s
      scrape_configs:
        - job_name: 'prometheus'
          static_configs:
            - targets: ['localhost:9090']
        - job_name: 'codebox-api'
          static_configs:
            - targets: ['api:3000']
          metrics_path: '/metrics'

volumes:
  redis_data:
  prometheus_data:
  grafana_data:
  caddy_data:
  caddy_config: