docker-compose.stack.yml

# ================================================================
# Bilibili RAG — Docker Swarm Stack (rolling update production)
# ================================================================
# Build images first, then deploy:
#   docker compose -f docker-compose.yml build
#   docker tag bilibili-rag-backend  registry.example.com/bilirag-backend:v1
#   docker tag bilibili-rag-frontend registry.example.com/bilirag-frontend:v1
#   docker push ...
#
# Deploy to Swarm:
#   docker stack deploy -c docker-compose.stack.yml bilirag
#
# Rolling update:
#   docker service update --image registry.example.com/bilirag-backend:v2 bilirag_backend
#
# Rollback:
#   docker service rollback bilirag_backend

services:
  # ==============================================================
  # Application — rolling update
  # ==============================================================

  backend:
    image: ${BACKEND_IMAGE:-bilirag-backend:latest}
    environment:
      - APP_DEBUG=false
      - APP_LOG_LEVEL=${APP_LOG_LEVEL:-INFO}
      - RDBMS__URL=${RDBMS__URL:-mysql+aiomysql://bilirag:bilirag@mysql:3306/bilirag}
      - MILVUS__URI=${MILVUS__URI:-http://milvus:19530}
      - MILVUS__TOKEN=${MILVUS__TOKEN:-}
      - MONGO__URI=${MONGO__URI:-mongodb://admin:bilirag@mongo:27017/?authSource=admin}
      - REDIS__URL=${REDIS__URL:-redis://:bilirag@redis:6379/1}
      - LLM__API_KEY=${LLM_API_KEY}
      - LLM__BASE_URL=${LLM_BASE_URL:-https://dashscope.aliyuncs.com/compatible-mode/v1}
      - LLM__MODEL=${LLM_MODEL:-qwen3-max}
      - EMBEDDING__MODEL=${EMBEDDING_MODEL:-text-embedding-v4}
      - EMBEDDING__DIMENSION=${EMBEDDING_DIMENSION:-1536}
      - ASR__API_KEY=${ASR_API_KEY:-}
      - ASR__BASE_URL=${ASR_BASE_URL:-https://dashscope.aliyuncs.com/api/v1}
      - ASR__MODEL=${ASR_MODEL:-paraformer-v2}
      - LANGSMITH__API_KEY=${LANGSMITH_API_KEY:-}
      - LANGSMITH__PROJECT=${LANGSMITH_PROJECT:-bilibili-rag}
      - SESSION__SECRET=${SESSION_SECRET}
      - SECURITY__API_KEY_ENCRYPTION_KEY=${API_KEY_ENCRYPTION_KEY}
    volumes:
      - backend_data:/app/data
      - backend_logs:/app/logs
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 30s
    deploy:
      replicas: ${BACKEND_REPLICAS:-2}
      update_config:
        parallelism: 1           # replace 1 replica at a time
        delay: 10s               # wait 10s between batches
        failure_action: rollback # auto-rollback on failure
        monitor: 30s             # monitor new replica for 30s
        order: start-first       # start new before stopping old (zero-downtime)
      rollback_config:
        parallelism: 1
        delay: 5s
        failure_action: pause
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
    networks:
      - bilirag-net

  frontend:
    image: ${FRONTEND_IMAGE:-bilirag-frontend:latest}
    environment:
      - NODE_ENV=production
      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 20s
    deploy:
      replicas: ${FRONTEND_REPLICAS:-2}
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
        monitor: 30s
        order: start-first
      rollback_config:
        parallelism: 1
        delay: 5s
        failure_action: pause
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
    networks:
      - bilirag-net

  # ==============================================================
  # Reverse Proxy
  # ==============================================================

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/certs:/etc/nginx/certs:ro
      - certbot_www:/var/www/certbot
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 5s
      retries: 3
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 5s
        failure_action: rollback
        order: start-first
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
    networks:
      - bilirag-net

  # ==============================================================
  # Infrastructure — stateful (no rolling update, single replica)
  # ==============================================================

  mysql:
    image: mysql:8.4
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:-root123}
      - MYSQL_DATABASE=bilirag
      - MYSQL_USER=${MYSQL_USER:-bilirag}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-bilirag}
    volumes:
      - mysql_data:/var/lib/mysql
      - ./app/system.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD:-root123}"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      replicas: 1
      placement:
        constraints: [node.role == manager]
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 5
    networks:
      - bilirag-net

  redis:
    image: redis:7-alpine
    command: >
      redis-server
      --requirepass ${REDIS_PASSWORD:-bilirag}
      --maxmemory 256mb
      --maxmemory-policy allkeys-lru
      --save 900 1
      --save 300 10
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-bilirag}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      replicas: 1
      placement:
        constraints: [node.role == manager]
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 5
    networks:
      - bilirag-net

  mongo:
    image: mongo:7
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${MONGO_USER:-admin}
      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD:-bilirag}
    volumes:
      - mongo_data:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      replicas: 1
      placement:
        constraints: [node.role == manager]
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 5
    networks:
      - bilirag-net

  milvus:
    image: milvusdb/milvus:v2.4.17
    command: milvus run standalone
    environment:
      - ETCD_ENDPOINTS=etcd:2379
      - MINIO_ADDRESS=minio:9000
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minioadmin}
    volumes:
      - milvus_data:/var/lib/milvus
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9091/healthz"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 60s
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 5
    networks:
      - bilirag-net

  etcd:
    image: quay.io/coreos/etcd:v3.5.14
    environment:
      - ETCD_AUTO_COMPACTION_MODE=revision
      - ETCD_AUTO_COMPACTION_RETENTION=1000
      - ETCD_QUOTA_BACKEND_BYTES=4294967296
      - ETCD_SNAPSHOT_COUNT=50000
    command: >
      etcd
      -advertise-client-urls=http://etcd:2379
      -listen-client-urls=http://0.0.0.0:2379
      -data-dir=/etcd
    volumes:
      - etcd_data:/etcd
    healthcheck:
      test: ["CMD", "etcdctl", "endpoint", "health"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
    networks:
      - bilirag-net

  minio:
    image: minio/minio:RELEASE.2024-11-07T00-52-20Z
    environment:
      - MINIO_ROOT_USER=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_ROOT_PASSWORD=${MINIO_SECRET_KEY:-minioadmin}
    command: server /data --console-address ":9001"
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
    networks:
      - bilirag-net

volumes:
  backend_data:
  backend_logs:
  mysql_data:
  redis_data:
  mongo_data:
  milvus_data:
  etcd_data:
  minio_data:
  certbot_www:

networks:
  bilirag-net:
    driver: overlay
    attachable: true