FilesExpand file tree

codex/greenhouse-option-regression

/

docker-compose.prod.yml

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

179 lines (173 loc) · 8.82 KB

codex/greenhouse-option-regression

/

docker-compose.prod.yml

Copy path

Top

File metadata and controls

• Code
• Blame

179 lines (173 loc) · 8.82 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

services:

simstudio:

env_file:

- path: .env

required: false

# app, realtime and migrations share a database schema and must move together,

# so one variable drives all three. Set SIM_VERSION in .env to upgrade.

image: ghcr.io/simstudioai/simstudio:${SIM_VERSION:-latest}

restart: unless-stopped

ports:

- '3000:3000'

deploy:

resources:

limits:

memory: 8G

environment:

- NODE_ENV=production

- 'DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?is required. For a new install set it in .env to the output of: openssl rand -hex 24. An install created before it was required uses the password postgres - set POSTGRES_PASSWORD=postgres to keep its data.}@db:5432/${POSTGRES_DB:-simstudio}'

- BETTER_AUTH_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}

- NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}

# TRUSTED_ORIGINS: comma-separated public origins to trust for auth in

# addition to NEXT_PUBLIC_APP_URL. Use when serving from multiple domains

# (apex + www, alias hostnames, reverse-proxy IPs). Empty by default.

- TRUSTED_ORIGINS=${TRUSTED_ORIGINS:-}

# AUTH_TRUSTED_PROXIES: comma-separated reverse-proxy IPs or CIDR ranges in

# front of the app (ingress, load balancer). Sim and Better Auth walk

# x-forwarded-for right to left, skip these hops, and use the first

# untrusted address as the client IP. Required to look through known

# intermediate proxies in a multi-hop chain. Empty by default.

- AUTH_TRUSTED_PROXIES=${AUTH_TRUSTED_PROXIES:-}

# Required. Compose aborts with this message rather than starting the app

# with an empty secret, which would silently corrupt stored credentials.

- 'BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:?is required. Create a .env file next to docker-compose.prod.yml and set it to the output of: openssl rand -hex 32}'

- 'ENCRYPTION_KEY=${ENCRYPTION_KEY:?is required. Set it in .env to the output of: openssl rand -hex 32. It cannot be changed later without losing stored credentials.}'

- 'INTERNAL_API_SECRET=${INTERNAL_API_SECRET:?is required. Set it in .env to the output of: openssl rand -hex 32}'

- API_ENCRYPTION_KEY=${API_ENCRYPTION_KEY:-}

# Authenticates the cron service against the background job endpoints.

- CRON_SECRET=${CRON_SECRET:-}

- REDIS_URL=${REDIS_URL:-redis://redis:6379}

- COPILOT_API_KEY=${COPILOT_API_KEY:-}

- MSHIP_SYSPROMPT_OVERRIDE=${MSHIP_SYSPROMPT_OVERRIDE:-}

- NEXT_PUBLIC_CHAT_DISABLED=${NEXT_PUBLIC_CHAT_DISABLED:-}

- SIM_AGENT_API_URL=${SIM_AGENT_API_URL:-}

- OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}

- SOCKET_SERVER_URL=${SOCKET_SERVER_URL:-http://realtime:3002}

# NEXT_PUBLIC_SOCKET_URL is read by the browser. Leave it unset for this

# stack: the client already falls back to localhost:3002 for a localhost

# page, and a proxied deployment needs the page-origin fallback that an

# explicit value would suppress. Set it only when realtime is on a

# different host:port (e.g. wss://socket.example.com).

- NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-}

- ADMISSION_GATE_MAX_INFLIGHT=${ADMISSION_GATE_MAX_INFLIGHT:-500}

# Lets a workflow reach a service on the Docker host. Reaching it also

# requires naming it in EGRESS_ALLOWED_HOSTS; this only makes the name

# resolve, which it does not on Linux by default.

extra_hosts:

- 'host.docker.internal:host-gateway'

depends_on:

db:

condition: service_healthy

redis:

condition: service_healthy

migrations:

condition: service_completed_successfully

realtime:

condition: service_healthy

healthcheck:

test: ['CMD', 'curl', '-fsS', 'http://127.0.0.1:3000']

interval: 90s

timeout: 5s

retries: 3

start_period: 10s

realtime:

env_file:

- path: .env

required: false

image: ghcr.io/simstudioai/realtime:${SIM_VERSION:-latest}

restart: unless-stopped

ports:

- '3002:3002'

deploy:

resources:

limits:

memory: 1G

environment:

- NODE_ENV=production

- 'DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?is required. For a new install set it in .env to the output of: openssl rand -hex 24. An install created before it was required uses the password postgres - set POSTGRES_PASSWORD=postgres to keep its data.}@db:5432/${POSTGRES_DB:-simstudio}'

- NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}

# Derived from NEXT_PUBLIC_APP_URL, matching the simstudio service — a

# single public-origin variable keeps the two from disagreeing.

- BETTER_AUTH_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}

- 'BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:?is required and must match the value used by the simstudio service}'

- 'INTERNAL_API_SECRET=${INTERNAL_API_SECRET:?is required and must match the value used by the simstudio service}'

- REDIS_URL=${REDIS_URL:-redis://redis:6379}

depends_on:

db:

condition: service_healthy

redis:

condition: service_healthy

healthcheck:

test: ['CMD', 'curl', '-fsS', 'http://127.0.0.1:3002/health']

interval: 90s

timeout: 5s

retries: 3

start_period: 10s

migrations:

image: ghcr.io/simstudioai/migrations:${SIM_VERSION:-latest}

working_dir: /app/packages/db

environment:

- 'DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?is required. For a new install set it in .env to the output of: openssl rand -hex 24. An install created before it was required uses the password postgres - set POSTGRES_PASSWORD=postgres to keep its data.}@db:5432/${POSTGRES_DB:-simstudio}'

depends_on:

db:

condition: service_healthy

command: ['bun', 'run', 'db:migrate']

restart: 'no'

# Backs pub/sub (live Chat task-status and table events) and the shared caches.

# The app falls back to PostgreSQL for storage when REDIS_URL is unset, but the

# pub/sub channels have no fallback — without Redis, live status never streams.

# Not published to the host: only the app and realtime containers need it, and

# binding 6379 would collide with a Redis already running locally.

redis:

image: redis:7-alpine

restart: unless-stopped

healthcheck:

test: ['CMD', 'redis-cli', 'ping']

interval: 5s

timeout: 5s

retries: 5

# Runs the background jobs the Helm chart schedules as Kubernetes CronJobs:

# scheduled workflows, polling triggers, connector syncs, the transactional

# outbox, subscription renewal, and data drains. Without it none of those run.

# Schedules live in docker/crontab and mirror helm/sim/values.yaml cronjobs.jobs.

cron:

# Deliberately NOT pinned to SIM_VERSION: the scheduler only makes HTTP calls

# and shares no database schema with the app, so it does not need to move in

# lockstep — and no cron tag exists for releases that predate it.

image: ghcr.io/simstudioai/cron:${SIM_CRON_VERSION:-latest}

# on-failure, not unless-stopped: with no CRON_SECRET the container exits 0

# after explaining why, and stays stopped instead of crash-looping. Upgrades

# from a compose file that predates this service therefore still come up.

restart: on-failure

environment:

- SIM_URL=http://simstudio:3000

- CRON_SECRET=${CRON_SECRET:-}

- TZ=${TZ:-UTC}

depends_on:

simstudio:

condition: service_healthy

# Not published to the host: app, realtime and migrations reach it over the

# Compose network as db:5432. A host `ports:` mapping binds every interface and

# Docker's own iptables rules bypass host firewalls, so it would put the

# database on the network. For host access (psql, a desktop client), use

# `docker compose exec db psql -U postgres simstudio`, or pass a second -f

# file that publishes '127.0.0.1:5432:5432' (-f disables override files).

db:

image: pgvector/pgvector:pg17

restart: unless-stopped

environment:

- POSTGRES_USER=${POSTGRES_USER:-postgres}

# Postgres applies this only when it creates the data volume; later

# changes are ignored. An install created before this was required got

# the password `postgres` — set exactly that to keep it working.

- 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?is required. For a new install set it in .env to the output of: openssl rand -hex 24. An install created before it was required uses the password postgres - set POSTGRES_PASSWORD=postgres to keep its data.}'

- POSTGRES_DB=${POSTGRES_DB:-simstudio}

volumes:

- postgres_data:/var/lib/postgresql/data

healthcheck:

test: ['CMD-SHELL', 'pg_isready -U postgres']

interval: 5s

timeout: 5s

retries: 5

volumes:

postgres_data: