1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
version: '3.8'
# Deployable stack: the four services the binary actually needs. Redis and
# MongoDB are HARD requirements (src/main.rs propagates their connection errors
# with `?`, so the process exits without them); ClickHouse is optional
# (src/domain/simulator.rs logs the failure and runs with database_repo: None,
# which only degrades the Historical source).
#
# The admin UIs (mongo-express, redis-commander) and the host-published
# infrastructure ports live in docker-compose.dev.yml, NOT here: `docker stack
# deploy` does not support compose profiles, so anything present in this file
# reaches the swarm, and those UIs ship default admin/password credentials.
#
# Service images are pinned by IMMUTABLE digest (image: name:tag@sha256:...)
# so a redeploy can never silently pull a different build (issue #22). The
# tag is kept as a readable prefix only; the digest is what the engine
# resolves. Digests are the multi-arch manifest-list digests from Docker Hub
# (docker buildx imagetools inspect <image:tag>).
#
# Update workflow: bump ONE image at a time in a dedicated PR - re-resolve
# its digest with imagetools inspect, update tag and digest together, run
# the stack locally (make deploy) against the health checks, and record the
# tested combination in the PR. Never drop the digest or use :latest.
#
# SWARM: this file deploys unchanged with `docker stack deploy` (make
# deploy-swarm). Consequences of that:
# - `backend` pulls the PUBLISHED image, it is never built here. The tag is
# the crate version, defaulting to the current Cargo.toml version;
# `make deploy` / `make deploy-swarm` pass OPTIONCHAIN_VERSION so the
# deployed tag always matches the manifest. `docker stack deploy` does NOT
# read .env, so export the overrides in the shell.
# - The network is EXTERNAL and shared: create it once per environment
# (`make network` locally, `make network-swarm` on a manager) so other
# stacks can attach to it and resolve these services by name. Swarm needs
# it to be an attachable overlay - a bridge network is node-scoped and
# rejected for services.
# - Nothing swarm ignores is declared here: `container_name`, `restart`,
# `depends_on` and `ulimits` live in the dev override, and the `deploy`
# blocks carry the equivalent restart policy. Keeping them out is what
# stops `docker stack deploy` (and Portainer) from printing "Ignoring
# unsupported options" on every deploy.
# - Only `backend` publishes a port. The infrastructure services are reachable
# over the stack network alone; under the routing mesh a published port
# would answer on EVERY node of the cluster.
# - The infrastructure services keep node-local volumes, so a multi-node
# swarm must either constrain them to one node or point the backend at
# managed Redis/MongoDB/ClickHouse instances via the env vars below.
services:
# Redis service configuration
redis:
image: redis:8.10.1-alpine@sha256:becdda6c7f4b3fb42e42fd7f120bbf5c54c4caaaf16f26da24e4563d2c1f0576
command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-password}
volumes:
- redis-data:/data
networks:
- optionchain-network
healthcheck:
test:
interval: 10s
timeout: 5s
retries: 5
environment:
- TZ=UTC
deploy:
replicas: 1
restart_policy:
condition: any
delay: 5s
# MongoDB service configuration
mongodb:
# UPGRADING AN EXISTING DEPLOYMENT from the 8.0 line: MongoDB refuses to
# start on a data directory whose feature compatibility version is higher
# than the binary, and it will not jump an FCV on its own. The order is:
#
# 1. on the RUNNING 8.0 instance, confirm the FCV is 8.0
# db.adminCommand({getParameter: 1, featureCompatibilityVersion: 1})
# 2. stop it, swap the image to this one, start it. The data directory
# keeps FCV 8.0, which 8.2 serves happily, so this step is
# reversible: putting the 8.0 image back still starts
# 3. once the deployment is trusted, raise it, which is the point of no
# easy return
# db.adminCommand({setFeatureCompatibilityVersion: "8.2", confirm: true})
#
# Verified on this exact digest against a persisted volume: 8.0.29 with
# FCV 8.0, binary swapped, 8.2.12 started, documents intact, FCV still 8.0,
# then raised to 8.2. A fresh volume needs none of this.
image: mongo:8.2.12@sha256:e0ce8c35124d4a9f9785532d1f268f39e9728ffa1cb38f46fa482436424c4bd3
volumes:
- mongodb-data:/data/db
- mongodb-config:/data/configdb
networks:
- optionchain-network
environment:
- MONGO_INITDB_ROOT_USERNAME=${MONGO_USERNAME:-admin}
- MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD:-password}
- TZ=UTC
healthcheck:
test: echo 'db.runCommand("ping").ok' | mongosh localhost:27017/test --quiet
interval: 10s
timeout: 5s
retries: 5
deploy:
replicas: 1
restart_policy:
condition: any
delay: 5s
clickhouse:
image: clickhouse/clickhouse-server:26.8.1.2041-alpine@sha256:fd037d424da807c1b36517f3ff6c739286c60a34c928279c229fc1faa0cadaa8
environment:
CLICKHOUSE_USER: ${CLICKHOUSE_USER:-admin}
CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-password}
CLICKHOUSE_DB: ${CLICKHOUSE_DB:-default}
volumes:
- clickhouse_data:/var/lib/clickhouse
networks:
- optionchain-network
deploy:
replicas: 1
restart_policy:
condition: any
delay: 5s
backend:
# Published by .github/workflows/docker-publish.yml on every Cargo.toml
# version bump, or by `make docker-push` from a workstation. Bump the
# default tag in the same PR that bumps the crate version.
image: ghcr.io/joaquinbejar/optionchain-simulator:${OPTIONCHAIN_VERSION:-0.2.15}
deploy:
replicas: 2
restart_policy:
condition: any
delay: 5s
update_config:
order: start-first
failure_action: rollback
environment:
CLICKHOUSE_USER: ${CLICKHOUSE_USER:-admin}
CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-password}
CLICKHOUSE_DB: ${CLICKHOUSE_DB:-default}
CLICKHOUSE_PORT: ${CLICKHOUSE_PORT:-8123}
CLICKHOUSE_HOST: ${CLICKHOUSE_HOST:-clickhouse}
MONGODB_URI: ${MONGODB_URI:-mongodb://admin:password@mongodb:27017}
MONGODB_DATABASE: ${MONGODB_DATABASE:-optionchain_simulator}
MONGODB_STEPS_COLLECTION: ${MONGODB_STEPS_COLLECTION:-steps}
MONGODB_EVENTS_COLLECTION: ${MONGODB_EVENTS_COLLECTION:-events}
MONGODB_TIMEOUT: ${MONGODB_TIMEOUT:-30}
REDIS_PORT: ${REDIS_PORT:-6379}
REDIS_DB: ${REDIS_DB:-0}
# `:-`, not `-`, on every line above and below: `${VAR-default}` only
# substitutes when the variable is UNSET, so a blank one in the repo's
# `.env` reached the container as "" and the app answered with its own
# default, which inside a container points at localhost. `:-` covers
# blank too, which is what the service now means by unset.
REDIS_USER: ${REDIS_USER:-}
REDIS_PASSWORD: ${REDIS_PASSWORD:-password}
REDIS_HOST: ${REDIS_HOST:-redis}
# Whole seconds, must parse as an integer >= 1: src/infrastructure/config
# /redis.rs falls back to these same defaults (30 / 5) on 0, on a
# non-numeric value, or when unset, warning as it does so.
REDIS_TIMEOUT: ${REDIS_TIMEOUT:-30}
REDIS_CONNECT_TIMEOUT: ${REDIS_CONNECT_TIMEOUT:-5}
# The service binds loopback when this is unset (src/infrastructure/config
# /server.rs), and loopback inside a container is reachable by nobody, so
# a published port would lead nowhere. A container has to say 0.0.0.0 out
# loud; the network boundary here is the published port, not the bind.
OCS_BIND_ADDRESS: ${OCS_BIND_ADDRESS:-0.0.0.0}
# Both sides of the mapping below read the same variable, so moving the
# service off 7070 is one edit rather than two that can disagree.
OCS_PORT: ${OCS_PORT:-7070}
# `/ready`, not `/health`: the point of the check is that compose reports
# the backend healthy only once it can actually serve a request, which
# means after Redis, MongoDB and (when persistence is on) ClickHouse
# answer. `wget` is busybox's, present in the alpine runtime image, and it
# exits non-zero on the 503 the endpoint returns while a dependency is
# down, which is exactly the signal compose reads.
healthcheck:
test:
interval: 10s
timeout: 5s
retries: 5
# Startup connects to Redis and MongoDB and may create the ClickHouse
# schema, so the first probes are expected to fail rather than to count
# against the retries.
start_period: 20s
ports:
- "${OCS_PORT:-7070}:${OCS_PORT:-7070}"
networks:
- optionchain-network
networks:
optionchain-network:
# EXTERNAL so other stacks can join the same network and reach this service
# by name. It is NOT created by this file and NOT stack-prefixed: create it
# once per environment before the first deploy (make network), as an
# attachable overlay on a swarm - the only scope swarm accepts for services
# - or as a bridge on a local engine.
external: true
name: ${OPTIONCHAIN_NETWORK:-optionchain-network}
volumes:
redis-data:
driver: local
mongodb-data:
driver: local
mongodb-config:
driver: local
clickhouse_data:
driver: local