compose.yaml

name: webmonitor-agent

x-runtime: &runtime
  user: "10001:10001"
  init: true
  read_only: true
  cap_drop: [ALL]
  security_opt: [no-new-privileges:true]
  tmpfs: ["/tmp:rw,nosuid,nodev,size=128m,uid=10001,gid=10001,mode=1777"]
  restart: unless-stopped

x-app-env: &app-env
  PGHOST: postgres
  PGPORT: "5432"
  PGDATABASE: webmonitor
  PGUSER: webmonitor
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
  APP_ORIGIN: ${APP_ORIGIN:-http://localhost:8080}
  DEVELOPMENT_MODE: ${DEVELOPMENT_MODE:-true}
  CONTAINER_RUNTIME: "true"
  SECRET_KEY: ${SECRET_KEY:?Set SECRET_KEY (>=32 characters) in .env}
  SESSION_TTL_HOURS: ${SESSION_TTL_HOURS:-168}
  ADMIN_EMAIL: ${ADMIN_EMAIL:-}
  ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
  REGISTRATION_ALLOWED_EMAILS: ${REGISTRATION_ALLOWED_EMAILS:-}
  DEFAULT_INTERVAL_SECONDS: ${DEFAULT_INTERVAL_SECONDS:-3600}
  DEFAULT_NOTIFICATION_GROUP: ${DEFAULT_NOTIFICATION_GROUP:-}
  DEFAULT_DELIVERY_CHANNEL: ${DEFAULT_DELIVERY_CHANNEL:-email}
  DEFAULT_WEBHOOK_URL: ${DEFAULT_WEBHOOK_URL:-}
  OPENAI_API_KEY: ${OPENAI_API_KEY:-}
  OPENAI_BASE_URL: ${OPENAI_BASE_URL:-https://api.openai.com/v1}
  OPENAI_CONTAINER_BASE_URL: ${OPENAI_CONTAINER_BASE_URL:-}
  OPENAI_MODEL: ${OPENAI_MODEL:-}
  S3_ENDPOINT_URL: http://s3:9000
  S3_BUCKET: ${S3_BUCKET:-webmonitor-evidence}
  S3_ACCESS_KEY_ID: ${S3_ROOT_USER:-webmonitor-admin}
  S3_SECRET_ACCESS_KEY: ${S3_ROOT_PASSWORD:-${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}}
  EGRESS_PROXY_URL: http://egress:3128
  SMTP_HOST: ${SMTP_HOST:-}
  SMTP_PORT: ${SMTP_PORT:-465}
  SMTP_USERNAME: ${SMTP_USERNAME:-}
  SMTP_PASSWORD: ${SMTP_PASSWORD:-}
  SMTP_USE_SSL: ${SMTP_USE_SSL:-true}
  SMTP_STARTTLS: ${SMTP_STARTTLS:-false}
  MAIL_FROM: ${MAIL_FROM:-}
  TARGET_POLICY: ${TARGET_POLICY:-public}
  TARGET_ALLOWED_ORIGINS: ${TARGET_ALLOWED_ORIGINS:-}
  TRUSTED_PROXY_IP: 172.30.80.10
  WORKERS_ENABLED: "true"

x-started: &started
  postgres: {condition: service_healthy}
  s3: {condition: service_healthy}

services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: webmonitor
      POSTGRES_DB: webmonitor
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
    tmpfs: ["/var/lib/postgresql/data:rw,nosuid,nodev,size=512m,mode=0700"]
    networks: [control]
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U webmonitor -d webmonitor"]
      interval: 3s
      timeout: 3s
      retries: 30
    restart: unless-stopped

  s3:
    <<: *runtime
    image: webmonitor-minio:local
    build: {context: ., dockerfile: deploy/minio.Dockerfile}
    command: [server, /data]
    environment:
      MINIO_ROOT_USER: ${S3_ROOT_USER:-webmonitor-admin}
      MINIO_ROOT_PASSWORD: ${S3_ROOT_PASSWORD:-${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}}
    tmpfs:
      - /tmp:rw,nosuid,nodev,size=32m,uid=10001,gid=10001,mode=1777
      - /data:rw,nosuid,nodev,size=512m,uid=10001,gid=10001,mode=0700
    networks: [control]
    healthcheck:
      test: [CMD, bash, -ec, 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n" >&3; read -r status <&3; [[ "$$status" == *" 200 "* ]]']
      interval: 3s
      timeout: 3s
      retries: 30

  egress:
    <<: *runtime
    image: webmonitor-egress:local
    build: {context: ., dockerfile: deploy/egress.Dockerfile}
    sysctls: {net.ipv4.ip_unprivileged_port_start: "0"}
    networks: [control, outbound]

  api:
    <<: *runtime
    image: ${WEBMONITOR_IMAGE:-ghcr.io/webmonitor/webmonitor-agent:latest}
    pull_policy: always
    command: [serve]
    cpus: 2
    mem_limit: 2g
    pids_limit: 256
    shm_size: 1g
    security_opt:
      - no-new-privileges:true
      - seccomp=./deploy/browser-seccomp.json
    environment: *app-env
    extra_hosts: ["host.docker.internal:host-gateway"]
    networks: [control, frontend, outbound]
    depends_on:
      <<: *started
      egress: {condition: service_started}
    healthcheck:
      test: [CMD, python, -c, "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/v1/health/ready', timeout=2).read()"]
      interval: 5s
      timeout: 3s
      retries: 60

  # Same image as `api`: one artifact, two entrypoints. Next.js needs a writable
  # /app/web/.next/cache and /tmp, which the read-only root plus tmpfs provides.
  web:
    <<: *runtime
    image: ${WEBMONITOR_IMAGE:-ghcr.io/webmonitor/webmonitor-agent:latest}
    pull_policy: always
    entrypoint: [node, /app/web/server.js]
    networks: [frontend]
    depends_on:
      api: {condition: service_healthy}
    healthcheck:
      test: [CMD, node, -e, "fetch('http://127.0.0.1:3000/login').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
      interval: 5s
      timeout: 3s
      retries: 30

  proxy:
    <<: *runtime
    image: nginx:1.28-alpine
    user: "101:101"
    entrypoint: [nginx, -g, "daemon off;"]
    tmpfs: ["/tmp:rw,nosuid,nodev,size=32m,uid=101,gid=101,mode=1777"]
    ports: ["127.0.0.1:${WEBMONITOR_HTTP_PORT:-8080}:8080"]
    volumes: ["./deploy/proxy/nginx.conf:/etc/nginx/nginx.conf:ro"]
    networks:
      frontend:
        ipv4_address: 172.30.80.10
      edge: {}
    depends_on:
      api: {condition: service_healthy}
      web: {condition: service_healthy}
    healthcheck:
      test: [CMD, wget, -q, -O, /dev/null, "http://127.0.0.1:8080/api/v1/health/ready"]
      interval: 5s
      timeout: 3s
      retries: 30

networks:
  control:
    internal: true
  frontend:
    internal: true
    ipam:
      config: [{subnet: 172.30.80.0/24}]
  outbound: {}
  edge: {}