docker-compose.ghcr.yml

# QuantDinger Docker Compose - GHCR prebuilt images (zero-repo deploy)
#
# Pulls backend, frontend, and mobile H5 images from GitHub Container Registry. The
# repository does NOT need to be cloned - only this file (plus a backend.env
# for runtime config) is required.
#
# Minimal install (Linux / macOS):
#
#   curl -O https://raw.githubusercontent.com/OpenByteInc/QuantDinger/main/docker-compose.ghcr.yml
#   curl -o backend.env https://raw.githubusercontent.com/OpenByteInc/QuantDinger/main/backend_api_python/env.example
#   # Edit backend.env and set ADMIN_USER / ADMIN_PASSWORD before first start.
#   docker compose -f docker-compose.ghcr.yml up -d
#   # open http://localhost:8888  (web) or http://localhost:8889 (mobile H5)
#
# Two-file separation of concerns:
#   - backend.env   - backend runtime config (SECRET_KEY, API keys, broker creds, ...);
#                     bind-mounted into the backend container as /app/.env
#   - .env (optional) - docker compose orchestration knobs (IMAGE_TAG, ports, mirrors);
#                       read by `docker compose` itself for ${VAR} substitution
#
# Database schema is bootstrapped automatically: the backend re-applies
# `migrations/init.sql` idempotently on every start, so no host-side SQL
# mount is needed (unlike docker-compose.yml).
#
# Orchestration override knobs (project-root .env, all optional):
#   IMAGE_TAG       - unified tag for backend AND frontend  (optional; see per-side defaults below)
#   BACKEND_TAG     - per-side override: pins backend only  (default: $IMAGE_TAG)
#   FRONTEND_TAG    - per-side override: pins frontend only (default: $IMAGE_TAG)
#   BACKEND_IMAGE   - backend image path  (default: ghcr.io/openbyteinc/quantdinger-backend)
#   FRONTEND_IMAGE  - frontend image path (default: ghcr.io/openbyteinc/quantdinger-frontend)
#   MOBILE_IMAGE    - mobile H5 image path (default: ghcr.io/openbyteinc/quantdinger-mobile)
#   IMAGE_PREFIX    - postgres/redis registry prefix (e.g. docker.m.daocloud.io/library/)
#
# Normal use: set IMAGE_TAG once and both services move in lockstep.
# Per-side overrides only kick in when BACKEND_TAG / FRONTEND_TAG are
# explicitly set - useful for testing a frontend hotfix against a
# stable backend, or vice versa.

x-backend-runtime: &backend-runtime
  init: true
  security_opt:
    - no-new-privileges:true
  pids_limit: ${BACKEND_PIDS_LIMIT:-512}
  stop_grace_period: ${BACKEND_STOP_GRACE_PERIOD:-45s}
  logging:
    driver: json-file
    options:
      max-size: ${CONTAINER_LOG_MAX_SIZE:-20m}
      max-file: ${CONTAINER_LOG_MAX_FILES:-5}

services:
  postgres:
    image: ${POSTGRES_IMAGE:-${IMAGE_PREFIX:-}postgres:18.3-alpine}
    container_name: quantdinger-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-quantdinger}
      POSTGRES_USER: ${POSTGRES_USER:-quantdinger}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-quantdinger123}
      PGDATA: ${POSTGRES_PGDATA:-/var/lib/postgresql/18/docker}
      TZ: ${TZ:-Asia/Shanghai}
    command:
      - "postgres"
      - "-c"
      - "max_connections=${PG_MAX_CONNECTIONS:-150}"
      - "-c"
      - "shared_buffers=${PG_SHARED_BUFFERS:-256MB}"
    volumes:
      - ${POSTGRES_DATA_SOURCE:-postgres_data}:${POSTGRES_PGDATA:-/var/lib/postgresql/18/docker}
    ports:
      - "${DB_PORT:-127.0.0.1:5432}:5432"
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-quantdinger} -d ${POSTGRES_DB:-quantdinger}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: ${REDIS_IMAGE:-${IMAGE_PREFIX:-}redis:8-alpine}
    container_name: quantdinger-redis
    restart: unless-stopped
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
    command:
      - sh
      - -ec
      - |
        if [ -n "$$REDIS_PASSWORD" ]; then set -- --requirepass "$$REDIS_PASSWORD"; fi
        exec redis-server --maxmemory "${REDIS_CACHE_MAXMEMORY:-128mb}" --maxmemory-policy allkeys-lru "$$@"
    ports:
      - "${REDIS_PORT:-127.0.0.1:6379}:6379"
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD-SHELL", "if [ -n \"$$REDIS_PASSWORD\" ]; then redis-cli --no-auth-warning -a \"$$REDIS_PASSWORD\" ping; else redis-cli ping; fi"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis-jobs:
    image: ${REDIS_IMAGE:-${IMAGE_PREFIX:-}redis:8-alpine}
    container_name: quantdinger-redis-jobs
    restart: unless-stopped
    environment:
      REDIS_PASSWORD: ${CELERY_REDIS_PASSWORD:-}
    command:
      - sh
      - -ec
      - |
        if [ -n "$$REDIS_PASSWORD" ]; then set -- --requirepass "$$REDIS_PASSWORD"; fi
        exec redis-server --appendonly yes --appendfsync everysec --save 60 1000 --maxmemory "${REDIS_JOBS_MAXMEMORY:-512mb}" --maxmemory-policy noeviction "$$@"
    volumes:
      - celery_redis_data:/data
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD-SHELL", "if [ -n \"$$REDIS_PASSWORD\" ]; then redis-cli --no-auth-warning -a \"$$REDIS_PASSWORD\" ping; else redis-cli ping; fi"]
      interval: 10s
      timeout: 5s
      retries: 5

  migration:
    <<: *backend-runtime
    image: ${BACKEND_IMAGE:-ghcr.io/openbyteinc/quantdinger-backend}:${BACKEND_TAG:-${IMAGE_TAG:-latest}}
    pull_policy: always
    container_name: quantdinger-migration
    restart: "no"
    command: ["python", "-m", "app.commands.migrate"]
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - backend_logs:/app/logs
      - backend_data:/app/data
      - ./backend.env:/app/.env
    environment:
      - DATABASE_URL=postgresql://${POSTGRES_USER:-quantdinger}:${POSTGRES_PASSWORD:-quantdinger123}@postgres:5432/${POSTGRES_DB:-quantdinger}
      - DB_TYPE=postgresql
      - DB_POOL_MIN=1
      - DB_POOL_MAX=2
    networks:
      - quantdinger-network

  backend:
    <<: *backend-runtime
    # Tag resolution: BACKEND_TAG > IMAGE_TAG > latest. See header comment.
    image: ${BACKEND_IMAGE:-ghcr.io/openbyteinc/quantdinger-backend}:${BACKEND_TAG:-${IMAGE_TAG:-latest}}
    pull_policy: always
    container_name: quantdinger-backend
    restart: unless-stopped
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      redis-jobs:
        condition: service_healthy
      migration:
        condition: service_completed_successfully
    ports:
      - "${BACKEND_PORT:-127.0.0.1:5000}:5000"
    volumes:
      - backend_logs:/app/logs
      - backend_data:/app/data
      # Backend runtime config. Must exist as a *file* on the host - if missing,
      # docker silently creates a directory at the mount target and shadows
      # /app/.env. The entrypoint will auto-generate SECRET_KEY on first start
      # and write it back through the bind mount, so the host file gets the
      # generated key persistently.
      - ./backend.env:/app/.env
    environment:
      - PYTHON_API_HOST=0.0.0.0
      - PYTHON_API_PORT=5000
      - GIT_TAG=${GIT_TAG:-${BACKEND_TAG:-${IMAGE_TAG:-}}}
      - TZ=${TZ:-Asia/Shanghai}
      - DATABASE_URL=postgresql://${POSTGRES_USER:-quantdinger}:${POSTGRES_PASSWORD:-quantdinger123}@postgres:5432/${POSTGRES_DB:-quantdinger}
      - DB_TYPE=postgresql
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - REDIS_PASSWORD=${REDIS_PASSWORD:-}
      - REDIS_CACHE_NAMESPACE=${REDIS_CACHE_NAMESPACE:-quantdinger:cache:v1}
      - CACHE_ENABLED=true
      - QD_PROCESS_ROLE=api
      - LOG_FORMAT=${LOG_FORMAT:-json}
      - PROMETHEUS_MULTIPROC_DIR=/tmp/quantdinger-prometheus
      - STRATEGY_COMMANDS_ENABLED=true
      - CELERY_TASKS_ENABLED=true
      - CELERY_REDIS_HOST=redis-jobs
      - CELERY_REDIS_PORT=6379
      - CELERY_REDIS_PASSWORD=${CELERY_REDIS_PASSWORD:-}
      - CELERY_BROKER_DB=0
      - CELERY_RESULT_DB=1
      - CELERY_BROKER_URL=${CELERY_BROKER_URL:-}
      - CELERY_RESULT_BACKEND=${CELERY_RESULT_BACKEND:-}
      - SKIP_AUTO_MIGRATE=true
      - DB_POOL_MIN=${DB_POOL_MIN:-2}
      - DB_POOL_MAX=${DB_POOL_MAX:-12}
      - DB_POOL_ACQUIRE_TIMEOUT=${DB_POOL_ACQUIRE_TIMEOUT:-10}
      - DB_POOL_HEALTH_CHECK=${DB_POOL_HEALTH_CHECK:-true}
      - MARKET_EXECUTOR_WORKERS=${MARKET_EXECUTOR_WORKERS:-6}
      - PORTFOLIO_EXECUTOR_WORKERS=${PORTFOLIO_EXECUTOR_WORKERS:-3}
      - RESOURCE_FD_COOLDOWN_SEC=${RESOURCE_FD_COOLDOWN_SEC:-180}
      - PORTFOLIO_MONITOR_DUE_BATCH_LIMIT=${PORTFOLIO_MONITOR_DUE_BATCH_LIMIT:-5}
      - GUNICORN_WORKERS=${GUNICORN_WORKERS:-2}
      - GUNICORN_THREADS=${GUNICORN_THREADS:-4}
      - ALLOW_LOCAL_DESKTOP_BROKERS=${ALLOW_LOCAL_DESKTOP_BROKERS:-true}
      - FRONTEND_URL=${FRONTEND_URL:-http://localhost:8888,http://localhost:8889}
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  trading-worker:
    <<: *backend-runtime
    image: ${BACKEND_IMAGE:-ghcr.io/openbyteinc/quantdinger-backend}:${BACKEND_TAG:-${IMAGE_TAG:-latest}}
    pull_policy: always
    container_name: quantdinger-trading-worker
    restart: unless-stopped
    command: ["python", "-m", "app.commands.trading_worker"]
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      migration:
        condition: service_completed_successfully
    volumes:
      - backend_logs:/app/logs
      - backend_data:/app/data
      - ./backend.env:/app/.env
    environment:
      - QD_PROCESS_ROLE=trading
      - LOG_FORMAT=${LOG_FORMAT:-json}
      - STRATEGY_COMMANDS_ENABLED=false
      - DATABASE_URL=postgresql://${POSTGRES_USER:-quantdinger}:${POSTGRES_PASSWORD:-quantdinger123}@postgres:5432/${POSTGRES_DB:-quantdinger}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - REDIS_PASSWORD=${REDIS_PASSWORD:-}
      - REDIS_CACHE_NAMESPACE=${REDIS_CACHE_NAMESPACE:-quantdinger:cache:v1}
      - CACHE_ENABLED=true
      - DB_POOL_MIN=${WORKER_DB_POOL_MIN:-2}
      - DB_POOL_MAX=${WORKER_DB_POOL_MAX:-12}
      - SKIP_AUTO_MIGRATE=true
      - ALLOW_LOCAL_DESKTOP_BROKERS=${ALLOW_LOCAL_DESKTOP_BROKERS:-true}
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD", "python", "-m", "app.commands.worker_health", "trading"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 30s

  scheduler-worker:
    <<: *backend-runtime
    image: ${BACKEND_IMAGE:-ghcr.io/openbyteinc/quantdinger-backend}:${BACKEND_TAG:-${IMAGE_TAG:-latest}}
    pull_policy: always
    container_name: quantdinger-scheduler-worker
    restart: unless-stopped
    command: ["python", "-m", "app.commands.scheduler"]
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      migration:
        condition: service_completed_successfully
    volumes:
      - backend_logs:/app/logs
      - backend_data:/app/data
      - ./backend.env:/app/.env
    environment:
      - QD_PROCESS_ROLE=scheduler
      - LOG_FORMAT=${LOG_FORMAT:-json}
      - DATABASE_URL=postgresql://${POSTGRES_USER:-quantdinger}:${POSTGRES_PASSWORD:-quantdinger123}@postgres:5432/${POSTGRES_DB:-quantdinger}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - REDIS_PASSWORD=${REDIS_PASSWORD:-}
      - REDIS_CACHE_NAMESPACE=${REDIS_CACHE_NAMESPACE:-quantdinger:cache:v1}
      - CACHE_ENABLED=true
      - DB_POOL_MIN=${WORKER_DB_POOL_MIN:-2}
      - DB_POOL_MAX=${WORKER_DB_POOL_MAX:-12}
      - SKIP_AUTO_MIGRATE=true
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD", "python", "-m", "app.commands.worker_health", "scheduler"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 30s

  celery-worker:
    <<: *backend-runtime
    image: ${BACKEND_IMAGE:-ghcr.io/openbyteinc/quantdinger-backend}:${BACKEND_TAG:-${IMAGE_TAG:-latest}}
    pull_policy: always
    container_name: quantdinger-celery-worker
    restart: unless-stopped
    command: ["celery", "-A", "app.celery_app:celery_app", "worker", "--loglevel=INFO", "-Q", "jobs,ai,maintenance", "--concurrency=${CELERY_CONCURRENCY:-2}"]
    depends_on:
      postgres:
        condition: service_healthy
      redis-jobs:
        condition: service_healthy
      migration:
        condition: service_completed_successfully
    volumes:
      - backend_logs:/app/logs
      - backend_data:/app/data
      - ./backend.env:/app/.env
    environment:
      - QD_PROCESS_ROLE=celery
      - LOG_FORMAT=${LOG_FORMAT:-json}
      - CELERY_TASKS_ENABLED=true
      - CELERY_REDIS_HOST=redis-jobs
      - CELERY_REDIS_PORT=6379
      - CELERY_REDIS_PASSWORD=${CELERY_REDIS_PASSWORD:-}
      - CELERY_BROKER_DB=0
      - CELERY_RESULT_DB=1
      - CELERY_BROKER_URL=${CELERY_BROKER_URL:-}
      - CELERY_RESULT_BACKEND=${CELERY_RESULT_BACKEND:-}
      - DATABASE_URL=postgresql://${POSTGRES_USER:-quantdinger}:${POSTGRES_PASSWORD:-quantdinger123}@postgres:5432/${POSTGRES_DB:-quantdinger}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - DB_POOL_MIN=${WORKER_DB_POOL_MIN:-2}
      - DB_POOL_MAX=${WORKER_DB_POOL_MAX:-12}
      - SKIP_AUTO_MIGRATE=true
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD", "python", "-m", "app.commands.worker_health", "celery"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 45s

  celery-beat:
    <<: *backend-runtime
    image: ${BACKEND_IMAGE:-ghcr.io/openbyteinc/quantdinger-backend}:${BACKEND_TAG:-${IMAGE_TAG:-latest}}
    pull_policy: always
    container_name: quantdinger-celery-beat
    restart: unless-stopped
    command: ["celery", "-A", "app.celery_app:celery_app", "beat", "--loglevel=INFO", "--schedule=/app/data/celerybeat-schedule"]
    depends_on:
      postgres:
        condition: service_healthy
      redis-jobs:
        condition: service_healthy
      migration:
        condition: service_completed_successfully
    volumes:
      - backend_logs:/app/logs
      - backend_data:/app/data
      - ./backend.env:/app/.env
    environment:
      - QD_PROCESS_ROLE=celery
      - LOG_FORMAT=${LOG_FORMAT:-json}
      - CELERY_REDIS_HOST=redis-jobs
      - CELERY_REDIS_PORT=6379
      - CELERY_REDIS_PASSWORD=${CELERY_REDIS_PASSWORD:-}
      - CELERY_BROKER_DB=0
      - CELERY_RESULT_DB=1
      - CELERY_BROKER_URL=${CELERY_BROKER_URL:-}
      - CELERY_RESULT_BACKEND=${CELERY_RESULT_BACKEND:-}
      - DATABASE_URL=postgresql://${POSTGRES_USER:-quantdinger}:${POSTGRES_PASSWORD:-quantdinger123}@postgres:5432/${POSTGRES_DB:-quantdinger}
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - DB_POOL_MIN=${WORKER_DB_POOL_MIN:-2}
      - DB_POOL_MAX=${WORKER_DB_POOL_MAX:-12}
      - SKIP_AUTO_MIGRATE=true
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD-SHELL", "kill -0 1"]
      interval: 30s
      timeout: 5s
      retries: 3

  frontend:
    # Tag resolution: FRONTEND_TAG > IMAGE_TAG > latest. See header comment.
    image: ${FRONTEND_IMAGE:-ghcr.io/openbyteinc/quantdinger-frontend}:${FRONTEND_TAG:-${IMAGE_TAG:-latest}}
    pull_policy: always
    container_name: quantdinger-frontend
    restart: unless-stopped
    ports:
      - "${FRONTEND_HOST:-127.0.0.1}:${FRONTEND_PORT:-8888}:80"
    environment:
      - BACKEND_URL=${BACKEND_URL:-http://backend:5000}
    depends_on:
      - backend
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  mobile:
    # Tag resolution: MOBILE_TAG > IMAGE_TAG > latest. See header comment.
    image: ${MOBILE_IMAGE:-ghcr.io/openbyteinc/quantdinger-mobile}:${MOBILE_TAG:-${IMAGE_TAG:-latest}}
    pull_policy: always
    container_name: quantdinger-mobile
    restart: unless-stopped
    ports:
      - "${MOBILE_HOST:-127.0.0.1}:${MOBILE_PORT:-8889}:80"
    environment:
      - BACKEND_URL=${BACKEND_URL:-http://backend:5000}
    depends_on:
      - backend
    networks:
      - quantdinger-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3

volumes:
  postgres_data:
    driver: local
  backend_logs:
    driver: local
  backend_data:
    driver: local
  celery_redis_data:
    driver: local

networks:
  quantdinger-network:
    driver: bridge