senke/veza
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(infra): J6 — mark 3 dormant docker-compose files as deprecated

Browse source 
Audit cross-checked against active composes shows three dormant compose
files that duplicate functionality already covered by the canonical
docker-compose.{,dev,prod,staging,test}.yml at the repo root. None are
referenced from Make targets, scripts, or CI workflows. They have
diverged from the active set (different ports, older Postgres version,
no shared volume names, etc.) and are a footgun for new contributors.

Files marked DEPRECATED with a header pointing at the canonical compose
to use instead:

  veza-stream-server/docker-compose.yml
    Standalone stream-server compose. Same service is provided by the
    root docker-compose.yml under the `docker-dev` profile.

  infra/docker-compose.lab.yml
    Lab Postgres on default port 5432. Conflicts with a host Postgres on
    most setups; root docker-compose.dev.yml uses non-default ports for
    a reason.

  config/docker/docker-compose.local.yml
    Local Postgres 15 variant on port 5433. Redundant with root
    docker-compose.dev.yml (Postgres 16, project-wide port mapping).

Not in this commit (intentionally limited J6 scope, per audit plan
"verify, don't refactor"):

  - No `extends:` consolidation across the active composes — that is a
    1-2 day refactor on its own and not a v1.0.4 concern.
  - The five active composes were syntactically validated locally
    (docker compose config); production and staging both require
    operator-injected env vars (DB_PASS, S3_*, RABBITMQ_PASS, etc.)
    which is the intended behavior, not a bug.
  - Cross-compose audit confirms zero references to the removed
    chat-server or any other dead service / image. Only one residual
    deprecation warning across all active composes: the obsolete
    `version:` field on docker-compose.{prod,test,test}.yml — cosmetic,
    not blocking.
  - Test suite verification (Go / Rust / Vitest) deferred to Forgejo CI
    rather than re-running locally. The pre-push hook + remote pipeline
    will gate the next push.

Follow-up candidates (not blocking v1.0.4):
  - Delete the three deprecated files once a 2-month grace period
    confirms no local dev workflow references them.
  - Drop the obsolete `version:` field across the active composes.

Refs: AUDIT_REPORT.md §6.1, §10 P7
This commit is contained in:
senke 2026-04-15 12:58:39 +02:00
parent 7f89bebe1a
commit 113210734c
3 changed files with 332 additions and 311 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

227
config/docker/docker-compose.local.yml
View file

@ -1,122 +1,129 @@
version: '3.8' # ============================================================================
# DEPRECATED — local dev compose variant (postgres:15 on port 5433).
# Redundant with docker-compose.dev.yml at the repo root (postgres:16 on the
# project-wide port mapping). Use docker-compose.dev.yml instead:
# docker compose -f docker-compose.dev.yml up -d
# Marked in v1.0.4 cleanup. Candidate for deletion once confirmed unused.
# ============================================================================
version: "3.8"
services: services:
# Base de données PostgreSQL # Base de données PostgreSQL
postgres: postgres:
image: postgres:15-alpine image: postgres:15-alpine
container_name: veza-postgres-local container_name: veza-postgres-local
environment: environment:
POSTGRES_DB: veza_local POSTGRES_DB: veza_local
POSTGRES_USER: veza_user POSTGRES_USER: veza_user
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-devpassword} POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-devpassword}
ports: ports:
- "5433:5432" - "5433:5432"
volumes: volumes:
- postgres_data:/var/lib/postgresql/data - postgres_data:/var/lib/postgresql/data
- ./scripts/database/init.sql:/docker-entrypoint-initdb.d/init.sql - ./scripts/database/init.sql:/docker-entrypoint-initdb.d/init.sql
networks: networks:
- veza-network - veza-network
# Cache Redis # Cache Redis
redis: redis:
image: redis:7-alpine image: redis:7-alpine
container_name: veza-redis-local container_name: veza-redis-local
ports: ports:
- "6379:6379" - "6379:6379"
volumes: volumes:
- redis_data:/data - redis_data:/data
networks: networks:
- veza-network - veza-network
# Monitoring - Prometheus # Monitoring - Prometheus
prometheus: prometheus:
image: prom/prometheus:latest image: prom/prometheus:latest
container_name: veza-prometheus-local container_name: veza-prometheus-local
ports: ports:
- "9090:9090" - "9090:9090"
volumes: volumes:
- ./config/prometheus.yml:/etc/prometheus/prometheus.yml - ./config/prometheus.yml:/etc/prometheus/prometheus.yml
- prometheus_data:/prometheus - prometheus_data:/prometheus
command: command:
- '--config.file=/etc/prometheus/prometheus.yml' - "--config.file=/etc/prometheus/prometheus.yml"
- '--storage.tsdb.path=/prometheus' - "--storage.tsdb.path=/prometheus"
- '--web.console.libraries=/etc/prometheus/console_libraries' - "--web.console.libraries=/etc/prometheus/console_libraries"
- '--web.console.templates=/etc/prometheus/consoles' - "--web.console.templates=/etc/prometheus/consoles"
- '--storage.tsdb.retention.time=200h' - "--storage.tsdb.retention.time=200h"
- '--web.enable-lifecycle' - "--web.enable-lifecycle"
networks: networks:
- veza-network - veza-network
# Monitoring - Grafana # Monitoring - Grafana
grafana: grafana:
image: grafana/grafana:latest image: grafana/grafana:latest
container_name: veza-grafana-local container_name: veza-grafana-local
ports: ports:
- "3000:3000" - "3000:3000"
environment: environment:
GF_SECURITY_ADMIN_PASSWORD: admin GF_SECURITY_ADMIN_PASSWORD: admin
GF_USERS_ALLOW_SIGN_UP: "false" GF_USERS_ALLOW_SIGN_UP: "false"
volumes: volumes:
- grafana_data:/var/lib/grafana - grafana_data:/var/lib/grafana
- ./config/grafana/dashboards:/etc/grafana/provisioning/dashboards - ./config/grafana/dashboards:/etc/grafana/provisioning/dashboards
- ./config/grafana/datasources:/etc/grafana/provisioning/datasources - ./config/grafana/datasources:/etc/grafana/provisioning/datasources
networks: networks:
- veza-network - veza-network
# Logging - Elasticsearch # Logging - Elasticsearch
elasticsearch: elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:8.8.0 image: docker.elastic.co/elasticsearch/elasticsearch:8.8.0
container_name: veza-elasticsearch-local container_name: veza-elasticsearch-local
environment: environment:
- discovery.type=single-node - discovery.type=single-node
# SECURITY(LOW-004): Enable xpack security. Set ELASTIC_PASSWORD in .env. # SECURITY(LOW-004): Enable xpack security. Set ELASTIC_PASSWORD in .env.
- xpack.security.enabled=true - xpack.security.enabled=true
- ELASTIC_PASSWORD=${ELASTIC_PASSWORD:-devpassword} - ELASTIC_PASSWORD=${ELASTIC_PASSWORD:-devpassword}
- "ES_JAVA_OPTS=-Xms512m -Xmx512m" - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
ports: ports:
- "9200:9200" - "9200:9200"
volumes: volumes:
- elasticsearch_data:/usr/share/elasticsearch/data - elasticsearch_data:/usr/share/elasticsearch/data
networks: networks:
- veza-network - veza-network
# Logging - Kibana # Logging - Kibana
kibana: kibana:
image: docker.elastic.co/kibana/kibana:8.8.0 image: docker.elastic.co/kibana/kibana:8.8.0
container_name: veza-kibana-local container_name: veza-kibana-local
ports: ports:
- "5601:5601" - "5601:5601"
environment: environment:
ELASTICSEARCH_HOSTS: http://elasticsearch:9200 ELASTICSEARCH_HOSTS: http://elasticsearch:9200
volumes: volumes:
- kibana_data:/usr/share/kibana/data - kibana_data:/usr/share/kibana/data
networks: networks:
- veza-network - veza-network
depends_on: depends_on:
- elasticsearch - elasticsearch
# Logging - Filebeat # Logging - Filebeat
filebeat: filebeat:
image: docker.elastic.co/beats/filebeat:8.8.0 image: docker.elastic.co/beats/filebeat:8.8.0
container_name: veza-filebeat-local container_name: veza-filebeat-local
user: root user: root
volumes: volumes:
- ./config/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro - ./config/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
- /var/lib/docker/containers:/var/lib/docker/containers:ro - /var/lib/docker/containers:/var/lib/docker/containers:ro
- /var/run/docker.sock:/var/run/docker.sock:ro - /var/run/docker.sock:/var/run/docker.sock:ro
networks: networks:
- veza-network - veza-network
depends_on: depends_on:
- elasticsearch - elasticsearch
volumes: volumes:
postgres_data: postgres_data:
redis_data: redis_data:
prometheus_data: prometheus_data:
grafana_data: grafana_data:
elasticsearch_data: elasticsearch_data:
kibana_data: kibana_data:
networks: networks:
veza-network: veza-network:
driver: bridge driver: bridge

131
infra/docker-compose.lab.yml
View file

@ -1,72 +1,79 @@
# ============================================================================
# DEPRECATED — lab environment compose, dormant since February 2026.
# Overlaps with docker-compose.dev.yml at the repo root (which uses non-default
# ports to avoid conflicts with a host Postgres). Use docker-compose.dev.yml
# for day-to-day dev:
# docker compose -f docker-compose.dev.yml up -d
# Marked in v1.0.4 cleanup. Candidate for deletion once confirmed unused.
# ============================================================================
version: "3.9" version: "3.9"
services: services:
postgres: postgres:
image: postgres:16 image: postgres:16
container_name: veza-lab-postgres container_name: veza-lab-postgres
environment: environment:
POSTGRES_USER: veza POSTGRES_USER: veza
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-devpassword} POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-devpassword}
POSTGRES_DB: veza_lab POSTGRES_DB: veza_lab
ports: ports:
- "5432:5432" - "5432:5432"
volumes: volumes:
- postgres_lab_data:/var/lib/postgresql/data - postgres_lab_data:/var/lib/postgresql/data
healthcheck: healthcheck:
test: [ "CMD-SHELL", "pg_isready -U veza -d veza_lab" ] test: ["CMD-SHELL", "pg_isready -U veza -d veza_lab"]
interval: 5s interval: 5s
timeout: 3s timeout: 3s
retries: 10 retries: 10
networks: networks:
- veza-lab-net - veza-lab-net
redis: redis:
image: redis:7 image: redis:7
container_name: veza-lab-redis container_name: veza-lab-redis
ports: ports:
- "6379:6379" - "6379:6379"
healthcheck: healthcheck:
test: [ "CMD", "redis-cli", "ping" ] test: ["CMD", "redis-cli", "ping"]
interval: 5s interval: 5s
timeout: 3s timeout: 3s
retries: 5 retries: 5
networks: networks:
- veza-lab-net - veza-lab-net
rabbitmq: rabbitmq:
image: rabbitmq:3-management image: rabbitmq:3-management
container_name: veza-lab-rabbitmq container_name: veza-lab-rabbitmq
ports: ports:
- "5672:5672" - "5672:5672"
- "15672:15672" - "15672:15672"
environment: environment:
RABBITMQ_DEFAULT_USER: veza RABBITMQ_DEFAULT_USER: veza
RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-devpassword} RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-devpassword}
healthcheck: healthcheck:
test: [ "CMD", "rabbitmq-diagnostics", "-q", "ping" ] test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
interval: 10s interval: 10s
timeout: 5s timeout: 5s
retries: 5 retries: 5
networks: networks:
- veza-lab-net - veza-lab-net
haproxy: haproxy:
image: haproxy:lts-alpine image: haproxy:lts-alpine
container_name: veza-lab-haproxy container_name: veza-lab-haproxy
ports: ports:
- "80:80" - "80:80"
# - "443:443" # SSL disabled for now # - "443:443" # SSL disabled for now
volumes: volumes:
- ../docker/haproxy/haproxy.lab.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro - ../docker/haproxy/haproxy.lab.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
extra_hosts: extra_hosts:
- "host.docker.internal:host-gateway" - "host.docker.internal:host-gateway"
networks: networks:
- veza-lab-net - veza-lab-net
volumes: volumes:
postgres_lab_data: postgres_lab_data:
networks: networks:
veza-lab-net: veza-lab-net:
driver: bridge driver: bridge

285
veza-stream-server/docker-compose.yml
View file

@ -1,148 +1,155 @@
version: '3.8' # ============================================================================
# DEPRECATED — standalone stream-server compose.
# Use docker-compose.yml (root) with the `docker-dev` profile instead:
# docker compose --profile docker-dev up -d stream-server
# Marked in v1.0.4 cleanup. Candidate for deletion once no local dev
# reference is found (2+ month grace period).
# ============================================================================
version: "3.8"
services: services:
stream-server: stream-server:
build: build:
context: . context: .
dockerfile: Dockerfile dockerfile: Dockerfile
args: args:
BUILD_TIME: ${BUILD_TIME:-$(date -u +"%Y-%m-%dT%H:%M:%SZ")} BUILD_TIME: ${BUILD_TIME:-$(date -u +"%Y-%m-%dT%H:%M:%SZ")}
RUST_VERSION: ${RUST_VERSION:-$(rustc --version)} RUST_VERSION: ${RUST_VERSION:-$(rustc --version)}
container_name: stream-server container_name: stream-server
restart: unless-stopped restart: unless-stopped
# Configuration réseau
ports:
- "${HOST_PORT:-8082}:8082"
# Variables d'environnement
environment:
- SECRET_KEY=${SECRET_KEY}
- STREAM_SERVER_PORT=8082
- AUDIO_DIR=/app/audio
- ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-http://localhost:5173}
- MAX_FILE_SIZE=${MAX_FILE_SIZE:-104857600}
- MAX_RANGE_SIZE=${MAX_RANGE_SIZE:-10485760}
- SIGNATURE_TOLERANCE=${SIGNATURE_TOLERANCE:-60}
- RUST_LOG=${RUST_LOG:-stream_server=info}
- ADMIN_TOKEN=${ADMIN_TOKEN:-}
# Montage des volumes
volumes:
- ./audio:/app/audio:ro
- ./logs:/app/logs:rw
- stream_server_cache:/tmp
# Limitations de ressources
deploy:
resources:
limits:
memory: 512M
cpus: '1.0'
reservations:
memory: 128M
cpus: '0.25'
# Configuration de sécurité
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
read_only: true
tmpfs:
- /tmp:rw,noexec,nosuid,size=100m
# Health check
healthcheck:
test: ["CMD", "/usr/local/bin/healthcheck.sh"]
interval: 30s
timeout: 10s
retries: 3
start_period: 10s
# Réseau
networks:
- stream_network
# Proxy inverse (optionnel) # Configuration réseau
nginx: ports:
image: nginx:alpine - "${HOST_PORT:-8082}:8082"
container_name: stream-nginx
restart: unless-stopped
depends_on:
- stream-server
ports:
- "${NGINX_PORT:-80}:80"
- "${NGINX_SSL_PORT:-443}:443"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf:ro
- ./ssl:/etc/nginx/ssl:ro
- nginx_cache:/var/cache/nginx
networks:
- stream_network
profiles:
- with-proxy
# Monitoring avec Prometheus (optionnel) # Variables d'environnement
prometheus: environment:
image: prom/prometheus:latest - SECRET_KEY=${SECRET_KEY}
container_name: stream-prometheus - STREAM_SERVER_PORT=8082
restart: unless-stopped - AUDIO_DIR=/app/audio
ports: - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-http://localhost:5173}
- "${PROMETHEUS_PORT:-9090}:9090" - MAX_FILE_SIZE=${MAX_FILE_SIZE:-104857600}
volumes: - MAX_RANGE_SIZE=${MAX_RANGE_SIZE:-10485760}
- ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro - SIGNATURE_TOLERANCE=${SIGNATURE_TOLERANCE:-60}
- prometheus_data:/prometheus - RUST_LOG=${RUST_LOG:-stream_server=info}
command: - ADMIN_TOKEN=${ADMIN_TOKEN:-}
- '--config.file=/etc/prometheus/prometheus.yml'
- '--storage.tsdb.path=/prometheus'
- '--web.console.libraries=/etc/prometheus/console_libraries'
- '--web.console.templates=/etc/prometheus/consoles'
- '--storage.tsdb.retention.time=200h'
- '--web.enable-lifecycle'
networks:
- stream_network
profiles:
- monitoring
# Grafana pour la visualisation (optionnel) # Montage des volumes
grafana: volumes:
image: grafana/grafana:latest - ./audio:/app/audio:ro
container_name: stream-grafana - ./logs:/app/logs:rw
restart: unless-stopped - stream_server_cache:/tmp
depends_on:
- prometheus # Limitations de ressources
ports: deploy:
- "${GRAFANA_PORT:-3000}:3000" resources:
environment: limits:
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin} memory: 512M
- GF_USERS_ALLOW_SIGN_UP=false cpus: "1.0"
volumes: reservations:
- grafana_data:/var/lib/grafana memory: 128M
- ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro cpus: "0.25"
- ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources:ro
networks: # Configuration de sécurité
- stream_network security_opt:
profiles: - no-new-privileges:true
- monitoring cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
read_only: true
tmpfs:
- /tmp:rw,noexec,nosuid,size=100m
# Health check
healthcheck:
test: ["CMD", "/usr/local/bin/healthcheck.sh"]
interval: 30s
timeout: 10s
retries: 3
start_period: 10s
# Réseau
networks:
- stream_network
# Proxy inverse (optionnel)
nginx:
image: nginx:alpine
container_name: stream-nginx
restart: unless-stopped
depends_on:
- stream-server
ports:
- "${NGINX_PORT:-80}:80"
- "${NGINX_SSL_PORT:-443}:443"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf:ro
- ./ssl:/etc/nginx/ssl:ro
- nginx_cache:/var/cache/nginx
networks:
- stream_network
profiles:
- with-proxy
# Monitoring avec Prometheus (optionnel)
prometheus:
image: prom/prometheus:latest
container_name: stream-prometheus
restart: unless-stopped
ports:
- "${PROMETHEUS_PORT:-9090}:9090"
volumes:
- ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
- prometheus_data:/prometheus
command:
- "--config.file=/etc/prometheus/prometheus.yml"
- "--storage.tsdb.path=/prometheus"
- "--web.console.libraries=/etc/prometheus/console_libraries"
- "--web.console.templates=/etc/prometheus/consoles"
- "--storage.tsdb.retention.time=200h"
- "--web.enable-lifecycle"
networks:
- stream_network
profiles:
- monitoring
# Grafana pour la visualisation (optionnel)
grafana:
image: grafana/grafana:latest
container_name: stream-grafana
restart: unless-stopped
depends_on:
- prometheus
ports:
- "${GRAFANA_PORT:-3000}:3000"
environment:
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
- GF_USERS_ALLOW_SIGN_UP=false
volumes:
- grafana_data:/var/lib/grafana
- ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
- ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources:ro
networks:
- stream_network
profiles:
- monitoring
networks: networks:
stream_network: stream_network:
driver: bridge driver: bridge
ipam: ipam:
config: config:
- subnet: 172.20.0.0/16 - subnet: 172.20.0.0/16
volumes: volumes:
stream_server_cache: stream_server_cache:
driver: local driver: local
nginx_cache: nginx_cache:
driver: local driver: local
prometheus_data: prometheus_data:
driver: local driver: local
grafana_data: grafana_data:
driver: local driver: local