Separ/docker-compose.yml at main · Angelerator/Separ · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
services:
  # PostgreSQL database
  postgres:
    image: postgres:16-alpine
    container_name: separ-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-separ}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-separ}
    ports:
      - "5433:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-separ}"]
      interval: 5s
      timeout: 5s
      retries: 5

  # SpiceDB for authorization
  spicedb:
    image: authzed/spicedb:latest
    container_name: separ-spicedb
    command: serve --grpc-preshared-key "${SPICEDB_PRESHARED_KEY}"
    ports:
      - "50051:50051"  # gRPC
      - "8443:8443"    # HTTP/REST
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: "postgres://${POSTGRES_USER:-separ}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-separ}?sslmode=disable"
    healthcheck:
      test: ["CMD", "grpc_health_probe", "-addr=localhost:50051"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  # SpiceDB migration (run once to initialize)
  spicedb-migrate:
    image: authzed/spicedb:latest
    container_name: separ-spicedb-migrate
    command: migrate head --datastore-engine postgres --datastore-conn-uri "postgres://${POSTGRES_USER:-separ}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-separ}?sslmode=disable"
    depends_on:
      postgres:
        condition: service_healthy

  # Database migrations (run once before separ starts)
  separ-migrate:
    image: postgres:16-alpine
    container_name: separ-migrate
    environment:
      PGHOST: postgres
      PGUSER: ${POSTGRES_USER:-separ}
      PGPASSWORD: ${POSTGRES_PASSWORD}
      PGDATABASE: ${POSTGRES_DB:-separ}
    volumes:
      - ./crates/separ-db/migrations:/migrations:ro
    command: >
      sh -c '
        echo "Running migrations..."
        for f in /migrations/*.sql; do
          if [ -f "$$f" ]; then
            echo "Applying: $$f"
            psql -h postgres -U ${POSTGRES_USER:-separ} -d ${POSTGRES_DB:-separ} -f "$$f" 2>&1 || true
          fi
        done
        echo "Migrations complete"
      '
    depends_on:
      postgres:
        condition: service_healthy

  # Separ API Server
  separ:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: separ-api
    ports:
      - "8080:8080"
    environment:
      SEPAR__SERVER__HOST: "0.0.0.0"
      SEPAR__SERVER__PORT: "8080"
      SEPAR__DATABASE__URL: "postgres://${POSTGRES_USER:-separ}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-separ}"
      SEPAR__SPICEDB__ENDPOINT: "http://spicedb:50051"
      SEPAR__SPICEDB__TOKEN: "${SPICEDB_PRESHARED_KEY}"
      SEPAR_ADMIN_API_KEY: "${SEPAR_ADMIN_API_KEY:-super-secret-admin-key}"
      SEPAR__JWT__SECRET: "${JWT_SECRET}"
      SEPAR__JWT__ISSUER: "${JWT_ISSUER:-separ}"
      RUST_LOG: "${RUST_LOG:-info,separ=debug}"
    depends_on:
      postgres:
        condition: service_healthy
      spicedb:
        condition: service_healthy
      separ-migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

volumes:
  postgres_data: