431 lines
14 KiB
Plaintext
431 lines
14 KiB
Plaintext
# ===================================================================
|
|
# Docker Compose - Microservices (OPTIMIZED & SECURED)
|
|
# Meldestelle Project - Application Services
|
|
# ===================================================================
|
|
# Security & Performance Improvements:
|
|
# - Secrets management for database credentials
|
|
# - Resource limits and reservations for all services
|
|
# - Security hardening (non-root users, no-new-privileges)
|
|
# - Optimized health checks and startup dependencies
|
|
# - Enhanced monitoring and logging configuration
|
|
# ===================================================================
|
|
# Usage:
|
|
# Vollständiges System: docker-compose -f docker-compose.yml.optimized -f docker-compose.services.yml.optimized up -d
|
|
# ===================================================================
|
|
|
|
version: '3.9'
|
|
|
|
services:
|
|
# ===================================================================
|
|
# Ping Service - Enhanced Security & Performance
|
|
# ===================================================================
|
|
ping-service:
|
|
build:
|
|
context: .
|
|
dockerfile: dockerfiles/services/ping-service/Dockerfile
|
|
args:
|
|
# Global build arguments
|
|
GRADLE_VERSION: ${DOCKER_GRADLE_VERSION:-9.0.0}
|
|
JAVA_VERSION: ${DOCKER_JAVA_VERSION:-21}
|
|
BUILD_DATE: ${BUILD_DATE:-unknown}
|
|
VERSION: ${DOCKER_APP_VERSION:-1.0.0}
|
|
# Service-specific arguments
|
|
SPRING_PROFILES_ACTIVE: ${DOCKER_SPRING_PROFILES_DOCKER:-docker}
|
|
container_name: meldestelle-ping-service
|
|
volumes:
|
|
# Mount Gradle cache for better build performance
|
|
- ping-service-gradle-cache:/home/gradle/.gradle
|
|
environment:
|
|
SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-docker}
|
|
SERVER_PORT: ${PING_SERVICE_PORT:-8082}
|
|
CONSUL_HOST: consul
|
|
CONSUL_PORT: ${CONSUL_PORT:-8500}
|
|
CONSUL_ENABLED: ${CONSUL_ENABLED:-true}
|
|
SPRING_CLOUD_CONSUL_DISCOVERY_ENABLED: ${CONSUL_ENABLED:-true}
|
|
# Database connection via secrets
|
|
DB_HOST: postgres
|
|
DB_PORT: 5432
|
|
DB_NAME: ${POSTGRES_DB:-meldestelle}
|
|
DB_USERNAME_FILE: /run/secrets/postgres_user
|
|
DB_PASSWORD_FILE: /run/secrets/postgres_password
|
|
# Redis Event Store connection with authentication
|
|
REDIS_EVENT_STORE_HOST: redis
|
|
REDIS_EVENT_STORE_PORT: 6379
|
|
REDIS_EVENT_STORE_PASSWORD_FILE: /run/secrets/redis_password
|
|
# JWT Configuration for service-to-service authentication
|
|
JWT_SECRET_FILE: /run/secrets/jwt_secret
|
|
JWT_ISSUER: ${JWT_ISSUER:-meldestelle-auth-server}
|
|
JWT_AUDIENCE: ${JWT_AUDIENCE:-meldestelle-services}
|
|
ports:
|
|
- "${PING_SERVICE_PORT:-8082}:8082"
|
|
depends_on:
|
|
consul:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks:
|
|
- meldestelle-network
|
|
secrets:
|
|
- postgres_user
|
|
- postgres_password
|
|
- redis_password
|
|
- jwt_secret
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1.0'
|
|
memory: 1G
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 256M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "--fail", "http://localhost:8082/actuator/health/readiness"]
|
|
interval: 15s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
# ===================================================================
|
|
# Members Service - Production Ready (Currently Commented Out)
|
|
# ===================================================================
|
|
members-service:
|
|
build:
|
|
context: .
|
|
dockerfile: dockerfiles/services/members-service/Dockerfile
|
|
args:
|
|
GRADLE_VERSION: ${DOCKER_GRADLE_VERSION:-9.0.0}
|
|
JAVA_VERSION: ${DOCKER_JAVA_VERSION:-21}
|
|
BUILD_DATE: ${BUILD_DATE:-unknown}
|
|
VERSION: ${DOCKER_APP_VERSION:-1.0.0}
|
|
SPRING_PROFILES_ACTIVE: ${DOCKER_SPRING_PROFILES_DOCKER:-docker}
|
|
container_name: meldestelle-members-service
|
|
volumes:
|
|
- members-service-gradle-cache:/home/gradle/.gradle
|
|
environment:
|
|
SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-docker}
|
|
SERVER_PORT: ${MEMBERS_SERVICE_PORT:-8083}
|
|
CONSUL_HOST: consul
|
|
CONSUL_PORT: ${CONSUL_PORT:-8500}
|
|
CONSUL_ENABLED: ${CONSUL_ENABLED:-true}
|
|
# Database connection via secrets
|
|
DB_HOST: postgres
|
|
DB_PORT: 5432
|
|
DB_NAME: ${POSTGRES_DB:-meldestelle}
|
|
DB_USERNAME_FILE: /run/secrets/postgres_user
|
|
DB_PASSWORD_FILE: /run/secrets/postgres_password
|
|
# Redis Event Store connection
|
|
REDIS_EVENT_STORE_HOST: redis
|
|
REDIS_EVENT_STORE_PORT: 6379
|
|
REDIS_EVENT_STORE_PASSWORD_FILE: /run/secrets/redis_password
|
|
# Kafka messaging
|
|
KAFKA_BOOTSTRAP_SERVERS: kafka:29092
|
|
# JWT Configuration
|
|
JWT_SECRET_FILE: /run/secrets/jwt_secret
|
|
JWT_ISSUER: ${JWT_ISSUER:-meldestelle-auth-server}
|
|
JWT_AUDIENCE: ${JWT_AUDIENCE:-meldestelle-services}
|
|
ports:
|
|
- "${MEMBERS_SERVICE_PORT:-8083}:8083"
|
|
depends_on:
|
|
consul:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
kafka:
|
|
condition: service_healthy
|
|
networks:
|
|
- meldestelle-network
|
|
secrets:
|
|
- postgres_user
|
|
- postgres_password
|
|
- redis_password
|
|
- jwt_secret
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2.0'
|
|
memory: 2G
|
|
reservations:
|
|
cpus: '0.5'
|
|
memory: 512M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "--fail", "http://localhost:8083/actuator/health/readiness"]
|
|
interval: 15s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
profiles:
|
|
- members
|
|
|
|
# ===================================================================
|
|
# Horses Service - Production Ready (Currently Commented Out)
|
|
# ===================================================================
|
|
horses-service:
|
|
build:
|
|
context: .
|
|
dockerfile: dockerfiles/services/horses-service/Dockerfile
|
|
args:
|
|
GRADLE_VERSION: ${DOCKER_GRADLE_VERSION:-9.0.0}
|
|
JAVA_VERSION: ${DOCKER_JAVA_VERSION:-21}
|
|
BUILD_DATE: ${BUILD_DATE:-unknown}
|
|
VERSION: ${DOCKER_APP_VERSION:-1.0.0}
|
|
SPRING_PROFILES_ACTIVE: ${DOCKER_SPRING_PROFILES_DOCKER:-docker}
|
|
container_name: meldestelle-horses-service
|
|
volumes:
|
|
- horses-service-gradle-cache:/home/gradle/.gradle
|
|
environment:
|
|
SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-docker}
|
|
SERVER_PORT: ${HORSES_SERVICE_PORT:-8084}
|
|
CONSUL_HOST: consul
|
|
CONSUL_PORT: ${CONSUL_PORT:-8500}
|
|
CONSUL_ENABLED: ${CONSUL_ENABLED:-true}
|
|
# Database connection via secrets
|
|
DB_HOST: postgres
|
|
DB_PORT: 5432
|
|
DB_NAME: ${POSTGRES_DB:-meldestelle}
|
|
DB_USERNAME_FILE: /run/secrets/postgres_user
|
|
DB_PASSWORD_FILE: /run/secrets/postgres_password
|
|
# Redis Event Store connection
|
|
REDIS_EVENT_STORE_HOST: redis
|
|
REDIS_EVENT_STORE_PORT: 6379
|
|
REDIS_EVENT_STORE_PASSWORD_FILE: /run/secrets/redis_password
|
|
# Kafka messaging
|
|
KAFKA_BOOTSTRAP_SERVERS: kafka:29092
|
|
# JWT Configuration
|
|
JWT_SECRET_FILE: /run/secrets/jwt_secret
|
|
JWT_ISSUER: ${JWT_ISSUER:-meldestelle-auth-server}
|
|
JWT_AUDIENCE: ${JWT_AUDIENCE:-meldestelle-services}
|
|
ports:
|
|
- "${HORSES_SERVICE_PORT:-8084}:8084"
|
|
depends_on:
|
|
consul:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
kafka:
|
|
condition: service_healthy
|
|
networks:
|
|
- meldestelle-network
|
|
secrets:
|
|
- postgres_user
|
|
- postgres_password
|
|
- redis_password
|
|
- jwt_secret
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2.0'
|
|
memory: 2G
|
|
reservations:
|
|
cpus: '0.5'
|
|
memory: 512M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "--fail", "http://localhost:8084/actuator/health/readiness"]
|
|
interval: 15s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
profiles:
|
|
- horses
|
|
|
|
# ===================================================================
|
|
# Events Service - Production Ready (Currently Commented Out)
|
|
# ===================================================================
|
|
events-service:
|
|
build:
|
|
context: .
|
|
dockerfile: dockerfiles/services/events-service/Dockerfile
|
|
args:
|
|
GRADLE_VERSION: ${DOCKER_GRADLE_VERSION:-9.0.0}
|
|
JAVA_VERSION: ${DOCKER_JAVA_VERSION:-21}
|
|
BUILD_DATE: ${BUILD_DATE:-unknown}
|
|
VERSION: ${DOCKER_APP_VERSION:-1.0.0}
|
|
SPRING_PROFILES_ACTIVE: ${DOCKER_SPRING_PROFILES_DOCKER:-docker}
|
|
container_name: meldestelle-events-service
|
|
volumes:
|
|
- events-service-gradle-cache:/home/gradle/.gradle
|
|
environment:
|
|
SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-docker}
|
|
SERVER_PORT: ${EVENTS_SERVICE_PORT:-8085}
|
|
CONSUL_HOST: consul
|
|
CONSUL_PORT: ${CONSUL_PORT:-8500}
|
|
CONSUL_ENABLED: ${CONSUL_ENABLED:-true}
|
|
# Database connection via secrets
|
|
DB_HOST: postgres
|
|
DB_PORT: 5432
|
|
DB_NAME: ${POSTGRES_DB:-meldestelle}
|
|
DB_USERNAME_FILE: /run/secrets/postgres_user
|
|
DB_PASSWORD_FILE: /run/secrets/postgres_password
|
|
# Redis Event Store connection
|
|
REDIS_EVENT_STORE_HOST: redis
|
|
REDIS_EVENT_STORE_PORT: 6379
|
|
REDIS_EVENT_STORE_PASSWORD_FILE: /run/secrets/redis_password
|
|
# Kafka messaging
|
|
KAFKA_BOOTSTRAP_SERVERS: kafka:29092
|
|
# JWT Configuration
|
|
JWT_SECRET_FILE: /run/secrets/jwt_secret
|
|
JWT_ISSUER: ${JWT_ISSUER:-meldestelle-auth-server}
|
|
JWT_AUDIENCE: ${JWT_AUDIENCE:-meldestelle-services}
|
|
ports:
|
|
- "${EVENTS_SERVICE_PORT:-8085}:8085"
|
|
depends_on:
|
|
consul:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
kafka:
|
|
condition: service_healthy
|
|
networks:
|
|
- meldestelle-network
|
|
secrets:
|
|
- postgres_user
|
|
- postgres_password
|
|
- redis_password
|
|
- jwt_secret
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2.0'
|
|
memory: 2G
|
|
reservations:
|
|
cpus: '0.5'
|
|
memory: 512M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "--fail", "http://localhost:8085/actuator/health/readiness"]
|
|
interval: 15s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
profiles:
|
|
- events
|
|
|
|
# ===================================================================
|
|
# Masterdata Service - Production Ready (Currently Commented Out)
|
|
# ===================================================================
|
|
masterdata-service:
|
|
build:
|
|
context: .
|
|
dockerfile: dockerfiles/services/masterdata-service/Dockerfile
|
|
args:
|
|
GRADLE_VERSION: ${DOCKER_GRADLE_VERSION:-9.0.0}
|
|
JAVA_VERSION: ${DOCKER_JAVA_VERSION:-21}
|
|
BUILD_DATE: ${BUILD_DATE:-unknown}
|
|
VERSION: ${DOCKER_APP_VERSION:-1.0.0}
|
|
SPRING_PROFILES_ACTIVE: ${DOCKER_SPRING_PROFILES_DOCKER:-docker}
|
|
container_name: meldestelle-masterdata-service
|
|
volumes:
|
|
- masterdata-service-gradle-cache:/home/gradle/.gradle
|
|
environment:
|
|
SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-docker}
|
|
SERVER_PORT: ${MASTERDATA_SERVICE_PORT:-8086}
|
|
CONSUL_HOST: consul
|
|
CONSUL_PORT: ${CONSUL_PORT:-8500}
|
|
CONSUL_ENABLED: ${CONSUL_ENABLED:-true}
|
|
# Database connection via secrets
|
|
DB_HOST: postgres
|
|
DB_PORT: 5432
|
|
DB_NAME: ${POSTGRES_DB:-meldestelle}
|
|
DB_USERNAME_FILE: /run/secrets/postgres_user
|
|
DB_PASSWORD_FILE: /run/secrets/postgres_password
|
|
# Redis Event Store connection
|
|
REDIS_EVENT_STORE_HOST: redis
|
|
REDIS_EVENT_STORE_PORT: 6379
|
|
REDIS_EVENT_STORE_PASSWORD_FILE: /run/secrets/redis_password
|
|
# JWT Configuration
|
|
JWT_SECRET_FILE: /run/secrets/jwt_secret
|
|
JWT_ISSUER: ${JWT_ISSUER:-meldestelle-auth-server}
|
|
JWT_AUDIENCE: ${JWT_AUDIENCE:-meldestelle-services}
|
|
ports:
|
|
- "${MASTERDATA_SERVICE_PORT:-8086}:8086"
|
|
depends_on:
|
|
consul:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks:
|
|
- meldestelle-network
|
|
secrets:
|
|
- postgres_user
|
|
- postgres_password
|
|
- redis_password
|
|
- jwt_secret
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1.5'
|
|
memory: 1.5G
|
|
reservations:
|
|
cpus: '0.5'
|
|
memory: 512M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "--fail", "http://localhost:8086/actuator/health/readiness"]
|
|
interval: 15s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
profiles:
|
|
- masterdata
|
|
|
|
# ===================================================================
|
|
# Secrets - Shared with main infrastructure
|
|
# ===================================================================
|
|
secrets:
|
|
postgres_user:
|
|
external: true
|
|
name: meldestelle_postgres_user
|
|
postgres_password:
|
|
external: true
|
|
name: meldestelle_postgres_password
|
|
redis_password:
|
|
external: true
|
|
name: meldestelle_redis_password
|
|
jwt_secret:
|
|
file: ./docker/secrets/jwt_secret.txt
|
|
|
|
# ===================================================================
|
|
# Volumes - Service-specific Gradle Caches
|
|
# ===================================================================
|
|
volumes:
|
|
ping-service-gradle-cache:
|
|
driver: local
|
|
members-service-gradle-cache:
|
|
driver: local
|
|
horses-service-gradle-cache:
|
|
driver: local
|
|
events-service-gradle-cache:
|
|
driver: local
|
|
masterdata-service-gradle-cache:
|
|
driver: local
|
|
|
|
# ===================================================================
|
|
# Networks - Use external network from main compose
|
|
# ===================================================================
|
|
networks:
|
|
meldestelle-network:
|
|
external: true
|
|
name: meldestelle_meldestelle-network
|