Covenant/docker-compose.yml at main · Mhemd139/Covenant · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Local services for Covenant.
#   docker compose up -d db                    # Layer 2 contract store
#   DATABASE_URL=postgresql://covenant:covenant@127.0.0.1:5432/covenant
#   docker compose up -d prometheus grafana    # Layer 4 observability
#   Grafana: http://localhost:3000 (anonymous) - scrapes the proxy at host port 9000
# Reversible: `docker compose down -v` removes the containers and volumes.

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: covenant
      POSTGRES_PASSWORD: covenant
      POSTGRES_DB: covenant
    ports:
      - "127.0.0.1:5432:5432"  # loopback only - static credentials must not face the LAN
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U covenant"]
      interval: 3s
      timeout: 3s
      retries: 10

  prometheus:
    image: prom/prometheus:latest
    ports:
      - "127.0.0.1:9090:9090"  # loopback only - a local dev stack must not listen on the LAN
    volumes:
      - ./deploy/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"  # reach the proxy on the host (Linux parity)

  grafana:
    image: grafana/grafana:latest
    ports:
      - "127.0.0.1:3000:3000"  # loopback only
    environment:
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Viewer  # anonymous can view the provisioned dashboard, nothing more
    volumes:
      - ./deploy/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./deploy/grafana/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      - prometheus

volumes:
  pgdata: {}