aperturedata/aperturedb-compose-single-node:0.19.15

# aperturedb-compose version: 0.19.15

services:

  aperturedb:
    cpus: ${ADB_CPUS:-0}
    mem_limit: ${ADB_MEMORY_LIMIT:-0}
    image: ${APERTUREDB_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/aperturedb:0.19.15}
    restart: always
    environment:
      ADB_KVGD_DB_SIZE: ${ADB_KVGD_DB_SIZE:-204800}
      ADB_DB_ROOT_PATH: "/aperturedb/db"
      ADB_LOG_PATH: "/aperturedb/logs"
      ADB_PORT: 55553
      ADB_ENABLE_DEBUG: ${ADB_ENABLE_DEBUG:-1}
      ADB_MAX_SIMULTANEOUS_CLIENTS: ${ADB_MAX_SIMULTANEOUS_CLIENTS:-24}
      ADB_FORCE_SSL: false
      ADB_TIMEOUT_RECEIVE: false
      ADB_LOG_LEVEL: ${ADB_LOG_LEVEL:-1}
      ADB_MASTER_KEY: ${ADB_MASTER_KEY:-admin}
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}aperturedb_db:/aperturedb/db"
      - "${DATA_DIR:+${DATA_DIR:-}/}aperturedb_logs:/aperturedb/logs"

  promtail:
    profiles:
      - telemetry
    image: ${PROMTAIL_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/promtail:0.19.15}
    restart: always
    environment:
      POD_IP: aperturedb
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}aperturedb_logs:/mnt/aperture"

  loki:
    profiles:
      - telemetry
    image: ${LOKI_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}grafana/loki:3.7.8}
    restart: always
    user: 0:0
    configs:
      - source: loki_config
        target: /etc/loki/local-config.yml
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}loki:/loki"

  prometheus:
    profiles:
      - telemetry
    image: ${PROMETHEUS_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}prom/prometheus:v3.15.0}
    restart: always
    user: 0:0
    command: [ "--config.file=/etc/prometheus/prometheus.yml", "--storage.tsdb.path=/prometheus", "--storage.tsdb.retention.time=${PROMETHEUS_RETENTION_TIME:-28d}" ]
    configs:
      - source: prometheus_config
        target: /etc/prometheus/prometheus.yml
      - source: monitoring_password
        target: /etc/prometheus/auth/password
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}prometheus:/prometheus"


  grafana:
    profiles:
      - telemetry
    image: ${GRAFANA_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/grafana:0.19.15}
    restart: always
    user: 0:0
    environment:
      GF_SERVER_ROOT_URL: ${GF_SERVER_ROOT_URL:-%(protocol)s://%(domain)s:%(http_port)s/grafana/}
      GF_SECURITY_ADMIN_USER: ${GF_SECURITY_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GF_SECURITY_ADMIN_PASSWORD:-admin}
      GF_SERVER_SERVE_FROM_SUB_PATH: 'true'
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}grafana:/var/lib/grafana"


  webui:
    image: ${WEBUI_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/webui:0.19.15}
    restart: always

  ca:
    image: ${OPENSSL_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}alpine/openssl:3.5.9}
    restart: on-failure
    environment:
      TLS_CERT_DIR: ${TLS_CERT_DIR:-}
      TLS_CERT_FILENAME: ${TLS_CERT_FILENAME:-tls.crt}
      TLS_KEY_FILENAME: ${TLS_KEY_FILENAME:-tls.key}
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        case "$$TLS_CERT_FILENAME" in
          ""|.|..|*[!a-zA-Z0-9._-]*)
            echo "TLS_CERT_FILENAME must be a plain filename using letters, digits, dots, underscores or hyphens." >&2
            exit 1 ;;
        esac
        case "$$TLS_KEY_FILENAME" in
          ""|.|..|*[!a-zA-Z0-9._-]*)
            echo "TLS_KEY_FILENAME must be a plain filename using letters, digits, dots, underscores or hyphens." >&2
            exit 1 ;;
        esac
        if [ "$$TLS_CERT_FILENAME" = "$$TLS_KEY_FILENAME" ]; then
          echo "Certificate and private key filenames must differ." >&2
          exit 1
        fi
        certificate="/cert/$$TLS_CERT_FILENAME"
        private_key="/cert/$$TLS_KEY_FILENAME"
        if [ -n "$$TLS_CERT_DIR" ]; then
          case "$$TLS_CERT_DIR" in
            /*) ;;
            *) echo "TLS_CERT_DIR must be an absolute directory on the Docker host." >&2; exit 1 ;;
          esac
          if [ ! -s "$$certificate" ] || [ ! -s "$$private_key" ]; then
            echo "TLS_CERT_DIR must contain both the supplied certificate and private key; no files will be generated." >&2
            exit 1
          fi
          openssl rsa -in "$$private_key" -passin pass: -check -noout >/dev/null
          certificate_modulus=$$(openssl x509 -in "$$certificate" -noout -modulus)
          private_key_modulus=$$(openssl rsa -in "$$private_key" -passin pass: -noout -modulus)
          if [ "$$certificate_modulus" != "$$private_key_modulus" ]; then
            echo "The supplied certificate and RSA private key do not match." >&2
            exit 1
          fi
          exit 0
        fi
        if [ -s "$$certificate" ] && [ -s "$$private_key" ]; then
          exit 0
        fi
        if [ -e "$$certificate" ] || [ -e "$$private_key" ]; then
          echo "Incomplete certificate pair in /cert; restore both files before starting." >&2
          exit 1
        fi
        umask 077
        openssl req -x509 -newkey rsa:4096 -days 3650 -nodes -keyout "$$private_key" -out "$$certificate" -subj "/C=US/O=ApertureData Inc./CN=localhost"
    volumes:
      - "${TLS_CERT_DIR:-certificate_volume}:/cert${TLS_CERT_DIR:+:ro}"

  lenz:
    cpus: ${LNZ_CPUS:-0}
    mem_limit: ${LNZ_MEMORY_LIMIT:-0}
    depends_on:
      ca:
        condition: service_completed_successfully
    image: ${LENZ_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/lenz:0.19.15}
    restart: always
    ports:
      - "${GATEWAY:-}:${ADB_TCP_PORT:-55555}:55551"
    environment:
      LNZ_HEALTH_PORT: 58085
      LNZ_TCP_PORT: 55551
      LNZ_HTTP_PORT: 8080
      LNZ_ADB_BACKENDS: '["aperturedb:55553"]'
      LNZ_REPLICAS: 1
      LNZ_ADB_MAX_CONCURRENCY: ${LNZ_ADB_MAX_CONCURRENCY:-16}
      LNZ_FORCE_SSL: ${LNZ_FORCE_SSL:-false}
      LNZ_CERTIFICATE_PATH: /etc/lenz/certificate/${TLS_CERT_FILENAME:-tls.crt}
      LNZ_PRIVATE_KEY_PATH: /etc/lenz/certificate/${TLS_KEY_FILENAME:-tls.key}
      LNZ_METRICS_PATH: /etc/lenz/metrics
      LNZ_DB_PATH: /etc/lenz/db
    configs:
      - source: monitoring_password
        target: /etc/lenz/metrics/password
      - source: telemetry_db_password
        target: /etc/lenz/db/password
    volumes:
      - "${TLS_CERT_DIR:-certificate_volume}:/etc/lenz/certificate:ro"

  nginx:
    depends_on:
      ca:
        condition: service_completed_successfully
    image: ${NGINX_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}nginx:1.30.5}
    restart: always
    ports:
      - "${GATEWAY:-}:${HTTP_PORT:-80}:80"
      - "${GATEWAY:-}:${HTTPS_PORT:-443}:443"
    configs:
      - source: nginx_config
        target: /etc/nginx/conf.d/default.conf
    volumes:
      - "${TLS_CERT_DIR:-certificate_volume}:/etc/nginx/certificate:ro"

configs:

  nginx_config:
    content: |
      server {
        listen 80;
        listen 443 ssl;
        client_max_body_size ${HTTP_MAX_BODY_SIZE:-256m};
        proxy_read_timeout ${HTTP_PROXY_READ_TIMEOUT:-60s};
        ssl_certificate /etc/nginx/certificate/${TLS_CERT_FILENAME:-tls.crt};
        ssl_certificate_key /etc/nginx/certificate/${TLS_KEY_FILENAME:-tls.key};
        location / {
          proxy_pass http://webui;
        }
        location /api/ {
          proxy_pass http://lenz:8080;
        }
        location /grafana/ {
          resolver 127.0.0.11 valid=30s;
          set $$target_var http://grafana:3000;
          proxy_pass $$target_var;
          proxy_set_header Host $$host;
        }
      }

  loki_config:
    content: |
      auth_enabled: false

      server:
        http_listen_port: 3100

      common:
        path_prefix: /loki
        storage:
          filesystem:
            chunks_directory: /loki/chunks
            rules_directory: /loki/rules
        replication_factor: 1
        ring:
          kvstore:
            store: inmemory

      schema_config:
        configs:
          - from: 2023-01-01
            store: tsdb
            object_store: filesystem
            schema: v13
            index:
              prefix: index_
              # loki will silently fail if this is any value other than "24h"
              period: 24h

      compactor:
        working_directory: /loki/retention
        compaction_interval: 24h
        retention_enabled: true
        delete_request_store: filesystem
        retention_delete_delay: 1h
        retention_delete_worker_count: 150

      limits_config:
        retention_period: ${LOKI_RETENTION_PERIOD:-672h}

      query_scheduler:
        max_outstanding_requests_per_tenant: 2048

      ruler:
        alertmanager_url: http://localhost:9093

  # Prometheus discovers and scrapes every database through Lenz.
  prometheus_config:
    content: |
      global:
        # Metrics calculations rely on the fixed 5-second collection interval.
        scrape_interval: 5s
        scrape_timeout: 4s
        external_labels:
          monitor: codelab-monitor
      scrape_configs:
        - job_name: aperturedb
          metrics_path: /api/metrics
          authorization:
            credentials_file: /etc/prometheus/auth/password
          http_sd_configs:
            - url: http://lenz:8080/api/servers?format=prometheus
              refresh_interval: 5s
              authorization:
                credentials_file: /etc/prometheus/auth/password
          relabel_configs:
            - source_labels: [__address__]
              target_label: __param_server
            - source_labels: [pod_ip]
              target_label: instance
            - target_label: __address__
              replacement: lenz:8080

  # Bearer password shared by Prometheus and Lenz for /api/servers and
  # /api/metrics; set MONITORING_PASSWORD.
  monitoring_password:
    content: ${MONITORING_PASSWORD:-monitoring}

  # Lenz collects metrics as the _telemetry database user, which authenticates
  # with the master key; set ADB_MASTER_KEY.
  telemetry_db_password:
    content: ${ADB_MASTER_KEY:-admin}

volumes:
  certificate_volume:
  aperturedb_db:
  aperturedb_logs:
  grafana:
  loki:
  prometheus: