docker-compose.yml

version: '3.8'

services:
  malachi:
    image: ${DOCKERHUB_USERNAME:-hectorcardoso}/malachi:latest
    build:
      context: .
      dockerfile: Dockerfile
    container_name: malachi
    ports:
      - "4040:4040"
      - "4041:4041"
    environment:
      - MALACHI_TCP_PORT=4040
      - MALACHI_DASHBOARD_PORT=4041
      - MALACHI_LOCALE=en_US
      - MALACHI_ADMIN_PASS=${MALACHI_ADMIN_PASS:-admin123}
      - MALACHI_PRODUCER_PASS=${MALACHI_PRODUCER_PASS:-producer123}
      - MALACHI_CONSUMER_PASS=${MALACHI_CONSUMER_PASS:-consumer123}
      - MALACHI_APP_PASS=${MALACHI_APP_PASS:-app123}
      - MALACHI_RATE_LIMIT_ENABLED=true
      - MALACHI_SESSION_IP_BINDING=true
      - MALACHI_AUDIT_LOG_OUTPUT=stdout
      # Durable storage. Without these the defaults land under /tmp, which is a tmpfs (below), so every
      # segment and the ra log (user credentials, ACLs, lockouts) would live in RAM and vanish on restart.
      # Same paths as the Kubernetes manifest, both under the one persistent mount.
      - MALACHI_RA_DATA_DIR=/app/data/ra
      - MALACHI_LOG_DATA_DIR=/app/data/log
    security_opt:
      - no-new-privileges:true
    # The root filesystem stays read-only; the named volume below is the single writable persistent path,
    # which a durable broker requires. /tmp and the log dir are writable tmpfs and do not survive a restart.
    read_only: true
    volumes:
      - malachi-data:/app/data
    tmpfs:
      - /tmp:rw,noexec,nosuid
    mem_limit: 512m
    cpus: 2.0
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "nc", "-z", "localhost", "4040"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 15s

  producer:
    image: node:20-alpine
    container_name: malachi-producer
    working_dir: /app
    volumes:
      - ./scripts:/app
    environment:
      - MALACHI_HOST=malachi
      - MALACHI_PORT=4040
      - MALACHI_USER=producer
      - MALACHI_PASS=${MALACHI_PRODUCER_PASS:-producer123}
      - MALACHI_LOCALE=en_US
    depends_on:
      malachi:
        condition: service_healthy
    command: ["node", "producer.js", "10"]
    profiles:
      - tools

volumes:
  # Persists the broker's log segments and ra state (credentials, ACLs, lockouts) across restarts.
  malachi-data: