Ilia Denisov
2b399d0838
Split the contour across the two prod hosts and retune for the small main host: - Gate vpn+bot to the telegram-local profile. The CI test deploy now passes --profile telegram-local so the test contour still brings them; the prod main host omits both, and the prod bot runs standalone from docker-compose.bot.yml. - docker-compose.prod.yml (main-host overlay): publish caddy 80/443 (no host caddy in prod; caddy owns ACME) and gateway 9443 (the remote bot dials in over mTLS); GOMAXPROCS=2, smaller memory caps and 7d Prometheus retention for the 2 vCPU / 1.9 GiB host. It launches deliberately undersized; resize reactively. - docker-compose.bot.yml: standalone bot for the tg host (no VPN, OTLP off since otelcol is unreachable from there, dials the main host's bot-link). - Add node_exporter + a Prometheus scrape so host memory pressure (the OOM signal on the tight main host), not just per-container docker_stats, is visible. - Soften AWG_CONF to a default: only the profiled vpn sidecar consumes it, and compose interpolates profiled-out services too, so prod must not require it.
93 lines
2.0 KiB
YAML
93 lines
2.0 KiB
YAML
# Production main-host overlay, applied on top of docker-compose.yml on the main host:
|
|
# docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
|
|
#
|
|
# It (1) publishes caddy 80/443 — there is no host caddy in prod, so the contour caddy
|
|
# owns the edge and does its own ACME on CADDY_SITE_ADDRESS — and the gateway bot-link
|
|
# :9443 the remote bot dials in over mTLS; and (2) retunes the R7 limits down for the
|
|
# 2 vCPU / 1.9 GiB host (GOMAXPROCS=2, smaller memory caps, shorter Prometheus
|
|
# retention). The contour launches deliberately undersized at zero players; the added
|
|
# node_exporter + Grafana watch host memory so it can be resized at Selectel when
|
|
# traffic arrives.
|
|
#
|
|
# The bot + its VPN sidecar are absent here (the telegram-local profile is not
|
|
# activated); the prod bot runs on its own host from docker-compose.bot.yml.
|
|
|
|
services:
|
|
caddy:
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 96M
|
|
|
|
gateway:
|
|
ports:
|
|
- "9443:9443"
|
|
environment:
|
|
# 2 vCPU host: align the Go scheduler with the cgroup quota (R7's 3 needs 3 cores).
|
|
GOMAXPROCS: "2"
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "2.0"
|
|
memory: 384M
|
|
|
|
backend:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 384M
|
|
|
|
postgres:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 384M
|
|
|
|
validator:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 96M
|
|
|
|
landing:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 64M
|
|
|
|
otelcol:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 256M
|
|
|
|
prometheus:
|
|
command:
|
|
- --config.file=/etc/prometheus/prometheus.yml
|
|
- --storage.tsdb.retention.time=7d
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 256M
|
|
|
|
tempo:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 384M
|
|
|
|
grafana:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 256M
|
|
|
|
postgres_exporter:
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 64M
|