docker-compose-storage-only.yml

# Local / lab stack for storage-only (trunk) mode.
# 对照 `docker/docker-compose.test.yml` 的数据面，去掉 website / mailpit / OAuth IT，
# 以 `config/config-storage-only.toml` 跑 Git smart HTTP 推送 + 可选 SSH 只读。
# 对象存储默认 RustFS（s3compatible）——直接 up 即可，不必加 --env-file。
# 仅当要把 mega2 改成本地文件系统后端时，才加
# `--env-file config/compose.env.storage-only.local`（RustFS 容器仍会启动）。
#
# 权威配置 / 运维说明:
#   config/config-storage-only.toml
#   docs/deploy-trunk.md
#
# 默认网络不固定名字，compose 为每个项目建 `<项目名>_default`（本栈为
# `mega2-trunk_default`）：以本文件、不同 `-p` 起的另一套栈解析不到本栈的
# postgres / redis / rustfs / mega2，也就碰不到本栈的数据库与对象存储；
# 宿主端口仍须另用 override 错开（plan-20261001 FIX-BB-06）。
#
# 与 IT 栈并存时务必带不同项目名，且本文件端口不与
# `docker/docker-compose.test.yml`（15432 / 16379 / 19000 / 19180）冲突:
#
#   # 默认 RustFS（无需 --env-file）
#   docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml up -d --wait
#
#   # 可选：mega2 改用本地文件系统对象存储（仅此情况需要 --env-file）
#   docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml \
#     --env-file config/compose.env.storage-only.local up -d --wait
#
# 首次构建（context = 本仓库根；`.dockerignore` 排除 target/）:
#
#   docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml build mega2
#
# HTTP:  http://127.0.0.1:9000/
# SSH:   ssh://git@127.0.0.1:2222/   (upload-pack only; receive-pack 关闭)
# RustFS API / console: 127.0.0.1:29000 / 127.0.0.1:29001
# Push:  Basic/Bearer，password/token = secrets/mega2-push-token.local 内容
#        （默认本地 token: mega2-storage-only-local-dev-token-0001）
#
# 生产/非本机: 用 MEGA2_PUSH_TOKEN_FILE 指向真实 secret 文件，勿提交明文。

services:
  postgres:
    image: postgres:18.6-alpine3.24
    shm_size: "256mb"
    environment:
      POSTGRES_USER: mega2
      POSTGRES_PASSWORD: mega2_storage_password
      POSTGRES_DB: mega2
    ports:
      - "127.0.0.1:25432:5432"
    volumes:
      # Postgres 18 image: mount the parent dir, not .../data.
      - mega2-trunk-pg:/var/lib/postgresql
      - ./traces_pg_trgm_init.sql:/docker-entrypoint-initdb.d/zz-traces-pg-trgm.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U mega2 -d mega2"]
      interval: 2s
      timeout: 5s
      retries: 20

  redis:
    image: redis:8.10.1-alpine3.23
    ports:
      - "127.0.0.1:26379:6379"
    volumes:
      - mega2-trunk-redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 2s
      timeout: 5s
      retries: 20

  # Default S3-compatible object store (RustFS). Lab credentials: rustfs /
  # rustfs_secret — matches config/config-storage-only.toml.
  rustfs:
    image: rustfs/rustfs:1.0.0@sha256:8cc9801755448b71a786705ce76692c77e14936cccd87cf2fc31842e58f4d1ff
    environment:
      RUSTFS_VOLUMES: /data
      RUSTFS_ADDRESS: 0.0.0.0:9000
      RUSTFS_CONSOLE_ADDRESS: 0.0.0.0:9001
      RUSTFS_CONSOLE_ENABLE: "true"
      RUSTFS_ACCESS_KEY: rustfs
      RUSTFS_SECRET_KEY: rustfs_secret
      RUSTFS_UNSAFE_BYPASS_DISK_CHECK: "true"
    ports:
      - "127.0.0.1:29000:9000"
      - "127.0.0.1:29001:9001"
    volumes:
      - mega2-trunk-rustfs:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9000/health"]
      interval: 2s
      timeout: 5s
      retries: 30
      start_period: 10s

  # Bucket init via RustFS CLI (`rc`). Stays up so `up -d --wait` can wait on it.
  rustfs-init:
    image: rustfs/rc:v0.1.36@sha256:ab024bfebee49a750ce886b4c70963ccd9ddaa03f491704a90710641d7a26699
    depends_on:
      rustfs:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      /usr/bin/rc alias set local http://rustfs:9000 rustfs rustfs_secret &&
      /usr/bin/rc mb --ignore-existing local/mega2 &&
      /usr/bin/rc anonymous set download local/mega2 &&
      exec sleep infinity
      "
    healthcheck:
      test: ["CMD-SHELL", "/usr/bin/rc ls local/mega2"]
      interval: 2s
      timeout: 5s
      retries: 20
      start_period: 3s

  # Standing mega2 for storage-only: trunk + push_auth=token + RustFS.
  mega2:
    image: mega2:local
    pull_policy: never
    build:
      context: ..
      dockerfile: Dockerfile
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rustfs-init:
        condition: service_healthy
    environment:
      MEGA_BASE_DIR: /var/lib/mega2
      MEGA_CONFIG: /etc/mega2/config.toml
      MEGA_DATABASE__DB_TYPE: postgres
      MEGA_DATABASE__DB_URL: postgres://mega2:mega2_storage_password@postgres:5432/mega2
      MEGA_REDIS__URL: redis://redis:6379
      # Default RustFS (s3compatible). No --env-file needed for the default.
      # Optional local FS backend: --env-file config/compose.env.storage-only.local
      MEGA_OBJECT_STORAGE__STORAGE_TYPE: ${MEGA_OBJECT_STORAGE__STORAGE_TYPE:-s3compatible}
      MEGA_OBJECT_STORAGE__LOCAL__ROOT_DIR: ${MEGA_OBJECT_STORAGE__LOCAL__ROOT_DIR:-/var/lib/mega2/objects}
      MEGA_OBJECT_STORAGE__S3__REGION: ${MEGA_OBJECT_STORAGE__S3__REGION:-us-east-1}
      MEGA_OBJECT_STORAGE__S3__BUCKET: ${MEGA_OBJECT_STORAGE__S3__BUCKET:-mega2}
      MEGA_OBJECT_STORAGE__S3__ACCESS_KEY_ID: ${MEGA_OBJECT_STORAGE__S3__ACCESS_KEY_ID:-rustfs}
      MEGA_OBJECT_STORAGE__S3__SECRET_ACCESS_KEY: ${MEGA_OBJECT_STORAGE__S3__SECRET_ACCESS_KEY:-rustfs_secret}
      # In-network endpoint (sample file uses host 127.0.0.1:29000 for bare-metal).
      MEGA_OBJECT_STORAGE__S3__ENDPOINT_URL: ${MEGA_OBJECT_STORAGE__S3__ENDPOINT_URL:-http://rustfs:9000}
      # Presigned URLs (artifacts / LFS) are signed for the host-published RustFS
      # port so host clients can follow them (docs/refactoring/orbit.md).
      # In-network LFS smoke: the lfs-innetwork env-file signs for rustfs:9000.
      MEGA_OBJECT_STORAGE__S3__PUBLIC_ENDPOINT_URL: ${MEGA_OBJECT_STORAGE__S3__PUBLIC_ENDPOINT_URL:-http://127.0.0.1:29000}
      # Artifact GC, off by default (the code defaults). GC opt-in stack:
      #   --env-file config/compose.env.storage-only.artifacts-gc
      MEGA_ARTIFACTS_GC__ENABLE: ${MEGA_ARTIFACTS_GC__ENABLE:-false}
      MEGA_ARTIFACTS_GC__INTERVAL_SECS: ${MEGA_ARTIFACTS_GC__INTERVAL_SECS:-3600}
      MEGA_ARTIFACTS_GC__GRACE_SECS: ${MEGA_ARTIFACTS_GC__GRACE_SECS:-86400}
      MEGA_ARTIFACTS_GC__BATCH_LIMIT: ${MEGA_ARTIFACTS_GC__BATCH_LIMIT:-100}
      MEGA_LOG__PRINT_STD: "true"
      MEGA_LOG__LEVEL: info
      # Host-facing LFS / capability URLs (published on 127.0.0.1:9000).
      # In-network LFS smoke: --env-file config/compose.env.storage-only.lfs-innetwork
      MEGA_HTTP__PUBLIC_BASE_URL: ${MEGA_HTTP__PUBLIC_BASE_URL:-http://127.0.0.1:9000}
      MEGA_LFS__SSH__HTTP_URL: ${MEGA_LFS__SSH__HTTP_URL:-http://127.0.0.1:9000}
    secrets:
      - mega2-push-token
    volumes:
      - ../config/config-storage-only.toml:/etc/mega2/config.toml:ro
      - mega2-trunk-data:/var/lib/mega2
    ports:
      - "127.0.0.1:9000:8000"
      - "127.0.0.1:2222:2222"
    # HTTP push + SSH upload-pack (receive-pack still off via config).
    command:
      [
        "--config",
        "/etc/mega2/config.toml",
        "service",
        "multi",
        "http",
        "ssh",
        "--host",
        "0.0.0.0",
        "-p",
        "8000",
        "--ssh-port",
        "2222",
      ]
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/api/openapi.json"]
      interval: 3s
      timeout: 5s
      retries: 40
      start_period: 20s

  # Optional linked Git CLI smoke against the compose-hosted mega2.
  # Bring up with: --profile smoke
  # Empty-volume bootstrap (once):
  #   docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml up -d --wait
  #   docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml exec -T mega2 \
  #     mega2 --config /etc/mega2/config.toml service init --yes
  # Then (storage-only / trunk black-box; uses git client, not libra):
  #   docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml \
  #     --profile smoke exec -T git-smoke \
  #     env MEGA2_HTTP_REPO_URL=http://mega2:8000/ \
  #         MEGA2_IT_SEED_TOKEN=mega2-storage-only-local-dev-token-0001 \
  #         MEGA2_GIT_SMOKE_PUSH=1 \
  #         bash /repo/scripts/git_protocol_smoke_storage_only.sh
  #
  # Product API write → Git visibility (plan-20260904 AW-04; curl+git):
  #   TOKEN='mega2-storage-only-local-dev-token-0001'
  #   docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml --profile smoke \
  #     exec -T \
  #     -e MEGA2_HTTP_REPO_URL="http://x:${TOKEN}@mega2:8000/" \
  #     -e MEGA2_API_BASE=http://mega2:8000 \
  #     -e MEGA2_IT_SEED_TOKEN="${TOKEN}" \
  #     git-smoke bash /repo/scripts/api_write_smoke_storage_only.sh
  #
  # Persist host log: tee to target/tmp/so-smoke-*.log (see docs/deploy-trunk.md).
  # Review/CL smoke remains scripts/git_protocol_smoke.sh (do not use on trunk).
  #
  # NOTE: LFS hrefs use MEGA_HTTP__PUBLIC_BASE_URL (default host 127.0.0.1:9000)
  # and presigned object URLs use MEGA_OBJECT_STORAGE__S3__PUBLIC_ENDPOINT_URL
  # (default host 127.0.0.1:29000).
  # For in-network LFS smoke (git-smoke → mega2), recreate with:
  #   --env-file config/compose.env.storage-only.lfs-innetwork
  git-smoke:
    image: mega2-git-smoke:3.8.0
    build:
      context: ..
      dockerfile: Dockerfile.git-smoke
    profiles: ["smoke"]
    init: true
    depends_on:
      mega2:
        condition: service_healthy
    environment:
      MEGA2_HTTP_REPO_URL: http://mega2:8000/
      MEGA2_GIT_SMOKE_PUSH: "1"
      MEGA2_GIT_SMOKE_LFS: "0"
      MEGA2_IT_SEED_TOKEN: mega2-storage-only-local-dev-token-0001
    volumes:
      - ${MEGA2_IT_GIT_WORKDIR:-/tmp/mega2-trunk-git}:/work
      - ..:/repo:ro
    working_dir: /work
    healthcheck:
      test: ["CMD-SHELL", "git --version >/dev/null && git lfs version | grep -q '^git-lfs/3[.]8[.]0 '"]
      interval: 2s
      timeout: 5s
      retries: 20

  # Interop black-box runner (docs/plan/plan-20261001.md, ADR-BB-02 / ADR-BB-09):
  # oras, curl, jq, libra (libra.tools stable), git, git-lfs, ssh. Only started
  # with `--profile interop`. On start it opens three loopback relays so the
  # runner sees the same addresses as the host:
  #   127.0.0.1:9000  -> mega2:8000   (HTTP; libra only sends credentials to
  #                                    https or loopback hosts)
  #   127.0.0.1:2222  -> mega2:2222   (SSH)
  #   127.0.0.1:29000 -> rustfs:9000  (presigned URLs signed for the host port)
  interop-smoke:
    image: mega2-interop-smoke:local
    build:
      context: ..
      dockerfile: Dockerfile.interop-smoke
    profiles: ["interop"]
    init: true
    depends_on:
      mega2:
        condition: service_healthy
    environment:
      MEGA2_BASE_URL: http://127.0.0.1:9000
      MEGA2_SSH_URL: ssh://git@127.0.0.1:2222
      MEGA2_IT_SEED_TOKEN: mega2-storage-only-local-dev-token-0001
    volumes:
      - ${MEGA2_IT_INTEROP_WORKDIR:-/tmp/mega2-trunk-interop}:/work
      - ..:/repo:ro
    working_dir: /work
    command:
      - bash
      - -c
      - |
        socat TCP-LISTEN:9000,bind=127.0.0.1,fork,reuseaddr TCP:mega2:8000 &
        socat TCP-LISTEN:2222,bind=127.0.0.1,fork,reuseaddr TCP:mega2:2222 &
        socat TCP-LISTEN:29000,bind=127.0.0.1,fork,reuseaddr TCP:rustfs:9000 &
        exec sleep infinity
    healthcheck:
      test:
        - CMD-SHELL
        - >-
          curl -fsS -o /dev/null http://127.0.0.1:9000/api/openapi.json
          && curl -sS -o /dev/null http://127.0.0.1:29000/
          && ssh-keyscan -T 3 -p 2222 127.0.0.1 >/dev/null 2>&1
      interval: 2s
      timeout: 10s
      retries: 30

secrets:
  mega2-push-token:
    # Override for real deployments: MEGA2_PUSH_TOKEN_FILE=/path/to/secret
    file: ${MEGA2_PUSH_TOKEN_FILE:-../secrets/mega2-push-token.local}

volumes:
  mega2-trunk-pg:
  mega2-trunk-redis:
  mega2-trunk-rustfs:
  mega2-trunk-data: