Self-hosted in under 15 minutes.

# ==========================================
# Testhide — Production Docker Compose (14 services)
# Images: hub.docker.com/u/thuesdays
# Download the full file via the button above.
# ==========================================

name: testhide

services:

  # ── Config-init (one-shot, syncs baked configs to named volumes) ─
  config-init:
    image: thuesdays/testhide-backend:latest
    container_name: testhide-config-init
    entrypoint: []
    command: ["bash", "/app/scripts/sync-configs-to-volumes.sh"]
    environment:
      - SKIP_LLM_CHECK=true
      - LOAD_AI_MODELS=false
      - RUN_AI_WORKER=false
      - DISABLE_CRON=true
    volumes:
      - grafana_dashboards:/mnt/grafana_dashboards
      - grafana_provisioning:/mnt/grafana_provisioning
      - loki_config:/mnt/loki_config
      - prometheus_config:/mnt/prometheus_config
      - tempo_config:/mnt/tempo_config
      - alloy_config:/mnt/alloy_config
    restart: "no"

  # ── Frontend (Nginx + Angular SPA, TLS termination) ─────────────
  frontend:
    container_name: testhide_frontend
    image: thuesdays/testhide-frontend:latest
    restart: unless-stopped
    ports: [ "80:80", "443:443", "7771:7771" ]
    env_file: [ .env ]
    environment:
      - CERT_FILE=${CERT_FILE}
      - CERT_KEY=${CERT_KEY}
    volumes:
      - ./ssl:/etc/ssl:ro
      - testhide_static_data:/usr/share/nginx/html/static:ro
    depends_on: [ backend, ai-api ]
    networks: [ testhide-net ]
    mem_limit: 256m

  # ── Backend (Python API + WebSocket, 2 replicas) ─────────────────
  backend:
    image: thuesdays/testhide-backend:latest
    restart: unless-stopped
    env_file: [ .env ]
    environment:
      - LOAD_AI_MODELS=false
      - RUN_AI_WORKER=false
      - ENVIRONMENT=production
      - SERVICE_NAME=testhide
      - BUILD_RCA_RETRAIN_THRESHOLD=9999999   # MUST NEVER train
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
      - SIDECAR_URL=http://sidecar-docker:8081
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-${PUBLIC_URL}}
    volumes:
      - testhide_static_data:/app/static
      - ./releases:/app/releases
      - ./monitoring_scripts:/app/monitoring_scripts
      - ./sandbox_data:/app/sandbox_data
      - ./ssh_keys:/app/ssh_keys     # persists across deploys
      - ./docker-compose.yaml:/app/docker-compose.yaml:ro
      - testhide_hf_cache:/app/hf_cache
    depends_on:
      mongo: { condition: service_healthy }
      redis: { condition: service_healthy }
      sidecar-docker: { condition: service_healthy }
    networks: [ testhide-net, testhide-internal ]
    mem_limit: 2.5g
    deploy:
      replicas: 2
      resources:
        limits: { cpus: "2.0", memory: 2.5g }

  # ── AI API (LLM / CLIP / FAISS inference — HTTP only) ────────────
  # Elastic memory: 1.5 GB reservation, 4.5 GB limit. Anti-correlated
  # with ai-worker via Redis (ai:training:in_progress).
  ai-api:
    container_name: testhide_ai_api
    image: thuesdays/testhide-backend:latest
    env_file: [ .env ]
    environment:
      - LOAD_AI_MODELS=true
      - RUN_AI_WORKER=false
      - DISABLE_CRON=true
      - HF_HOME=/app/hf_cache
      - HF_HUB_OFFLINE=${HF_HUB_OFFLINE:-0}
      - RC_MODEL_NAME=${RC_MODEL_NAME:-distilbert-base-uncased}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-${PUBLIC_URL}}
    volumes:
      - testhide_static_data:/app/static
      - testhide_hf_cache:/app/hf_cache
      - ./sandbox_data:/app/sandbox_data
      - ./releases:/app/releases
    depends_on:
      mongo: { condition: service_healthy }
      redis: { condition: service_healthy }
    networks: [ testhide-net ]
    mem_limit: 4.5g
    memswap_limit: 4.5g
    mem_reservation: 1500m
    cpus: 2.5

  # ── AI Worker (training, vectorization, Edge AI) ─────────────────
  # Elastic memory: 5 GB reservation, 8.5 GB limit.
  ai-worker:
    container_name: testhide_ai_worker
    image: thuesdays/testhide-backend:latest
    env_file: [ .env ]
    environment:
      - LOAD_AI_MODELS=true
      - RUN_AI_WORKER=true
      - RUN_INFERENCE_WORKER=true  # drains /ai/inference queue
      - DISABLE_CRON=true
      - SKIP_BUILD_RECOVERY=true
      # Memory ceiling, dataset/batch caps and CPU/GPU selection are auto-sized
      # from the container's RAM + CPU/GPU — no AI tuning env vars needed.
      - AI_LLM_CTX=${AI_LLM_CTX:-8192}
      - AI_TRAINING_LOCK_TTL_SEC=${AI_TRAINING_LOCK_TTL_SEC:-3600}
      - AI_VECTORS_SIDECAR_ENABLED=${AI_VECTORS_SIDECAR_ENABLED:-1}
      - HF_HOME=/app/hf_cache
      - RC_MODEL_NAME=${RC_MODEL_NAME:-distilbert-base-uncased}
    volumes:
      - testhide_static_data:/app/static
      - testhide_hf_cache:/app/hf_cache
      - ./sandbox_data:/app/sandbox_data
      - ./releases:/app/releases
    depends_on:
      mongo: { condition: service_healthy }
      redis: { condition: service_healthy }
    networks: [ testhide-net ]
    mem_limit: 8.5g
    memswap_limit: 8.5g
    mem_reservation: 5g
    cpus: 5.0

  # ── MongoDB 8 ──────────────────────────────────────────────────
  mongo:
    container_name: testhide_mongo
    image: mongo:8.2.3
    restart: unless-stopped
    command: ["mongod","--auth","--wiredTigerCacheSizeGB","2"]
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${MONGO_USER}
      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASS}
    ports: [ "27017:27017" ]
    volumes: [ "${MONGO_DATA_PATH}:/data/db" ]
    networks: [ testhide-net ]
    healthcheck:
      # Unauthenticated ping (allowed before auth), with a client-free fallback:
      # the app user does NOT live in `admin`, and `mongosh` is not on PATH in mongo:8.2.3.
      test: ["CMD-SHELL","mongosh --quiet --eval \"db.adminCommand('ping').ok\" 2>/dev/null || bash -c 'exec 3<>/dev/tcp/127.0.0.1/27017' 2>/dev/null"]
      interval: 30s · timeout: 5s · retries: 5 · start_period: 40s
    mem_limit: 3g

  # ── Redis 7 ───────────────────────────────────────────────────
  redis:
    container_name: testhide_redis
    image: redis:7-alpine
    command: ["redis-server","--maxmemory","512mb","--maxmemory-policy","allkeys-lru","--appendonly","no","--requirepass","${REDIS_PASSWORD}"]
    networks: [ testhide-net ]
    mem_limit: 768m

  # ── Redis Insight (optional admin UI, proxied via nginx) ───────
  redisinsight:
    container_name: testhide_redisinsight
    image: redis/redisinsight:3.4.2  # pinned — :latest 404s on Docker Hub
    depends_on:
      redis: { condition: service_healthy }
    networks: [ testhide-net ]
    mem_limit: 256m

  # ── Docker Socket Sidecar (SEC-004) ────────────────────────────
  # Sidecar token auto-derived from JWT_SECRET via HMAC-SHA256.
  sidecar-docker:
    container_name: testhide_sidecar_docker
    image: thuesdays/testhide-sidecar:latest
    environment:
      - JWT_SECRET=${JWT_SECRET}
      - SIDECAR_ALLOWED_IMAGES=${SIDECAR_ALLOWED_IMAGES}
      - SIDECAR_ALLOWED_EXEC_PATTERNS=${SIDECAR_ALLOWED_EXEC_PATTERNS}
      - SIDECAR_ALLOWED_NETWORKS=${SIDECAR_ALLOWED_NETWORKS}
      - SIDECAR_PORT=8081
    volumes: [ "/var/run/docker.sock:/var/run/docker.sock" ]
    networks: [ testhide-internal ]
    mem_limit: 128m
    healthcheck:
      test: ["CMD","wget","-qO-","http://localhost:8081/health"]

  # ── Observability: Prometheus (metrics) ────────────────────────
  # Loopback bind by default. Override via PROMETHEUS_PORT_BIND.
  prometheus:
    image: prom/prometheus:v2.51.0
    container_name: testhide-prometheus
    depends_on:
      config-init: { condition: service_completed_successfully }
    volumes:
      - prometheus_config:/etc/prometheus:ro
      - prometheus_data:/prometheus
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.retention.time=30d
      - --web.enable-lifecycle
      - --web.enable-remote-write-receiver
    ports: [ "${PROMETHEUS_PORT_BIND:-127.0.0.1:9090}:9090" ]
    networks: [ testhide-net ]
    mem_limit: 512m

  # ── Observability: Grafana (HTTPS, dashboards) ─────────────────
  grafana:
    image: grafana/grafana:10.4.2
    container_name: testhide-grafana
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?Set in .env}
      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-${PUBLIC_URL}:3000}
      GF_SERVER_PROTOCOL: https
      GF_SERVER_CERT_FILE: /etc/grafana/ssl/server.crt
      GF_SERVER_CERT_KEY: /etc/grafana/ssl/server.key
      GF_FEATURE_TOGGLES_ENABLE: traceqlEditor
      GF_AUTH_ANONYMOUS_ENABLED: "false"
    volumes:
      - grafana_provisioning:/etc/grafana/provisioning:ro
      - grafana_dashboards:/var/lib/grafana/dashboards:ro
      - grafana_data:/var/lib/grafana
      - ${GRAFANA_CERT_HOST_CRT:-./ssl/testhide.crt}:/etc/grafana/ssl/server.crt:ro
      - ${GRAFANA_CERT_HOST_KEY:-./ssl/testhide.key}:/etc/grafana/ssl/server.key:ro
    ports: [ "3000:3000" ]
    depends_on:
      config-init: { condition: service_completed_successfully }
      prometheus:  { condition: service_started }
      tempo:       { condition: service_started }
      loki:        { condition: service_started }
    networks: [ testhide-net ]
    mem_limit: 256m

  # ── Observability: Tempo (distributed traces, OTel) ────────────
  tempo:
    image: grafana/tempo:2.4.1
    container_name: testhide-tempo
    command: ["-config.file=/etc/tempo/tempo.yml"]
    depends_on:
      config-init: { condition: service_completed_successfully }
    volumes:
      - tempo_config:/etc/tempo:ro
      - tempo_data:/tmp/tempo
    ports: [ "4317:4317", "4318:4318", "3200:3200" ]
    networks: [ testhide-net ]
    mem_limit: 512m

  # ── Observability: Loki (log storage) ──────────────────────────
  loki:
    image: grafana/loki:2.9.4
    container_name: testhide-loki
    command: -config.file=/etc/loki/loki.yml
    depends_on:
      config-init: { condition: service_completed_successfully }
    volumes:
      - loki_config:/etc/loki:ro
      - loki_data:/loki
    ports: [ "3100:3100" ]
    networks: [ testhide-net ]
    mem_limit: 256m

  # ── Observability: Grafana Alloy (log/metric collector) ────────
  alloy:
    image: grafana/alloy:v1.5.1
    container_name: testhide-alloy
    volumes:
      - alloy_config:/etc/alloy:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - testhide_static_data:/var/log/testhide:ro
    ports: [ "12345:12345" ]
    depends_on:
      config-init: { condition: service_completed_successfully }
      loki:       { condition: service_started }
      prometheus: { condition: service_started }
    networks: [ testhide-net ]
    mem_limit: 256m

volumes:
  testhide_static_data:    { name: testhide_static_data }
  testhide_hf_cache:       { name: testhide_hf_cache }
  prometheus_data:         { name: testhide_prometheus_data }
  grafana_data:            { name: testhide_grafana_data }
  tempo_data:              { name: testhide_tempo_data }
  loki_data:               { name: testhide_loki_data }
  # Config volumes — populated by config-init from the image.
  grafana_dashboards:      { name: testhide_grafana_dashboards }
  grafana_provisioning:    { name: testhide_grafana_provisioning }
  loki_config:             { name: testhide_loki_config }
  prometheus_config:       { name: testhide_prometheus_config }
  tempo_config:            { name: testhide_tempo_config }
  alloy_config:            { name: testhide_alloy_config }

networks:
  testhide-net:      { name: testhide-net }
  testhide-internal: { driver: bridge, internal: true }