docker-compose.yml

# Paths in this file are resolved from the repository root. Use
# `docker compose --project-directory . -f docker/docker-compose.yml ...`.
services:
  mysql:
    image: mysql:9.1
    stop_grace_period: ${INFRA_STOP_GRACE_PERIOD:-30s}
    # Bind to all interfaces so IPv4 port-mapped connections (localhost:23306) reach the
    # MySQL handshake. Without this, MySQL 9.1 listens on IPv6 [::]:3306 only, and Docker
    # Desktop on WSL2 fails to forward the IPv4→IPv6 handshake to the container.
    command: ["--bind-address=0.0.0.0"]
    expose:
      - "3306"
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?MYSQL_ROOT_PASSWORD is required}
      MYSQL_DATABASE: ${DB_NAME:-ulticode}
      MYSQL_USER: ${DB_USER:-ulticode}
      MYSQL_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required}
      NACOS_DB_USER: ${NACOS_DB_USER:-}
      NACOS_DB_PASSWORD: ${NACOS_DB_PASSWORD:-}
      MYSQL_CHARACTER_SET_SERVER: utf8mb4
      MYSQL_COLLATION_SERVER: utf8mb4_unicode_ci
    volumes:
      - mysql_data:/var/lib/mysql
      - ./docker/initdb:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - sql

  redis:
    image: redis:7-alpine
    stop_grace_period: ${INFRA_STOP_GRACE_PERIOD:-30s}
    expose:
      - "6379"
    # Per-owner ACL security boundary (review 2026-08-25): the anonymous
    # default user is disabled and every client authenticates as a named ACL
    # user (see the runtime REDIS_ACL_DIR). Generate/rotate credentials via
    # docker/redis/generate-users-acl.sh; the ACL file is not tracked in Git.
    command: ["redis-server", "--aclfile", "/usr/local/etc/redis/users.acl"]
    environment:
      REDIS_HEALTH_USER: ulticode-health
      REDIS_HEALTH_PASSWORD: ${HEALTH_REDIS_PASSWORD:?HEALTH_REDIS_PASSWORD is required}
    volumes:
      - "${REDIS_ACL_DIR:-./.local/redis}:/usr/local/etc/redis:ro"
      - redis_data:/data
    healthcheck:
      test: ["CMD", "sh", "-c", "redis-cli --user \"$$REDIS_HEALTH_USER\" --pass \"$$REDIS_HEALTH_PASSWORD\" ping | grep -q PONG"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - cache

  nacos:
    image: nacos/nacos-server:v2.3.2
    stop_grace_period: ${INFRA_STOP_GRACE_PERIOD:-30s}
    expose:
      - "8848"
      - "9848"
    environment:
      MODE: standalone
      SPRING_DATASOURCE_PLATFORM: mysql
      MYSQL_SERVICE_HOST: mysql
      MYSQL_SERVICE_PORT: 3306
      MYSQL_SERVICE_DB_NAME: nacos_config
      MYSQL_SERVICE_USER: root
      MYSQL_SERVICE_PASSWORD: ${MYSQL_ROOT_PASSWORD:?MYSQL_ROOT_PASSWORD is required}
      MYSQL_SERVICE_DB_PARAM: "characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&useSSL=false&allowPublicKeyRetrieval=true"
      JVM_XMS: 256m
      JVM_XMX: 512m
      JVM_XMN: 128m
      NACOS_AUTH_ENABLE: "true"
      NACOS_AUTH_TOKEN: ${NACOS_AUTH_TOKEN:?NACOS_AUTH_TOKEN is required}
      NACOS_AUTH_IDENTITY_KEY: ${NACOS_AUTH_IDENTITY_KEY:?NACOS_AUTH_IDENTITY_KEY is required}
      NACOS_AUTH_IDENTITY_VALUE: ${NACOS_AUTH_IDENTITY_VALUE:?NACOS_AUTH_IDENTITY_VALUE is required}
    volumes:
      - nacos_logs:/home/nacos/logs
    depends_on:
      mysql:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8848/nacos/"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - sql
      - registry
      - egress-nacos

