docker-compose.loadtest.yml

# Load test compose: just the tracker + DB + Redis to stress-test announces.
# The web and API aren't needed for raw tracker benchmarking.

services:
  tracker:
    image: ghcr.io/dim145/opentracker/tracker:${IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: apps/tracker/Dockerfile
    container_name: trackarr-loadtest-tracker
    restart: unless-stopped
    # Same hardening as the prod tracker — the binary runs from scratch
    # with no disk writes, so we don't need a tmpfs.
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 100
    environment:
      NODE_ENV: production
      DATABASE_URL: postgres://${DB_USER:-tracker}:${DB_PASSWORD:-tracker}@postgres:5432/${DB_NAME:-trackarr}
      DB_SSL: "false"
      REDIS_URL: redis://redis:6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-loadtest}
      IP_HASH_SECRET: ${IP_HASH_SECRET:-loadtest-ip-hash-secret}
      TRACKER_HTTP_PORT: 8080
      TRACKER_DEBUG: ${TRACKER_DEBUG:-false}
    ports:
      - "8080:8080"
    networks:
      - trackarr-loadtest
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  postgres:
    image: postgres:16-alpine
    container_name: trackarr-loadtest-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${DB_USER:-tracker}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-tracker}
      POSTGRES_DB: ${DB_NAME:-trackarr}
    ports:
      # Bind to loopback only — this overlay ships default/weak creds, so the
      # DB must never be reachable off-host even if run on a shared box
      # (finding L16). Run k6/benchmarks from inside the compose network.
      - "127.0.0.1:5432:5432"
    volumes:
      - loadtest_postgres:/var/lib/postgresql/data
      - ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    command: >
      postgres
      -c ssl=off
      -c max_connections=200
      -c shared_buffers=256MB
    healthcheck:
      test:
        ["CMD-SHELL", "pg_isready -U ${DB_USER:-tracker} -d ${DB_NAME:-trackarr}"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - trackarr-loadtest

  redis:
    image: redis:7-alpine
    container_name: trackarr-loadtest-redis
    restart: unless-stopped
    command: >
      redis-server
      --appendonly no
      --save ""
      --requirepass ${REDIS_PASSWORD:-loadtest}
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
      --maxclients 5000
    ports:
      # Loopback only — see the postgres note above (finding L16).
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-loadtest}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - trackarr-loadtest

networks:
  trackarr-loadtest:
    driver: bridge

volumes:
  loadtest_postgres: