docker-compose.stack.yml

version: '3.9'

services:
  adminer:
    image: adminer
    networks:
      - twir
      - traefik-public
    deploy:
      placement:
        constraints:
          - node.labels.databases != true
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-adminer.rule=Host(`adminer.twir.app`)
        - traefik.http.services.twir-adminer.loadbalancer.server.port=8080
        - traefik.docker.network=traefik-public

  nats:
    image: nats:2.10.11-scratch
    restart: always
    command: -js -m 8222
    networks:
      - twir
      - traefik-public
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases != true
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-nats.rule=Host(`nats.twir.app`)
        - traefik.http.services.twir-nats.loadbalancer.server.port=8222
        - traefik.docker.network=traefik-public

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.116.1
    volumes:
      - ./configs/otel/otel-collector.yaml:/etc/otelcol-contrib/config.yaml
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 3s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.role == manager

#  postgres-old:
#    image: 'bitnami/postgresql:17'
#    environment:
#      POSTGRES_USER_FILE: /run/secrets/twir_postgres_user
#      POSTGRES_PASSWORD_FILE: /run/secrets/twir_postgres_password
#      POSTGRES_DB_FILE: /run/secrets/twir_postgres_db
#      POSTGRESQL_POSTGRES_PASSWORD_FILE: /run/secrets/twir_postgres_password
#      POSTGRESQL_MAX_CONNECTIONS: 1000
#    secrets:
#      - twir_postgres_user
#      - twir_postgres_password
#      - twir_postgres_db
#    volumes:
#      - twir-postgres-data:/bitnami/postgresql
#    networks:
#      - twir
#    deploy:
#      restart_policy:
#        condition: any
#        delay: 30s
#        max_attempts: 30
#      endpoint_mode: dnsrr
#      placement:
#        constraints:
#          - node.labels.databases-1 == tru

  postgres:
    image: 'twirapp/postgres:latest'
    command: postgres -c max_connections=1000 -c shared_buffers=1536MB -c effective_cache_size=4608MB -c maintenance_work_mem=384MB -c checkpoint_completion_target=0.9 -c wal_buffers=16MB -c default_statistics_target=100 -c random_page_cost=1.1 -c effective_io_concurrency=200 -c work_mem=786kB -c huge_pages=off -c min_wal_size=1GB -c max_wal_size=4GB -c shared_preload_libraries='pgx_ulid'
    environment:
      POSTGRES_USER_FILE: /run/secrets/twir_postgres_user
      POSTGRES_PASSWORD_FILE: /run/secrets/twir_postgres_password
      POSTGRES_DB_FILE: /run/secrets/twir_postgres_db
    secrets:
      - twir_postgres_user
      - twir_postgres_password
      - twir_postgres_db
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases-1 == true

  postgres-backup:
    image: registry.twir.app/twirapp/postgres-backup:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases == true

  pgbouncer:
    image: bitnami/pgbouncer:1.23.1
    secrets:
      - twir_postgres_user
      - twir_postgres_password
      - twir_postgres_db
    environment:
      - POSTGRESQL_HOST=postgres
      - POSTGRESQL_USERNAME_FILE=/run/secrets/twir_postgres_user
      - POSTGRESQL_PASSWORD_FILE=/run/secrets/twir_postgres_password
      - POSTGRESQL_DATABASE_FILE=/run/secrets/twir_postgres_db

      - PGBOUNCER_AUTH_USER=twir
      - PGBOUNCER_DATABASE=twir
      - PGBOUNCER_DEFAULT_POOL_SIZE=100
      - PGBOUNCER_MIN_POOL_SIZE=20
      - PGBOUNCER_RESERVE_POOL_SIZE=20
      - PGBOUNCER_RESERVE_POOL_TIMEOUT=5
      - PGBOUNCER_MAX_CLIENT_CONN=4000
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases == true


  temporal-postgres:
    image: 'bitnami/postgresql:17'
    environment:
      POSTGRES_USER: temporal
      POSTGRES_PASSWORD: temporal
      POSTGRES_DB: temporal
      POSTGRESQL_POSTGRES_PASSWORD: temporal
    volumes:
      - temporal-postgres-data:/bitnami/postgresql
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases-1 == true

  temporal:
    depends_on:
      - postgres
    image: twirapp/temporal:latest
    networks:
      - twir
    secrets:
      - twir_postgres_user
      - twir_postgres_password
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      labels:
        kompose.volume.type: configMap
      placement:
        constraints:
          - node.labels.databases != true

  temporal-ui:
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      - TEMPORAL_CORS_ORIGINS=http://localhost:3000
    image: temporalio/ui:2.21.0
    networks:
      - twir
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-temporal.rule=Host(`temporal.twir.app`)

