kit/docker-compose.yml at main · sandstream/kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
version: "3.8"

services:
  # kit CLI - for testing CLI commands
  kit-cli:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: kit-cli
    working_dir: /app
    environment:
      NODE_ENV: development
      DEBUG: kit:*
    volumes:
      - ./src:/app/src
      - ./dist:/app/dist
    command: npm run dev
    networks:
      - kit-network

  # Marketplace Frontend
  marketplace:
    build:
      context: .
      dockerfile: Dockerfile.marketplace
    container_name: kit-marketplace
    ports:
      - "3000:3000"
    environment:
      NODE_ENV: development
      NEXT_PUBLIC_API_URL: http://localhost:8000
      DATABASE_URL: postgresql://kit:password@postgres:5432/kit
      REDIS_URL: redis://redis:6379
    depends_on:
      - postgres
      - redis
    networks:
      - kit-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 40s

  # PostgreSQL Database
  postgres:
    image: postgres:16-alpine
    container_name: kit-postgres
    # Hardening (semgrep no-new-privileges / writable-filesystem): no setuid
    # escalation; root fs read-only — postgres writes only via the data volume
    # and the tmpfs run/tmp dirs.
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /run/postgresql
    environment:
      POSTGRES_USER: kit
      POSTGRES_PASSWORD: password
      POSTGRES_DB: kit
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./scripts/init-db.sql:/docker-entrypoint-initdb.d/init.sql
    networks:
      - kit-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U kit"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Redis Cache
  redis:
    image: redis:7-alpine
    container_name: kit-redis
    security_opt:
      - no-new-privileges:true
    read_only: true
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    networks:
      - kit-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    command: redis-server --appendonly yes

  # Infisical Secrets Management (optional)
  # infisical:
  #   image: infisical/infisical:latest
  #   container_name: kit-infisical
  #   ports:
  #     - "8080:3000"
  #   environment:
  #     ENCRYPTION_KEY: dev-encryption-key-64-chars-minimum-required-length
  #   volumes:
  #     - infisical_data:/app/backend/data
  #   networks:
  #     - kit-network

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  # infisical_data:
  #   driver: local

networks:
  kit-network:
    driver: bridge