1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
version: '3.8'
# Deployable stack: the four services the binary actually needs. Redis and
# MongoDB are HARD requirements (src/main.rs propagates their connection errors
# with `?`, so the process exits without them); ClickHouse is optional
# (src/domain/simulator.rs logs the failure and runs with database_repo: None,
# which only degrades the Historical source).
#
# The admin UIs (mongo-express, redis-commander) and the host-published
# infrastructure ports live in docker-compose.dev.yml, NOT here: `docker stack
# deploy` does not support compose profiles, so anything present in this file
# reaches the swarm, and those UIs ship default admin/password credentials.
#
# Service images are pinned by IMMUTABLE digest (image: name:tag@sha256:...)
# so a redeploy can never silently pull a different build (issue #22). The
# tag is kept as a readable prefix only; the digest is what the engine
# resolves. Digests are the multi-arch manifest-list digests from Docker Hub
# (docker buildx imagetools inspect <image:tag>).
#
# Update workflow: bump ONE image at a time in a dedicated PR - re-resolve
# its digest with imagetools inspect, update tag and digest together, run
# the stack locally (make deploy) against the health checks, and record the
# tested combination in the PR. Never drop the digest or use :latest.
#
# SWARM: this file deploys unchanged with `docker stack deploy` (make
# deploy-swarm). Consequences of that:
# - `backend` pulls the PUBLISHED image, it is never built here. The tag is
# the crate version, defaulting to the current Cargo.toml version;
# `make deploy` / `make deploy-swarm` pass OPTIONCHAIN_VERSION so the
# deployed tag always matches the manifest. `docker stack deploy` does NOT
# read .env, so export the overrides in the shell.
# - The network is EXTERNAL and shared: create it once per environment
# (`make network` locally, `make network-swarm` on a manager) so other
# stacks can attach to it and resolve these services by name. Swarm needs
# it to be an attachable overlay - a bridge network is node-scoped and
# rejected for services.
# - Nothing swarm ignores is declared here: `container_name`, `restart`,
# `depends_on` and `ulimits` live in the dev override, and the `deploy`
# blocks carry the equivalent restart policy. Keeping them out is what
# stops `docker stack deploy` (and Portainer) from printing "Ignoring
# unsupported options" on every deploy.
# - Only `backend` publishes a port. The infrastructure services are reachable
# over the stack network alone; under the routing mesh a published port
# would answer on EVERY node of the cluster.
# - The infrastructure services keep node-local volumes, so a multi-node
# swarm must either constrain them to one node or point the backend at
# managed Redis/MongoDB/ClickHouse instances via the env vars below.
services:
# Redis service configuration
redis:
image: redis:8.10.0@sha256:344e3945a0b431c8ff1eecd58c5573538126bd756f02fc7e218ddf1fc2546366
command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-password}
volumes:
- redis-data:/data
networks:
- optionchain-network
healthcheck:
test:
interval: 10s
timeout: 5s
retries: 5
environment:
- TZ=UTC
deploy:
replicas: 1
restart_policy:
condition: any
delay: 5s
# MongoDB service configuration
mongodb:
image: mongo:8.0.29@sha256:de267922bc1153d923f5c9dc429f21c11faf18299080c1ce04d6d6007097fb06
volumes:
- mongodb-data:/data/db
- mongodb-config:/data/configdb
networks:
- optionchain-network
environment:
- MONGO_INITDB_ROOT_USERNAME=${MONGO_USERNAME:-admin}
- MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD:-password}
- TZ=UTC
healthcheck:
test: echo 'db.runCommand("ping").ok' | mongosh localhost:27017/test --quiet
interval: 10s
timeout: 5s
retries: 5
deploy:
replicas: 1
restart_policy:
condition: any
delay: 5s
clickhouse:
image: clickhouse/clickhouse-server:26.3.17.110@sha256:2ef11bbe2e44ab7022f37ff3019b3f2125ed09e919ea6194660be6130b7ca4b7
environment:
CLICKHOUSE_USER: ${CLICKHOUSE_USER:-admin}
CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-password}
CLICKHOUSE_DB: ${CLICKHOUSE_DB:-default}
volumes:
- clickhouse_data:/var/lib/clickhouse
networks:
- optionchain-network
deploy:
replicas: 1
restart_policy:
condition: any
delay: 5s
backend:
# Published by .github/workflows/docker-publish.yml on every Cargo.toml
# version bump, or by `make docker-push` from a workstation. Bump the
# default tag in the same PR that bumps the crate version.
image: ghcr.io/joaquinbejar/optionchain-simulator:${OPTIONCHAIN_VERSION:-0.2.0}
deploy:
replicas: 1
restart_policy:
condition: any
delay: 5s
update_config:
order: start-first
failure_action: rollback
environment:
CLICKHOUSE_USER: ${CLICKHOUSE_USER:-admin}
CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-password}
CLICKHOUSE_DB: ${CLICKHOUSE_DB:-default}
CLICKHOUSE_PORT: ${CLICKHOUSE_PORT-8123}
CLICKHOUSE_HOST: ${CLICKHOUSE_HOST-clickhouse}
MONGODB_URI: ${MONGODB_URI-mongodb://admin:password@mongodb:27017}
MONGODB_DATABASE: ${MONGODB_DATABASE-optionchain_simulator}
MONGODB_STEPS_COLLECTION: ${MONGODB_STEPS_COLLECTION-steps}
MONGODB_EVENTS_COLLECTION: ${MONGODB_EVENTS_COLLECTION-events}
MONGODB_TIMEOUT: ${MONGODB_TIMEOUT-30}
REDIS_PORT: ${REDIS_PORT-6379}
REDIS_DB: ${REDIS_DB-0}
REDIS_USER: ${REDIS_USER}
REDIS_PASSWORD: ${REDIS_PASSWORD-password}
REDIS_HOST: ${REDIS_HOST-redis}
# Whole seconds, must parse as an integer >= 1: src/infrastructure/config
# /redis.rs falls back to these same defaults (30 / 5) on 0, on a
# non-numeric value, or when unset, warning as it does so.
REDIS_TIMEOUT: ${REDIS_TIMEOUT-30}
REDIS_CONNECT_TIMEOUT: ${REDIS_CONNECT_TIMEOUT-5}
ports:
- "7070:7070"
networks:
- optionchain-network
networks:
optionchain-network:
# EXTERNAL so other stacks can join the same network and reach this service
# by name. It is NOT created by this file and NOT stack-prefixed: create it
# once per environment before the first deploy (make network), as an
# attachable overlay on a swarm - the only scope swarm accepts for services
# - or as a bridge on a local engine.
external: true
name: ${OPTIONCHAIN_NETWORK:-optionchain-network}
volumes:
redis-data:
driver: local
mongodb-data:
driver: local
mongodb-config:
driver: local
clickhouse_data:
driver: local