docker-compose.yml

# Fula Storage - Complete Development Stack
# Run with: docker-compose up -d

version: "3.8"

services:
  # ============================================
  # Fula Gateway - S3-Compatible API
  # ============================================
  gateway:
    build:
      context: /opt/fula-api
      dockerfile: Dockerfile
    env_file:
      - .env
    environment:
      # --- Load-relief for gc-damaged buckets (2026-06-07) ---
      # Stop the one-time fleet-wide index-node backfill: on damaged buckets it
      # re-walks every index, hits hard-loss nodes at ~6s each, and burns
      # gateway/kubo capacity on every restart for no gain (per-PUT pinning still
      # protects active buckets). Reversible: remove this line to re-enable.
      - FULA_NO_LOCAL_RETAIN_BACKFILL=true
      # Bounded-read budget. The local-retain verifier has offloaded ~nothing
      # (backlog ~956k pending, oldest ~4.5 days) so essentially EVERY block is
      # still local — there are almost no remote reads to protect, and the
      # online tail is pure dead-weight on gc-orphaned reads (stale/gc'd CID
      # that's gone). So: keep a 1s shot at any peered holder (fast=1) and kill
      # the slow tail (slow=0) → gc-orphaned reads fast-fail to the cluster-mirror
      # fallback (or 404) in ~1s instead of ~3-6s, for BOTH mirror-hits and
      # mirror-misses. Healthy local reads are the offline-hit fast path,
      # unaffected. If the backlog ever drains (real remote reads appear) and
      # legit slow holders start 410'ing, raise slow back to 2-4.
      - FULA_READ_FAST_TIMEOUT_SECS=1
      - FULA_READ_SLOW_TIMEOUT_SECS=0
    volumes:
      - /var/lib/fula-gateway:/var/lib/fula-gateway
    network_mode: host
    restart: unless-stopped
    # --- Blast-radius cap (2026-08-23) ---
    # Measured on the live host: this container was holding 11.35 GiB of the
    # box's 29.37 GiB while sitting at 1.3% CPU — i.e. idle but fat — against a
    # configured 256 MB LRU block cache. Roughly 240 MB/hour of growth over a
    # 47-hour uptime, which is a leak, not a working set.
    #
    # The box has NO swap and, until this line, no container had any limit at
    # all. That combination means whichever service grows first invokes the
    # kernel OOM killer against the WHOLE machine rather than against itself —
    # and kubo/ipfs-cluster are started with `restart: no`, so collateral
    # damage there does not come back on its own.
    #
    # 8g is deliberately generous: it leaves ~21 GiB for kubo, ipfs-cluster,
    # postgres and the host, and at the observed leak rate gives ~33 hours
    # between restarts. Paired with `restart: unless-stopped` above, the
    # failure mode becomes "one container recycles" instead of "the host
    # falls over". This CONTAINS the leak; it does not fix it — the 12 GiB
    # RSS still wants its own investigation.
    mem_limit: 8g
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3

  # ============================================
  # Redis (optional - for multi-gateway sync)
  # ============================================
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    command: redis-server --appendonly yes
    restart: unless-stopped
    networks:
      - fula-network
    profiles:
      - full

  # ============================================
  # Prometheus (optional - monitoring)
  # ============================================
  prometheus:
    image: prom/prometheus:latest
    ports:
      - "9090:9090"
    volumes:
      - ./config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.enable-lifecycle'
    restart: unless-stopped
    networks:
      - fula-network
    profiles:
      - monitoring

  # ============================================
  # Grafana (optional - dashboards)
  # ============================================
  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
    depends_on:
      - prometheus
    restart: unless-stopped
    networks:
      - fula-network
    profiles:
      - monitoring

# ============================================
# Networks
# ============================================
networks:
  fula-network:
    driver: bridge

# ============================================
# Volumes
# ============================================
volumes:
  redis-data:
  prometheus-data:
  grafana-data: