compose.yaml

name: quespot

services:
  redis:
    image: redis:8.0-alpine
    container_name: quespot-redis
    restart: unless-stopped
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
    command:
      - /bin/sh
      - -c
      - exec redis-server --appendonly yes --requirepass "$${REDIS_PASSWORD}" --maxmemory 128mb --maxmemory-policy noeviction
    volumes:
      - redis-data:/data
    networks:
      - backend
    mem_limit: 128m
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a \"$${REDIS_PASSWORD}\" ping | grep PONG"]
      interval: 10s
      timeout: 5s
      retries: 5
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  app:
    image: ${APP_IMAGE:?APP_IMAGE must be set}
    container_name: quespot-app
    restart: unless-stopped
    env_file:
      - .env
    secrets:
      - firebase-service-account
    environment:
      REDIS_HOST: redis
      REDIS_PORT: 6379
      SPRING_PROFILES_ACTIVE: prod
      JAVA_TOOL_OPTIONS: -XX:InitialRAMPercentage=20 -XX:MaxRAMPercentage=60 -XX:+ExitOnOutOfMemoryError
    depends_on:
      redis:
        condition: service_healthy
    networks:
      - backend
    mem_limit: 600m
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  alloy:
    image: grafana/alloy:v1.19.2
    container_name: quespot-alloy
    restart: unless-stopped
    command:
      - run
      - --server.http.listen-addr=0.0.0.0:12345
      - --storage.path=/var/lib/alloy/data
      - /etc/alloy/config.alloy
    environment:
      GRAFANA_CLOUD_PROMETHEUS_URL: ${GRAFANA_CLOUD_PROMETHEUS_URL:?GRAFANA_CLOUD_PROMETHEUS_URL must be set}
      GRAFANA_CLOUD_PROMETHEUS_USERNAME: ${GRAFANA_CLOUD_PROMETHEUS_USERNAME:?GRAFANA_CLOUD_PROMETHEUS_USERNAME must be set}
      GRAFANA_CLOUD_API_TOKEN: ${GRAFANA_CLOUD_API_TOKEN:?GRAFANA_CLOUD_API_TOKEN must be set}
    configs:
      - source: alloy-config
        target: /etc/alloy/config.alloy
    volumes:
      - alloy-data:/var/lib/alloy/data
    depends_on:
      - app
    networks:
      - backend
    mem_limit: 128m
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  nginx:
    image: nginx:stable-alpine
    container_name: quespot-nginx
    restart: unless-stopped
    depends_on:
      - app
    ports:
      - "80:80"
      - "443:443"
    command:
      - /bin/sh
      - -c
      - |
        while :; do
          sleep 6h
          nginx -s reload
        done &
        exec nginx -g 'daemon off;'
    configs:
      - source: nginx-default
        target: /etc/nginx/conf.d/default.conf
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - certbot-webroot:/var/www/certbot:ro
    networks:
      - backend
    mem_limit: 64m
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  certbot:
    image: certbot/certbot:latest
    container_name: quespot-certbot
    restart: unless-stopped
    depends_on:
      - nginx
    entrypoint: /bin/sh
    command:
      - -c
      - |
        trap exit TERM
        while :; do
          certbot renew --webroot --webroot-path /var/www/certbot --quiet
          sleep 12h & wait $${!}
        done
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt
      - /var/lib/letsencrypt:/var/lib/letsencrypt
      - certbot-webroot:/var/www/certbot
    networks:
      - backend
    mem_limit: 96m
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

configs:
  nginx-default:
    content: |
      server {
          listen 80;
          server_name api.quespot.site;

          location ^~ /.well-known/acme-challenge/ {
              root /var/www/certbot;
              default_type text/plain;
          }

          location = /actuator/health {
              proxy_pass http://app:8080;
              proxy_http_version 1.1;
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
          }

          location ^~ /actuator/prometheus {
              access_log off;
              return 404;
          }

          location / {
              return 301 https://api.quespot.site$$request_uri;
          }
      }

      server {
          listen 443 ssl;
          http2 on;
          server_name api.quespot.site;

          ssl_certificate /etc/letsencrypt/live/api.quespot.site/fullchain.pem;
          ssl_certificate_key /etc/letsencrypt/live/api.quespot.site/privkey.pem;
          ssl_protocols TLSv1.2 TLSv1.3;
          ssl_session_cache shared:SSL:10m;
          ssl_session_timeout 1d;
          ssl_session_tickets off;

          client_max_body_size 10m;

          location ^~ /actuator/prometheus {
              access_log off;
              return 404;
          }

          location / {
              proxy_pass http://app:8080;
              proxy_http_version 1.1;
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              proxy_connect_timeout 5s;
              proxy_read_timeout 60s;
              proxy_send_timeout 60s;
          }
      }

  alloy-config:
    content: |
      prometheus.scrape "quespot_app" {
        targets = [{
          "__address__" = "app:8080",
          "job"         = "quespot-api",
        }]
        metrics_path    = "/actuator/prometheus"
        scrape_interval = "15s"
        forward_to      = [prometheus.remote_write.grafana_cloud.receiver]
      }

      prometheus.remote_write "grafana_cloud" {
        endpoint {
          url              = sys.env("GRAFANA_CLOUD_PROMETHEUS_URL")
          follow_redirects = false

          basic_auth {
            username = sys.env("GRAFANA_CLOUD_PROMETHEUS_USERNAME")
            password = sys.env("GRAFANA_CLOUD_API_TOKEN")
          }
        }
      }

secrets:
  firebase-service-account:
    file: /opt/quespot/secrets/firebase-service-account.json

volumes:
  redis-data:
  certbot-webroot:
  alloy-data:

networks:
  backend:
    driver: bridge