docker-compose.yml

x-defaults:
  &defaults
  ENVIRONMENT: production

services:
  landing:
    image: ghcr.io/teknologi-umum/pesto-landing:edge
    environment:
      <<: [ *defaults ]
      PORT: 3000
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=pesto"
      - "traefik.http.routers.landing.entrypoints=web,websecure"
      - "traefik.http.routers.landing.rule=Host(`pesto.teknologiumum.com`)"
      - "traefik.http.routers.landing.priority=1"
      - "traefik.http.routers.landing.tls.certresolver=tlsresolver"
      - "traefik.http.routers.landing.middlewares=landing-header,landing-rate,landing-redirectscheme"
      - "traefik.http.services.landing.loadbalancer.server.port=3000"
      - "traefik.http.services.landing.loadbalancer.server.scheme=http"
      - "traefik.http.services.landing.loadbalancer.healthcheck.interval=30s"
      - "traefik.http.services.landing.loadbalancer.healthcheck.path=/"
      - "traefik.http.middlewares.landing-rate.ratelimit.average=100"
      - "traefik.http.middlewares.landing-rate.ratelimit.burst=20"
      - "traefik.http.middlewares.landing-rate.ratelimit.period=1s"
      - "traefik.http.middlewares.landing-header.headers.accesscontrolallowmethods=GET,OPTIONS"
      - "traefik.http.middlewares.landing-header.headers.accesscontrolalloworiginlist=https://teknologiumum.com"
      - "traefik.http.middlewares.landing-header.headers.accesscontrolmaxage=604800"
      - "traefik.http.middlewares.landing-header.headers.addvaryheader=true"
      - "traefik.http.middlewares.landing-header.headers.frameDeny=true"
      - "traefik.http.middlewares.landing-header.headers.browserxssfilter=true"
      - "traefik.http.middlewares.landing-header.headers.stsSeconds=604800"
      - "traefik.http.middlewares.landing-header.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.landing-header.headers.browserXssFilter=true"
      - "traefik.http.middlewares.landing-header.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.landing-header.headers.customResponseHeaders.server=Teknologi Umum"
      - "traefik.http.middlewares.landing-redirectscheme.redirectscheme.scheme=https"
      - "traefik.http.middlewares.landing-redirectscheme.redirectscheme.permanent=true"
      - "com.centurylinklabs.watchtower.enable=true"
    platform: linux/amd64
    storage_opt:
      size: '1G'
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: 3
    healthcheck:
      test: "curl -f http://localhost:3000/ || exit 1"
      interval: 15s
      timeout: 10s
      retries: 5
    deploy:
      mode: replicated
      replicas: 1
      restart_policy:
        condition: unless-stopped
        delay: 30s
        window: 120s
      resources:
        limits:
          memory: 350MB
          cpus: '0.75'
        reservations:
          memory: 25MB
          cpus: '0.10'
    networks:
      - pesto

  db:
    image: ghcr.io/teknologi-umum/pesto-redis:edge
    platform: linux/amd64
    healthcheck:
      test: "redis-cli ping | grep PONG"
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      mode: replicated
      replicas: 1
      restart_policy:
        condition: unless-stopped
        delay: 30s
        window: 60s
      resources:
        limits:
          memory: 2GB
          cpus: '1'
        reservations:
          memory: 100MB
          cpus: '0.25'
    networks:
      - internal
    volumes:
      - redis-data

  auth:
    image: ghcr.io/teknologi-umum/pesto-auth:edge
    environment:
      <<: [ *defaults ]
      PORT: 3000
      SENTRY_DSN: ${AUTH_SENTRY_DSN}
      REDIS_URL: redis://@db:6379/
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=pesto"
      - "traefik.http.routers.auth.entrypoints=web,websecure"
      - "traefik.http.routers.auth.middlewares=auth-error,auth-header,auth-rate"
      - "traefik.http.services.auth.loadbalancer.server.port=3000"
      - "traefik.http.services.auth.loadbalancer.server.scheme=http"
      - "traefik.http.services.auth.loadbalancer.healthcheck.interval=30s"
      - "traefik.http.services.auth.loadbalancer.healthcheck.path=/healthz"
      - "traefik.http.middlewares.auth-error.errors.status=500-599"
      - "traefik.http.middlewares.auth-error.errors.service=landing@docker"
      - "traefik.http.middlewares.auth-error.errors.query=/500"
      - "traefik.http.middlewares.auth-rate.ratelimit.average=20"
      - "traefik.http.middlewares.auth-rate.ratelimit.burst=5"
      - "traefik.http.middlewares.auth-rate.ratelimit.period=1s"
      - "traefik.http.middlewares.auth-header.headers.addvaryheader=true"
      - "traefik.http.middlewares.auth-header.headers.frameDeny=true"
      - "traefik.http.middlewares.auth-header.headers.browserxssfilter=true"
      - "traefik.http.middlewares.auth-header.headers.stsSeconds=604800"
      - "traefik.http.middlewares.auth-header.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.auth-header.headers.browserXssFilter=true"
      - "traefik.http.middlewares.auth-header.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.auth-header.headers.customResponseHeaders.server=Teknologi Umum"
      - "com.centurylinklabs.watchtower.enable=true"
    platform: linux/amd64
    storage_opt:
      size: '1G'
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: 3
    healthcheck:
      test: "wget -q --spider http://localhost:3000/healthz || exit 1"
      interval: 15s
      timeout: 10s
      retries: 5
    deploy:
      mode: replicated
      replicas: 1
      restart_policy:
        condition: unless-stopped
        delay: 30s
        window: 120s
      resources:
        limits:
          memory: 500MB
          cpus: '0.75'
        reservations:
          memory: 10MB
          cpus: '0.10'
    depends_on:
      db:
        condition: service_healthy
    networks:
      - pesto
      - internal

  rce:
    image: ghcr.io/teknologi-umum/pesto-rce:edge
    environment:
      <<: [ *defaults ]
      PORT: 50051
      SENTRY_DSN: ${RCE_SENTRY_DSN}
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=pesto"
      - "traefik.http.routers.rce.entrypoints=web,websecure"
      - "traefik.http.routers.rce.rule=Host(`pesto.teknologiumum.com`) && PathPrefix(`/api`)"
      - "traefik.http.routers.rce.priority=3"
      - "traefik.http.routers.rce.tls.certresolver=tlsresolver"
      - "traefik.http.routers.rce.middlewares=rce-auth,rce-error,rce-header,rce-rate,rce-redirectscheme"
      - "traefik.http.services.rce.loadbalancer.server.port=50051"
      - "traefik.http.services.rce.loadbalancer.server.scheme=http"
      - "traefik.http.services.rce.loadbalancer.healthcheck.interval=30s"
      - "traefik.http.services.rce.loadbalancer.healthcheck.path=/healthz"
      - "traefik.http.middlewares.rce-auth.forwardauth.address=http://auth:3000/"
      - "traefik.http.middlewares.rce-auth.forwardauth.authRequestHeaders=Accept,X-Pesto-Token,Referer,Origin"
      - "traefik.http.middlewares.rce-auth.forwardauth.authResponseHeaders=Sentry-Trace,Baggage"
      - "traefik.http.middlewares.rce-auth.forwardauth.tls.insecureSkipVerify=true"
      - "traefik.http.middlewares.rce-error.errors.status=500-599"
      - "traefik.http.middlewares.rce-error.errors.service=landing@docker"
      - "traefik.http.middlewares.rce-error.errors.query=/500"
      - "traefik.http.middlewares.rce-rate.ratelimit.average=500"
      - "traefik.http.middlewares.rce-rate.ratelimit.burst=100"
      - "traefik.http.middlewares.rce-rate.ratelimit.period=1m"
      - "traefik.http.middlewares.rce-header.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
      - "traefik.http.middlewares.rce-header.headers.accesscontrolalloworiginlist=*"
      - "traefik.http.middlewares.rce-header.headers.accesscontrolmaxage=604800"
      - "traefik.http.middlewares.rce-header.headers.addvaryheader=true"
      - "traefik.http.middlewares.rce-header.headers.frameDeny=true"
      - "traefik.http.middlewares.rce-header.headers.browserxssfilter=true"
      - "traefik.http.middlewares.rce-header.headers.stsSeconds=604800"
      - "traefik.http.middlewares.rce-header.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.rce-header.headers.browserXssFilter=true"
      - "traefik.http.middlewares.rce-header.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.rce-header.headers.customResponseHeaders.server=Teknologi Umum"
      - "traefik.http.middlewares.rce-redirectscheme.redirectscheme.scheme=https"
      - "traefik.http.middlewares.rce-redirectscheme.redirectscheme.permanent=true"
      - "com.centurylinklabs.watchtower.enable=true"
    platform: linux/amd64
    storage_opt:
      size: '5G'
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: 3
    healthcheck:
      test: "curl -f http://localhost:50051/healthz || exit 1"
      interval: 15s
      timeout: 5s
      retries: 5
    deploy:
      mode: replicated
      replicas: 2
      restart_policy:
        condition: unless-stopped
        delay: 30s
        window: 120s
      resources:
        limits:
          memory: 4GB
          cpus: '2'
        reservations:
          memory: 100MB
          cpus: '0.10'
    networks:
      - pesto
      - internal

  registration:
    image: ghcr.io/teknologi-umum/pesto-registration:edge
    environment:
      <<: [ *defaults ]
      PORT: "3000"
      SENTRY_DSN: ${REGISTRATION_SENTRY_DSN}
      REDIS_URL: redis://@db:6379/
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=pesto"
      - "traefik.http.routers.registration.entrypoints=web,websecure"
      - "traefik.http.routers.registration.rule=Host(`pesto.teknologiumum.com`) && Path(`/api/register`)"
      - "traefik.http.routers.registration.priority=5"
      - "traefik.http.routers.registration.tls.certresolver=tlsresolver"
      - "traefik.http.routers.registration.middlewares=registration-error,registration-header,registration-rate,registration-redirectscheme,registration-inflightreq"
      - "traefik.http.services.registration.loadbalancer.server.port=3000"
      - "traefik.http.services.registration.loadbalancer.server.scheme=http"
      - "traefik.http.services.registration.loadbalancer.healthcheck.interval=30s"
      - "traefik.http.services.registration.loadbalancer.healthcheck.path=/healthz"
      - "traefik.http.middlewares.registration-error.errors.status=500-599"
      - "traefik.http.middlewares.registration-error.errors.service=landing@docker"
      - "traefik.http.middlewares.registration-error.errors.query=/500"
      - "traefik.http.middlewares.registration-rate.ratelimit.average=100"
      - "traefik.http.middlewares.registration-rate.ratelimit.burst=10"
      - "traefik.http.middlewares.registration-rate.ratelimit.period=1m"
      - "traefik.http.middlewares.registration-header.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
      - "traefik.http.middlewares.registration-header.headers.accesscontrolalloworiginlist=*"
      - "traefik.http.middlewares.registration-header.headers.accesscontrolmaxage=604800"
      - "traefik.http.middlewares.registration-header.headers.addvaryheader=true"
      - "traefik.http.middlewares.registration-header.headers.frameDeny=true"
      - "traefik.http.middlewares.registration-header.headers.browserxssfilter=true"
      - "traefik.http.middlewares.registration-header.headers.stsSeconds=604800"
      - "traefik.http.middlewares.registration-header.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.registration-header.headers.browserXssFilter=true"
      - "traefik.http.middlewares.registration-header.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.registration-header.headers.customResponseHeaders.server=Teknologi Umum"
      - "traefik.http.middlewares.registration-redirectscheme.redirectscheme.scheme=https"
      - "traefik.http.middlewares.registration-redirectscheme.redirectscheme.permanent=true"
      - "traefik.http.middlewares.registration-inflightreq.inflightreq.amount=50"
      - "com.centurylinklabs.watchtower.enable=true"
    platform: linux/amd64
    storage_opt:
      size: '1G'
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: 3
    healthcheck:
      test: "wget -q --spider http://localhost:3000/healthz || exit 1"
      interval: 15s
      timeout: 10s
      retries: 5
    depends_on:
      db:
        condition: service_healthy
    deploy:
      mode: replicated
      replicas: 1
      restart_policy:
        condition: unless-stopped
        delay: 30s
        window: 120s
      resources:
        limits:
          memory: 500MB
          cpus: '1'
        reservations:
          memory: 10MB
          cpus: '0.10'
    networks:
      - pesto
      - internal

networks:
  pesto:
    driver: bridge
    external: true
    ipam:
      config:
        - subnet: 10.32.50.0/27
  internal:
    driver: bridge
    external: false
    ipam:
      config:
        - subnet: 10.32.51.0/27

volumes:
  redis-data: