From bd17c718d0ba4b7612996825060d7e2e04bcf24a Mon Sep 17 00:00:00 2001 From: Thomas Stocker Date: Wed, 29 Oct 2025 10:48:58 +0100 Subject: [PATCH] feat: refacto compose.prod.yaml and add install documentation Signed-off-by: Thomas Stocker --- docker-compose.yaml => compose.prod.yaml | 87 +---------- docs/INSTALLATION.md | 181 +++++++++++++++++++---- 2 files changed, 159 insertions(+), 109 deletions(-) rename docker-compose.yaml => compose.prod.yaml (50%) diff --git a/docker-compose.yaml b/compose.prod.yaml similarity index 50% rename from docker-compose.yaml rename to compose.prod.yaml index 3d2b21b91..6ed2c9cde 100644 --- a/docker-compose.yaml +++ b/compose.prod.yaml @@ -11,7 +11,7 @@ services: # Application settings PROBOD_HOSTNAME: "localhost:8080" API_ADDR: "localhost:8080" - API_CORS_ALLOWED_ORIGINS: "http://localhost:8080,http://localhost:5173" + API_CORS_ALLOWED_ORIGINS: "http://localhost:8080" # PostgreSQL database PG_ADDR: "postgres:5432" @@ -29,10 +29,10 @@ services: # Observability - Metrics & Tracing METRICS_ADDR: "probo:8081" - TRACING_ADDR: "tempo:4317" + TRACING_ADDR: "" # Email notifications - SMTP_ADDR: "mailpit:1025" + SMTP_ADDR: "your.smtp.server:587" SMTP_TLS_REQUIRED: "false" MAILER_SENDER_NAME: "Probo" MAILER_SENDER_EMAIL: "no-reply@notification.getprobo.com" @@ -81,64 +81,6 @@ services: MINIO_ROOT_USER: "probod" MINIO_ROOT_PASSWORD: "thisisnotasecret" - grafana: - image: "grafana/grafana:latest" - ports: - - "3001:3000" - volumes: - - "./compose/grafana/provisioning:/etc/grafana/provisioning:ro" - - "grafana-data:/var/lib/grafana:rw" - environment: - GF_AUTH_ANONYMOUS_ENABLED: "true" - GF_AUTH_ANONYMOUS_ORG_ROLE: "Admin" - GF_AUTH_DISABLE_LOGIN_FORM: "true" - GF_USERS_DEFAULT_THEME: "light" - - prometheus: - image: "prom/prometheus:latest" - volumes: - - "./compose/prometheus/prometheus.yaml:/etc/prometheus/prometheus.yml" - - "prometheus-data:/prometheus" - command: - - "--config.file=/etc/prometheus/prometheus.yml" - - "--storage.tsdb.path=/prometheus" - - "--web.console.libraries=/etc/prometheus/console_libraries" - - "--web.console.templates=/etc/prometheus/consoles" - - "--web.enable-lifecycle" - - "--web.enable-remote-write-receiver" - - "--web.listen-address=:9191" - ports: - - "9191:9191" - - loki: - image: "grafana/loki:latest" - ports: - - "3100:3100" - command: - - "-config.file=/etc/loki/local-config.yaml" - - tempo: - image: "grafana/tempo:latest" - command: - - "-config.file=/etc/tempo.yaml" - ports: - - "4317:4317" - volumes: - - "./compose/tempo/tempo.yaml:/etc/tempo.yaml:ro" - - "tempo-data:/var/tempo:rw" - - mailpit: - image: "axllent/mailpit:latest" - ports: - - "1025:1025" # SMTP server - - "8025:8025" # Web UI - environment: - - "MP_DISABLE_VERSION_CHECK=true" - - "MP_VERBOSE=false" - - "MP_SMTP_AUTH_ACCEPT_ANY=true" - - "MP_ENABLE_PROMETHEUS=true" - - "MP_SMTP_AUTH_ALLOW_INSECURE=true" - chrome: image: "chromedp/headless-shell:140.0.7259.2" ports: @@ -155,31 +97,8 @@ services: - "--disable-background-timer-throttling" - "--disable-extensions" - pebble: - image: "letsencrypt/pebble:latest" - ports: - - "14000:14000" # ACME server - - "15000:15000" # Management interface - environment: - PEBBLE_VA_NOSLEEP: "1" # Don't sleep during validation for faster testing - PEBBLE_WFE_NONCEREJECT: "0" # Don't reject reused nonces - PEBBLE_VA_ALWAYS_VALID: "1" # Skip actual HTTP/DNS validation for local dev - command: pebble -config /test/config/pebble-config.json -dnsserver 127.0.0.1:8053 - volumes: - - "./compose/pebble:/test/config:ro" - - pebble-challtestsrv: - image: "letsencrypt/pebble-challtestsrv:latest" - ports: - - "8055:8055" # HTTP-01 challenge test server - - "8053:8053" # DNS server - - "8056:8056" # Management API - command: pebble-challtestsrv -dns01 ":8053" -http01 ":8055" -management ":8056" volumes: probo-data: postgres-data: minio-data: - grafana-data: - prometheus-data: - tempo-data: diff --git a/docs/INSTALLATION.md b/docs/INSTALLATION.md index ad9980b6a..e79838bdb 100644 --- a/docs/INSTALLATION.md +++ b/docs/INSTALLATION.md @@ -28,57 +28,188 @@ docker run -d \ ### Docker Compose Setup -For a complete setup with dependencies, you can use Docker Compose: +For a complete setup with dependencies, you can use our `compose.prod.yml` Docker Compose file: +You can either provide environment variables directly in the docker-compose file or use a config file mounted as a volume. + +#### With Environment Variables ```yaml -version: "3.8" - services: - probod: - image: ghcr.io/getprobo/probo:latest + probo: + image: "ghcr.io/getprobo/probo:latest" + environment: + # Required secrets (use secure values in production) + PROBOD_ENCRYPTION_KEY: "thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA=" + AUTH_COOKIE_SECRET: "this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes" + AUTH_PASSWORD_PEPPER: "this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes" + TRUST_AUTH_TOKEN_SECRET: "this-is-a-secure-secret-for-trust-token-signing-at-least-32-bytes" + + # Application settings + PROBOD_HOSTNAME: "localhost:8080" + API_ADDR: "localhost:8080" + API_CORS_ALLOWED_ORIGINS: "http://localhost:8080" + + # PostgreSQL database + PG_ADDR: "postgres:5432" + PG_USERNAME: "postgres" + PG_PASSWORD: "postgres" + PG_DATABASE: "probod" + PG_POOL_SIZE: "100" + + # AWS/MinIO S3 storage + AWS_REGION: "us-east-1" + AWS_BUCKET: "probod" + AWS_ACCESS_KEY_ID: "probod" + AWS_SECRET_ACCESS_KEY: "thisisnotasecret" + AWS_ENDPOINT: "http://minio:9000" + + # Observability - Metrics & Tracing + METRICS_ADDR: "probo:8081" + TRACING_ADDR: "" + + # Email notifications + SMTP_ADDR: "your.smtp.server:587" + SMTP_TLS_REQUIRED: "false" + MAILER_SENDER_NAME: "Probo" + MAILER_SENDER_EMAIL: "no-reply@notification.getprobo.com" + + # Chrome for PDF generation + CHROME_DP_ADDR: "chrome:9222" ports: - "8080:8080" + - "8081:8081" + - "8443:8443" volumes: - - ./config.yaml:/etc/probod/config.yaml - - ./data:/data - environment: - - PROBOD_CONFIG=/etc/probod/config.yaml + - "probo-data:/data" depends_on: - postgres - minio + - chrome + postgres: - image: postgres:17.4 - shm_size: 1g + image: "postgres:17.4" + shm_size: "1g" command: > postgres -c "shared_buffers=4GB" -c "max_connections=200" -c "log_statement=all" - environment: - POSTGRES_USER: postgres - POSTGRES_PASSWORD: postgres - volumes: - - postgres_data:/var/lib/postgresql/data ports: - "5432:5432" + volumes: + - "./compose/postgres:/docker-entrypoint-initdb.d:ro" + - "postgres-data:/var/lib/postgresql/data:rw" + environment: + POSTGRES_USER: "postgres" + POSTGRES_PASSWORD: "postgres" minio: - image: quay.io/minio/minio - entrypoint: sh + image: "quay.io/minio/minio" + entrypoint: "sh" command: | -c 'mkdir -p /var/lib/minio/probod && minio server --json --console-address :9001 /var/lib/minio' - environment: - MINIO_ROOT_USER: probod - MINIO_ROOT_PASSWORD: thisisnotasecret - volumes: - - minio_data:/var/lib/minio ports: - "9000:9000" - "9001:9001" + volumes: + - "minio-data:/var/lib/minio:rw" + environment: + MINIO_ROOT_USER: "probod" + MINIO_ROOT_PASSWORD: "thisisnotasecret" + + chrome: + image: "chromedp/headless-shell:140.0.7259.2" + ports: + - "9222:9222" + command: + - "--headless" + - "--disable-gpu" + - "--disable-dev-shm-usage" + - "--hide-scrollbars" + - "--mute-audio" + - "--no-default-browser-check" + - "--no-first-run" + - "--disable-background-networking" + - "--disable-background-timer-throttling" + - "--disable-extensions" + volumes: - postgres_data: - minio_data: + probo-data: + postgres-data: + minio-data: +``` +#### With mounted Config File +```yaml +services: + probo: + image: "ghcr.io/getprobo/probo:latest" + ports: + - "8080:8080" + - "8081:8081" + - "8443:8443" + environment: + - PROBOD_CONFIG=/etc/probod/config.yaml + volumes: + - "probo-data:/data" + - "./cfg/dev.yaml:/etc/probod/config.yaml:ro" + depends_on: + - postgres + - minio + - chrome + + + postgres: + image: "postgres:17.4" + shm_size: "1g" + command: > + postgres -c "shared_buffers=4GB" + -c "max_connections=200" + -c "log_statement=all" + ports: + - "5432:5432" + volumes: + - "./compose/postgres:/docker-entrypoint-initdb.d:ro" + - "postgres-data:/var/lib/postgresql/data:rw" + environment: + POSTGRES_USER: "postgres" + POSTGRES_PASSWORD: "postgres" + + minio: + image: "quay.io/minio/minio" + entrypoint: "sh" + command: | + -c 'mkdir -p /var/lib/minio/probod && minio server --json --console-address :9001 /var/lib/minio' + ports: + - "9000:9000" + - "9001:9001" + volumes: + - "minio-data:/var/lib/minio:rw" + environment: + MINIO_ROOT_USER: "probod" + MINIO_ROOT_PASSWORD: "thisisnotasecret" + + chrome: + image: "chromedp/headless-shell:140.0.7259.2" + ports: + - "9222:9222" + command: + - "--headless" + - "--disable-gpu" + - "--disable-dev-shm-usage" + - "--hide-scrollbars" + - "--mute-audio" + - "--no-default-browser-check" + - "--no-first-run" + - "--disable-background-networking" + - "--disable-background-timer-throttling" + - "--disable-extensions" + + +volumes: + probo-data: + postgres-data: + minio-data: ``` ### Docker Architecture Support