        - traefik.http.services.twir-temporal.loadbalancer.server.port=8080
        - traefik.docker.network=traefik-public
      placement:
        constraints:
          - node.labels.databases != true

  migrations:
    image: twirapp/migrations:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      restart_policy:
        condition: on-failure
        delay: 30s
        max_attempts: 30
    healthcheck:
      test: exit 0

  redis:
    image: redis:7.4.2
    command: redis-server --save 60 1 --loglevel warning
    volumes:
      - redis-data:/data
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 3s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases == true

  api:
    image: twirapp/api:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-api.rule=Host(`twir.app`) && PathPrefix(`/api-old`)
        - traefik.http.routers.twir-api.middlewares=api-stripprefix
        - traefik.http.middlewares.api-stripprefix.stripprefix.prefixes=/api-old
        - traefik.http.services.twir-api.loadbalancer.server.port=3002
        - traefik.docker.network=traefik-public
      update_config:
        parallelism: 2
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.labels.databases != true

  api-gql:
    image: twirapp/api-gql:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-api-gql.rule=Host(`twir.app`) && PathPrefix(`/api`)
        - traefik.http.routers.twir-api-gql.middlewares=api-gql-stripprefix
        - traefik.http.middlewares.api-gql-stripprefix.stripprefix.prefixes=/api
        - traefik.http.services.twir-api-gql.loadbalancer.server.port=3009
        - traefik.docker.network=traefik-public
      update_config:
        parallelism: 2
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.labels.databases != true

  bots:
    image: twirapp/bots:latest
    secrets:
      - twir_doppler_token
    networks:
      - traefik-public
      - twir
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-bots.rule=Host(`services-bots.twir.app`)

        - traefik.http.services.twir-bots.loadbalancer.server.port=3000
        - traefik.docker.network=traefik-public
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases != true

  parser:
    image: twirapp/parser:latest
    secrets:
      - twir_doppler_token
    deploy:
      update_config:
        parallelism: 2
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      mode: replicated
      replicas: 6
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases != true
    networks:
      - twir

  timers:
    image: twirapp/timers:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      update_config:
        parallelism: 2
      mode: replicated
      replicas: 6
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases != true

  scheduler:
    image: twirapp/scheduler:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases != true

  eventsub:
    image: twirapp/eventsub:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
      - traefik-public
      - cloudflared
    deploy:
      mode: replicated
      replicas: 3
      update_config:
        parallelism: 1
      endpoint_mode: dnsrr
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-eventsub.rule=Host(`eventsub.twir.app`)
        - traefik.http.services.twir-eventsub.loadbalancer.server.port=3003
        - traefik.docker.network=traefik-public
      placement:
        constraints:
          - node.labels.databases != true

  eval:
    image: twirapp/eval:latest
    secrets:
      - twir_doppler_token
    deploy:
      mode: replicated
      replicas: 8
      update_config:
        parallelism: 2
      endpoint_mode: dnsrr
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      resources:
        limits:
          cpus: '0.3'
          memory: 256M
      placement:
        constraints:
          - node.labels.databases != true
    networks:
      - twir

  integrations:
    image: twirapp/integrations:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr

  web:
    image: twirapp/web:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
      - traefik-public
    deploy:
      update_config:
        parallelism: 2
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      mode: replicated
      replicas: 4
      endpoint_mode: dnsrr
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-web.rule=Host(`twir.app`)

        - traefik.http.services.twir-web.loadbalancer.server.port=3000
        - traefik.docker.network=traefik-public
      placement:
        constraints:
          - node.labels.databases != true

  dashboard:
    image: twirapp/dashboard:latest
    command: --gzip --brotli --threshold 500 --ignore-cache-control-paths "/sw.js,/index.html,/manifest.webmanifest,/pluginWebUpdateNotice/web_version_by_plugin.json"
    secrets:
      - twir_doppler_token
    networks:
      - twir
      - traefik-public
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-dashboard.rule=Host(`twir.app`) && PathPrefix(`/dashboard`)
        - traefik.http.routers.twir-dashboard.middlewares=dashboard-stripprefix
        - traefik.http.middlewares.dashboard-stripprefix.stripprefix.prefixes=/dashboard
        - traefik.http.services.twir-dashboard.loadbalancer.server.port=8080
        - traefik.docker.network=traefik-public
      placement:
        constraints:
          - node.labels.databases != true

  overlays:
    image: twirapp/overlays:latest
    command: --gzip --brotli --threshold 500
    networks:
      - twir
      - traefik-public
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-overlays.rule=Host(`twir.app`) && PathPrefix(`/overlays`)
        - traefik.http.routers.twir-overlays.middlewares=overlays-stripprefix
        - traefik.http.middlewares.overlays-stripprefix.stripprefix.prefixes=/overlays
        - traefik.http.services.twir-overlays.loadbalancer.server.port=8080
        - traefik.docker.network=traefik-public
      placement:
        constraints:
          - node.labels.databases != true

  websockets:
    image: twirapp/websockets:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
      - traefik-public
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      labels:
        - traefik.enable=true
        - traefik.http.routers.twir-websockets.rule=Host(`twir.app`) && PathPrefix(`/socket`)
        - traefik.http.routers.twir-websockets.middlewares=sockets-stripprefix
        - traefik.http.middlewares.sockets-stripprefix.stripprefix.prefixes=/socket
        - traefik.http.services.twir-websockets.loadbalancer.server.port=3004
        - traefik.docker.network=traefik-public
      placement:
        constraints:
          - node.labels.databases != true

  tokens:
    image: twirapp/tokens:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      update_config:
        parallelism: 2
      mode: replicated
      replicas: 4
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases != true

  emotes-cacher:
    image: twirapp/emotes-cacher:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      update_config:
        parallelism: 2
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 4
      placement:
        constraints:
          - node.labels.databases != true

  events:
    image: twirapp/events:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      update_config:
        parallelism: 2
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 6
      placement:
        constraints:
          - node.labels.databases != true

  ytsr:
    image: twirapp/ytsr:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      update_config:
        parallelism: 2
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 6
      placement:
        constraints:
          - node.labels.databases != true

  tts:
    image: aculeasis/rhvoice-rest:latest
    networks:
      - twir
    deploy:
      update_config:
        parallelism: 2
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 4
      placement:
        constraints:
          - node.labels.databases != true

  discord:
    image: twirapp/discord:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
    deploy:
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases != true

  language-detector:
    image: twirapp/language-detector:latest
    secrets:
      - twir_doppler_token
    environment:
      - APP_ENV=production
    deploy:
      update_config:
        parallelism: 1
      mode: replicated
      replicas: 2
      endpoint_mode: dnsrr
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      placement:
        constraints:
          - node.labels.databases != true
          - node.role != manager
    networks:
      - twir

  toxicity-detector:
    image: twirapp/toxicity-detector:latest
    environment:
      TOXICITY_THRESHOLD: -4
    deploy:
      update_config:
        parallelism: 2
      mode: replicated
      replicas: 4
      endpoint_mode: dnsrr
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      placement:
        constraints:
          - node.labels.databases != true
          - node.role != manager
    networks:
      - twir

  # This is https://github.com/twirapp/music-recognizer repository, which is doing "Shazam for twitch stream".
  music-recognizer:
    image: registry.twir.app/twirapp/music-recognizer:latest
    secrets:
      - twir_doppler_token
    networks:
      - twir
      - traefik-public
    deploy:
      labels: # for testing purposes, not needed in production because requests done via internal docker network
        - traefik.enable=true
        - traefik.http.routers.music-recognizer.rule=Host(`music-recognizer.twir.app`)
        - traefik.http.services.music-recognizer.loadbalancer.server.port=3000
        - traefik.docker.network=traefik-public
      update_config:
        parallelism: 1
      restart_policy:
        condition: any
        delay: 30s
        max_attempts: 30
      mode: replicated
      replicas: 4
      endpoint_mode: dnsrr
      placement:
        constraints:
          - node.labels.databases != true

volumes:
  postgres-data:
  redis-data:
  minio-data:
  temporal-postgres-data:

networks:
  twir:
    name: twir
    external: true
  traefik-public:
    external: true
  cloudflared:
    external: true

secrets:
  twir_doppler_token:
    external: true
  twir_postgres_user:
    external: true
  twir_postgres_db:
    external: true
  twir_postgres_password:
    external: true