  meilisearch:
    image: getmeili/meilisearch:v1.8
    stop_grace_period: ${INFRA_STOP_GRACE_PERIOD:-30s}
    restart: unless-stopped
    environment:
      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY:?MEILI_MASTER_KEY is required}
      - MEILI_ENV=production
      - MEILI_NO_ANALYTICS=true
      - MEILI_DB_PATH=/meili_data
    expose:
      - "7700"
    volumes:
      - meili_data:/meili_data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:7700/health"]
      interval: 30s
      timeout: 10s
      start_period: 10s
      retries: 3
    networks:
      - search
# RustFS is private infrastructure: its S3 API and console are reachable only
# from the storage network unless a development overlay explicitly publishes
# loopback ports for host-run backends.
  rustfs:
    image: "${RUSTFS_IMAGE_REF:-rustfs/rustfs:1.0.0@sha256:8cc9801755448b71a786705ce76692c77e14936cccd87cf2fc31842e58f4d1ff}"
    user: "10001:10001"
    expose:
      - "9000"
      - "9001"
    environment:
      RUSTFS_VOLUMES: /data
      RUSTFS_ADDRESS: :9000
      RUSTFS_CONSOLE_ADDRESS: :9001
      RUSTFS_CONSOLE_ENABLE: "true"
      RUSTFS_HEALTH_ENDPOINT_ENABLE: "true"
      RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:?RUSTFS_ACCESS_KEY is required; do not use rustfsadmin}
      RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:?RUSTFS_SECRET_KEY is required; do not use rustfsadmin}
    volumes:
      - rustfs_data:/data
    healthcheck:
      test: ["CMD-SHELL", "curl --fail --silent --show-error http://127.0.0.1:9000/health/ready >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 10s
    networks:
      - object-storage

  # Create the private bucket once RustFS is ready. The command is idempotent:
  # head-bucket succeeds for an existing bucket and create-bucket handles the
  # first boot. This service has no persistent data of its own.
  rustfs-init:
    image: "amazon/aws-cli:2.31.0@sha256:d5f18fde2ba3f9205e75d511ca3e6185c144e55df07e50eee16d940994557b40"
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        if aws s3api head-bucket --bucket "$$RUSTFS_BUCKET" --endpoint-url "$$RUSTFS_ENDPOINT" >/dev/null 2>&1; then
          echo "RustFS bucket $$RUSTFS_BUCKET already exists."
        else
          aws s3api create-bucket --bucket "$$RUSTFS_BUCKET" --endpoint-url "$$RUSTFS_ENDPOINT"
          echo "Created RustFS bucket $$RUSTFS_BUCKET."
        fi
    environment:
      AWS_ACCESS_KEY_ID: ${RUSTFS_ACCESS_KEY:?RUSTFS_ACCESS_KEY is required}
      AWS_SECRET_ACCESS_KEY: ${RUSTFS_SECRET_KEY:?RUSTFS_SECRET_KEY is required}
      AWS_DEFAULT_REGION: us-east-1
      AWS_EC2_METADATA_DISABLED: "true"
      RUSTFS_BUCKET: ${RUSTFS_BUCKET:-ulticode}
      RUSTFS_ENDPOINT: http://rustfs:9000
    depends_on:
      rustfs:
        condition: service_healthy
    networks:
      - object-storage

  # Create and bind least-privilege application users after the bucket exists.
  # The root pair above is bootstrap-only; runtime services receive prefix-scoped
  # credentials from the production/local overlays.
  rustfs-iam-init:
    image: "rustfs/rc:v0.1.36@sha256:ab024bfebee49a750ce886b4c70963ccd9ddaa03f491704a90710641d7a26699"
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        umask 077
        if [ "$$RUSTFS_APP_ACCESS_KEY" = "$$RUSTFS_ACCESS_KEY" ] \
            || [ "$$RUSTFS_ADMIN_ACCESS_KEY" = "$$RUSTFS_ACCESS_KEY" ] \
            || [ "$$RUSTFS_APP_ACCESS_KEY" = "$$RUSTFS_ADMIN_ACCESS_KEY" ]; then
          echo "RustFS runtime access keys must be distinct from root and each other" >&2
          exit 1
        fi
        cat >/tmp/app-storage-policy.json <<POLICY
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": ["s3:GetBucketLocation"],
              "Resource": ["arn:aws:s3:::$${RUSTFS_BUCKET}"]
            },
            {
              "Effect": "Allow",
              "Action": ["s3:ListBucket"],
              "Resource": ["arn:aws:s3:::$${RUSTFS_BUCKET}"],
              "Condition": {
                "StringLike": {
                  "s3:prefix": ["app/avatars", "app/avatars/*"]
                }
              }
            },
            {
              "Effect": "Allow",
              "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
              "Resource": ["arn:aws:s3:::$${RUSTFS_BUCKET}/app/avatars/*"]
            }
          ]
        }
        POLICY
        cat >/tmp/admin-storage-policy.json <<POLICY
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": ["s3:GetBucketLocation"],
              "Resource": ["arn:aws:s3:::$${RUSTFS_BUCKET}"]
            },
            {
              "Effect": "Allow",
              "Action": ["s3:ListBucket"],
              "Resource": ["arn:aws:s3:::$${RUSTFS_BUCKET}"],
              "Condition": {
                "StringLike": {
                  "s3:prefix": [
                    "app/avatars",
                    "app/avatars/*",
                    "admin/backups",
                    "admin/backups/*"
                  ]
                }
              }
            },
            {
              "Effect": "Allow",
              "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
              "Resource": [
                "arn:aws:s3:::$${RUSTFS_BUCKET}/app/avatars/*",
                "arn:aws:s3:::$${RUSTFS_BUCKET}/admin/backups/*"
              ]
            }
          ]
        }
        POLICY
        # RustFS rc needs the explicit flag for private production CAs; the
        # local HTTP endpoint does not need one.
        if [ -n "$${RUSTFS_CA_BUNDLE:-}" ]; then
          rc alias set root "$$RUSTFS_ENDPOINT" "$$RUSTFS_ACCESS_KEY" "$$RUSTFS_SECRET_KEY" \
            --ca-bundle "$$RUSTFS_CA_BUNDLE"
        else
          rc alias set root "$$RUSTFS_ENDPOINT" "$$RUSTFS_ACCESS_KEY" "$$RUSTFS_SECRET_KEY"
        fi
        rc admin policy create root app-storage /tmp/app-storage-policy.json
        rc admin policy create root admin-storage /tmp/admin-storage-policy.json
        if rc admin user info root "$$RUSTFS_APP_ACCESS_KEY" >/dev/null 2>&1; then
          rc admin user passwd root "$$RUSTFS_APP_ACCESS_KEY" \
            --password-from-env RUSTFS_APP_SECRET_KEY
        else
          rc admin user add root "$$RUSTFS_APP_ACCESS_KEY" "$$RUSTFS_APP_SECRET_KEY"
        fi
        rc admin user enable root "$$RUSTFS_APP_ACCESS_KEY"
        if rc admin user info root "$$RUSTFS_ADMIN_ACCESS_KEY" >/dev/null 2>&1; then
          rc admin user passwd root "$$RUSTFS_ADMIN_ACCESS_KEY" \
            --password-from-env RUSTFS_ADMIN_SECRET_KEY
        else
          rc admin user add root "$$RUSTFS_ADMIN_ACCESS_KEY" "$$RUSTFS_ADMIN_SECRET_KEY"
        fi
        rc admin user enable root "$$RUSTFS_ADMIN_ACCESS_KEY"
        rc admin policy attach root app-storage --user "$$RUSTFS_APP_ACCESS_KEY"
        rc admin policy attach root admin-storage --user "$$RUSTFS_ADMIN_ACCESS_KEY"
    environment:
      RUSTFS_ENDPOINT: http://rustfs:9000
      RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:?RUSTFS_ACCESS_KEY is required}
      RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:?RUSTFS_SECRET_KEY is required}
      RUSTFS_APP_ACCESS_KEY: ${RUSTFS_APP_ACCESS_KEY:?RUSTFS_APP_ACCESS_KEY is required}
      RUSTFS_APP_SECRET_KEY: ${RUSTFS_APP_SECRET_KEY:?RUSTFS_APP_SECRET_KEY is required}
      RUSTFS_ADMIN_ACCESS_KEY: ${RUSTFS_ADMIN_ACCESS_KEY:?RUSTFS_ADMIN_ACCESS_KEY is required}
      RUSTFS_ADMIN_SECRET_KEY: ${RUSTFS_ADMIN_SECRET_KEY:?RUSTFS_ADMIN_SECRET_KEY is required}
      RUSTFS_BUCKET: ${RUSTFS_BUCKET:-ulticode}
    depends_on:
      rustfs-init:
        condition: service_completed_successfully
    networks:
      - object-storage

networks:
  object-storage:
    internal: true
  edge:
    internal: true
  sql:
    internal: true
  cache:
    internal: true
  registry:
    internal: true
  rpc-auth:
    internal: true
  rpc-app:
    internal: true
  rpc-submission:
    internal: true
  rpc-notification:
    internal: true
  rpc-judge:
    internal: true
  search:
    internal: true
  egress-auth:
    internal: false
  egress-admin:
    internal: false
  egress-app:
    internal: false
  egress-submission:
    internal: false
  egress-search:
    internal: false
  egress-notification:
    internal: false
  egress-judge:
    internal: false
  egress-nacos:
    internal: false
  observability:
    internal: true

volumes:
  mysql_data:
  redis_data:
  nacos_logs:
  meili_data:
  rustfs_data: