Erico AlmeidaandClaude Opus 4.8
7ae1fe3ae1
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
299 lines
12 KiB
YAML
299 lines
12 KiB
YAML
# ============================================================================
|
|
# Rastro — Docker Compose para o COOLIFY (máquina nova).
|
|
#
|
|
# Derivado do deploy/stack.yml (Swarm). Diferenças:
|
|
# - Sem labels do Traefik: no Coolify você define os DOMÍNIOS pela UI (por serviço),
|
|
# e o proxy do Coolify gera o roteamento. Ver deploy/MIGRACAO-COOLIFY.md.
|
|
# - Sem rede `erico-net` externa: o Coolify põe todos os serviços do compose na
|
|
# MESMA rede — eles se acham pelo nome do serviço (db, rabbitmq, minio, osrm…).
|
|
# - `shm_size` no db (o Compose respeita, diferente do Swarm que exigia tmpfs).
|
|
# - `deploy.resources.limits` mantidos (o `docker compose` do Coolify honra) —
|
|
# ajuste conforme a capacidade da máquina nova.
|
|
# - `migrate` roda só o SCHEMA (sem seed/bootstrap): os usuários/config vêm do
|
|
# dump data-migration/rastro-userdata.sql (restaurado depois). Ver runbook.
|
|
# - As imagens custom vêm do Gitea; as de infra, do Docker Hub.
|
|
#
|
|
# Variáveis ${...} → configure no ambiente do recurso no Coolify (ou .env).
|
|
# ============================================================================
|
|
|
|
x-app-env: &app-env
|
|
DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public
|
|
RABBITMQ_URL: amqp://${RABBITMQ_DEFAULT_USER}:${RABBITMQ_DEFAULT_PASS}@rabbitmq:5672
|
|
RASTRO_EXCHANGE: ${RASTRO_EXCHANGE:-rastro.passagens}
|
|
RASTRO_QUEUE: ${RASTRO_QUEUE:-rastro.passagens.processar}
|
|
|
|
services:
|
|
# ------------------------------------------------------------------ Infra
|
|
db:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/timescaledb-ha:pg16
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
shm_size: 1gb
|
|
volumes:
|
|
- db_data:/home/postgres/pgdata
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 15
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '4.0', memory: 6G }
|
|
|
|
rabbitmq:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rabbitmq:3-management
|
|
restart: unless-stopped
|
|
environment:
|
|
RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER}
|
|
RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS}
|
|
volumes:
|
|
- rabbitmq_data:/var/lib/rabbitmq
|
|
healthcheck:
|
|
test: ['CMD', 'rabbitmq-diagnostics', '-q', 'ping']
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '1.0', memory: 640M }
|
|
|
|
minio:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/minio:latest
|
|
restart: unless-stopped
|
|
command: server /data --console-address ":9001"
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
|
|
volumes:
|
|
- minio_data:/data
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '1.0', memory: 640M }
|
|
|
|
gotenberg:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/gotenberg:8
|
|
restart: unless-stopped
|
|
command:
|
|
- gotenberg
|
|
- --chromium-disable-javascript=false
|
|
- --api-timeout=60s
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '2.0', memory: 1536M }
|
|
|
|
# OSRM (roteamento por vias) — OPCIONAL na 1ª subida. Precisa do grafo do Brasil
|
|
# (~12-15GB) em OSRM_DATA_DIR. Sem ele, deixe COMENTADO e o app sobe sem rotas;
|
|
# o processor/dfe-worker caem para no-op de roteamento. Habilite quando levar o grafo.
|
|
# osrm:
|
|
# image: osrm/osrm-backend:latest
|
|
# restart: unless-stopped
|
|
# command: ['osrm-routed', '--algorithm', 'mld', '--mmap', '--max-matching-size', '2000', '/data/brazil.osrm']
|
|
# volumes:
|
|
# - ${OSRM_DATA_DIR:-/data/rastro/osrm}:/data:ro
|
|
# deploy:
|
|
# resources:
|
|
# limits: { cpus: '2.0', memory: 6G }
|
|
|
|
# ------------------------------------------------------------- Init (roda 1x)
|
|
# SÓ SCHEMA (sem seed/bootstrap): os usuários/config vêm do dump. Roda uma vez e sai.
|
|
migrate:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rastro-node:${TAG:-latest}
|
|
restart: "no"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
<<: *app-env
|
|
NODE_ENV: production
|
|
DB_CONNECTION_LIMIT: ${DB_CONNECTION_LIMIT_MIGRATE:-5}
|
|
DB_POOL_TIMEOUT: ${DB_POOL_TIMEOUT:-15}
|
|
command: >
|
|
sh -c "wait-for-db &&
|
|
pnpm --filter @rastro/db migrate &&
|
|
pnpm --filter @rastro/db postgis &&
|
|
pnpm --filter @rastro/db timescale &&
|
|
pnpm --filter @rastro/db intel &&
|
|
pnpm --filter @rastro/db analyze"
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '2.0', memory: 1536M }
|
|
|
|
# ---------------------------------------------------------------- Drenagem
|
|
# OBS: para migração inicial LEVE, deixe ingestor/dfe-worker parados (scale 0 no
|
|
# Coolify) até querer puxar dados. O sistema serve os dados existentes sem eles.
|
|
ingestor:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rastro-node:${TAG:-latest}
|
|
restart: unless-stopped
|
|
depends_on: { db: { condition: service_healthy } }
|
|
environment:
|
|
<<: *app-env
|
|
NODE_ENV: production
|
|
DB_CONNECTION_LIMIT: ${DB_CONNECTION_LIMIT_INGESTOR:-5}
|
|
DB_POOL_TIMEOUT: ${DB_POOL_TIMEOUT:-15}
|
|
ONE_TP_AMB: ${ONE_TP_AMB:-1}
|
|
ONE_VER_APLIC: ${ONE_VER_APLIC:-rastro-1.0}
|
|
ONE_HOST: ${ONE_HOST:-one.svrs.rs.gov.br}
|
|
ONE_TP_DIST: ${ONE_TP_DIST:-1,4}
|
|
ONE_CUF: ${ONE_CUF:-41}
|
|
ONE_CNPJ_OPER: ${ONE_CNPJ_OPER:-}
|
|
ONE_POLL_INTERVAL: ${ONE_POLL_INTERVAL:-120}
|
|
ONE_MAX_BATCHES: ${ONE_MAX_BATCHES:-15}
|
|
ONE_BATCH_DELAY_MS: ${ONE_BATCH_DELAY_MS:-1200}
|
|
ONE_IND_RESUMO: ${ONE_IND_RESUMO:-0}
|
|
DFE_CERT_PFX_PATH: ${DFE_CERT_PFX_CONTAINER_PATH:-/certs/11de260603452f3c.pfx}
|
|
DFE_CERT_PASSPHRASE: ${DFE_CERT_PASSPHRASE:-}
|
|
CERT_DIR: /certs
|
|
DFE_TLS_REJECT_UNAUTHORIZED: ${DFE_TLS_REJECT_UNAUTHORIZED:-false}
|
|
MINIO_ENDPOINT: minio
|
|
MINIO_PORT: '9000'
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
|
|
MINIO_BUCKET: ${MINIO_BUCKET:-rastro-photos}
|
|
command: sh -c "wait-for-db schema rabbitmq && pnpm --filter @rastro/ingestor start"
|
|
volumes:
|
|
- ${CERT_HOST_DIR:-/data/rastro/certificado}:/certs:ro
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '1.0', memory: 640M }
|
|
|
|
processor:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rastro-node:${TAG:-latest}
|
|
restart: unless-stopped
|
|
depends_on: { db: { condition: service_healthy } }
|
|
environment:
|
|
<<: *app-env
|
|
NODE_ENV: production
|
|
DB_CONNECTION_LIMIT: ${DB_CONNECTION_LIMIT_PROCESSOR:-8}
|
|
DB_POOL_TIMEOUT: ${DB_POOL_TIMEOUT:-15}
|
|
SEFAZ_PR_DFE_URL: ${SEFAZ_PR_DFE_URL:-}
|
|
SEFAZ_PR_DFE_USER: ${SEFAZ_PR_DFE_USER:-}
|
|
SEFAZ_PR_DFE_PASSWORD: ${SEFAZ_PR_DFE_PASSWORD:-}
|
|
OSRM_URL: ${OSRM_URL:-http://osrm:5000}
|
|
REROUTE_STALE_INTERVAL_MIN: ${REROUTE_STALE_INTERVAL_MIN:-15}
|
|
command: sh -c "wait-for-db schema rabbitmq && pnpm --filter @rastro/processor start"
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '2.0', memory: 1G }
|
|
|
|
dfe-worker:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rastro-node:${TAG:-latest}
|
|
restart: unless-stopped
|
|
depends_on: { db: { condition: service_healthy } }
|
|
environment:
|
|
<<: *app-env
|
|
NODE_ENV: production
|
|
DB_CONNECTION_LIMIT: ${DB_CONNECTION_LIMIT_DFE_WORKER:-12}
|
|
DB_POOL_TIMEOUT: ${DB_POOL_TIMEOUT:-15}
|
|
SEFAZ_PR_DFE_URL: ${SEFAZ_PR_DFE_URL:-}
|
|
SEFAZ_PR_DFE_USER: ${SEFAZ_PR_DFE_USER:-}
|
|
SEFAZ_PR_DFE_PASSWORD: ${SEFAZ_PR_DFE_PASSWORD:-}
|
|
OSRM_URL: ${OSRM_URL:-http://osrm:5000}
|
|
DFE_GEN_INTERVAL: ${DFE_GEN_INTERVAL:-20}
|
|
DFE_GEN_BATCH: ${DFE_GEN_BATCH:-25}
|
|
DFE_GEN_CONCURRENCY: ${DFE_GEN_CONCURRENCY:-6}
|
|
DFE_REFRESH_TTL_HOURS: ${DFE_REFRESH_TTL_HOURS:-12}
|
|
DFE_GEN_ROUTE: ${DFE_GEN_ROUTE:-true}
|
|
SEFAZ_WS_TP_AMB: ${SEFAZ_WS_TP_AMB:-1}
|
|
SEFAZ_WS_ENDPOINTS: ${SEFAZ_WS_ENDPOINTS:-}
|
|
SEFAZ_WS_MAX_CTE: ${SEFAZ_WS_MAX_CTE:-20}
|
|
SEFAZ_ARQUIVOXML_ENDPOINTS: ${SEFAZ_ARQUIVOXML_ENDPOINTS:-}
|
|
SEFAZ_ARQUIVOXML_CUF: ${SEFAZ_ARQUIVOXML_CUF:-41}
|
|
SEFAZ_ARQUIVOXML_ORGAO: ${SEFAZ_ARQUIVOXML_ORGAO:-SEFA-PARANA}
|
|
SEFAZ_ARQUIVOXML_SETOR: ${SEFAZ_ARQUIVOXML_SETOR:-AGAA}
|
|
SEFAZ_ARQUIVOXML_VERAPLIC: ${SEFAZ_ARQUIVOXML_VERAPLIC:-PR_Rastro_v1}
|
|
SEFAZ_ARQUIVOXML_MATR: ${SEFAZ_ARQUIVOXML_MATR:-999999}
|
|
SEFAZ_ARQUIVOXML_MAX_NFE: ${SEFAZ_ARQUIVOXML_MAX_NFE:-40}
|
|
SEFAZ_CONSULTADFE_ENDPOINTS: ${SEFAZ_CONSULTADFE_ENDPOINTS:-}
|
|
DFE_CERT_PFX_PATH: ${DFE_CERT_PFX_CONTAINER_PATH:-/certs/11de260603452f3c.pfx}
|
|
DFE_CERT_PASSPHRASE: ${DFE_CERT_PASSPHRASE:-}
|
|
CERT_DIR: /certs
|
|
DFE_TLS_REJECT_UNAUTHORIZED: ${DFE_TLS_REJECT_UNAUTHORIZED:-false}
|
|
command: sh -c "wait-for-db schema && pnpm --filter @rastro/processor start:worker"
|
|
volumes:
|
|
- ${CERT_HOST_DIR:-/data/rastro/certificado}:/certs:ro
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '2.0', memory: 1G }
|
|
|
|
analytics:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rastro-analytics:${TAG:-latest}
|
|
restart: unless-stopped
|
|
depends_on: { db: { condition: service_healthy } }
|
|
environment:
|
|
<<: *app-env
|
|
INTEL_TOP_COMPANIES: ${INTEL_TOP_COMPANIES:-200}
|
|
INTEL_TOP_COMMODITIES: ${INTEL_TOP_COMMODITIES:-50}
|
|
INTEL_HORIZON_WEEKS: ${INTEL_HORIZON_WEEKS:-8}
|
|
INTEL_CYCLE_HOURS: ${INTEL_CYCLE_HOURS:-24}
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '2.0', memory: 1536M }
|
|
|
|
# ---------------------------------------------------------------- Backend / Fronts
|
|
# No Coolify, atribua os DOMÍNIOS a estes 3 serviços pela UI (ver runbook). O
|
|
# backend precisa responder /api e /health NO MESMO domínio do web e do admin
|
|
# (o front chama same-origin). Configure isso pelo roteamento por path do Coolify.
|
|
backend:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rastro-node:${TAG:-latest}
|
|
restart: unless-stopped
|
|
depends_on: { db: { condition: service_healthy } }
|
|
environment:
|
|
<<: *app-env
|
|
NODE_ENV: production
|
|
DB_CONNECTION_LIMIT: ${DB_CONNECTION_LIMIT_BACKEND:-12}
|
|
DB_POOL_TIMEOUT: ${DB_POOL_TIMEOUT:-15}
|
|
BACKEND_PORT: '39010'
|
|
JWT_SECRET: ${JWT_SECRET}
|
|
SESSION_COOKIE_NAME: ${SESSION_COOKIE_NAME:-rastro_session}
|
|
CORS_ORIGINS: https://${WEB_DOMAIN},https://${ADMIN_DOMAIN}
|
|
RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-1000}
|
|
GOTENBERG_URL: http://gotenberg:3000
|
|
MINIO_ENDPOINT: minio
|
|
MINIO_PORT: '9000'
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
|
|
MINIO_BUCKET: ${MINIO_BUCKET:-rastro-photos}
|
|
command: sh -c "wait-for-db schema && pnpm --filter @rastro/backend start"
|
|
# Porta interna do backend (aponte o domínio do Coolify para 39010, path /api e /health)
|
|
expose:
|
|
- "39010"
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '2.0', memory: 1G }
|
|
|
|
web:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rastro-node:${TAG:-latest}
|
|
restart: unless-stopped
|
|
environment:
|
|
<<: *app-env
|
|
VITE_DEV_HELPERS: 'false'
|
|
PREVIEW_ALLOWED_HOSTS: ${WEB_DOMAIN}
|
|
command: sh -c "pnpm --filter web preview --host 0.0.0.0 --port 39000"
|
|
expose:
|
|
- "39000"
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '1.0', memory: 640M }
|
|
|
|
admin:
|
|
image: ${REGISTRY:-gitea.interno.utic.app.br}/${NAMESPACE:-ericoalmeida}/rastro-node:${TAG:-latest}
|
|
restart: unless-stopped
|
|
environment:
|
|
<<: *app-env
|
|
VITE_DEV_HELPERS: 'false'
|
|
PREVIEW_ALLOWED_HOSTS: ${ADMIN_DOMAIN}
|
|
command: sh -c "pnpm --filter admin preview --host 0.0.0.0 --port 39020"
|
|
expose:
|
|
- "39020"
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: '1.0', memory: 640M }
|
|
|
|
volumes:
|
|
db_data:
|
|
rabbitmq_data:
|
|
minio_data:
|