docker-compose.yaml

---
# FOR DEVELOPMENT ONLY
services:
  crdb:
    image: "cockroachdb/cockroach:v26.2.5"
    command: "start-single-node --insecure --accept-sql-without-tls"
    restart: "unless-stopped"
    ports:
      - "26257:26257" # SQL
      - "8080:8080" # Admin UI
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health?ready=1"]
      interval: "3s"
      timeout: "3s"
      retries: 5
  crdb-init:
    image: "cockroachdb/cockroach:v26.2.5"
    depends_on:
      crdb:
        condition: "service_healthy"
    command: >
      sql --insecure --host=crdb:26257 -e "SET CLUSTER SETTING kv.rangefeed.enabled = true;"
    restart: "on-failure"
  migrate:
    depends_on:
      crdb-init:
        condition: "service_completed_successfully"
    build: "."
    container_name: "migrate"
    environment:
      - "SPICEDB_DATASTORE_ENGINE=cockroachdb"
      - "SPICEDB_DATASTORE_CONN_URI=postgresql://root@crdb:26257/defaultdb?sslmode=disable"
    command: "datastore migrate head"
    networks:
      - "default"
  # Envoy is used instead of nginx for gRPC load balancing. nginx balances at the
  # connection level: once a client opens an HTTP/2 connection, all RPCs on that
  # connection go to the same backend. Envoy speaks HTTP/2 to the backends and
  # balances individual RPCs across pods, which is required for even cache warming.
  envoy:
    image: "envoyproxy/envoy:v1.33-latest"
    ports:
      - "50051:50051" # grpc
      - "8443:8443" # http
    volumes:
      - "./development/envoy.yaml:/etc/envoy/envoy.yaml"
    command: "-c /etc/envoy/envoy.yaml"
    depends_on:
      spicedb-1:
        condition: "service_healthy"
      spicedb-2:
        condition: "service_healthy"
  spicedb-1:
    container_name: "spicedb-1"
    build: "."
    command: "serve"
    restart: "no"
    networks:
      default:
        # Shared DNS name resolving to every node, so each dispatcher's
        # hashring contains all nodes (as the Kubernetes resolver would).
        aliases:
          - "spicedb-dispatch"
    ports:
      - "9090" # prometheus metrics
      - "50051" # grpc endpoint
      - "8443" # http endpoint
      - "50053" # dispatch endpoint
    environment:
      - "SPICEDB_LOG_FORMAT=json"
      - "SPICEDB_LOG_LEVEL=info"
      - "SPICEDB_HTTP_ENABLED=true"
      - "SPICEDB_GRPC_PRESHARED_KEY=super-secret-key"
      - "SPICEDB_GRPC_SHUTDOWN_DRAIN_DELAY=2s"
      - "SPICEDB_DATASTORE_ENGINE=cockroachdb"
      - "SPICEDB_DATASTORE_CONN_URI=postgresql://root@crdb:26257/defaultdb?sslmode=disable"
      - "SPICEDB_DISPATCH_CLUSTER_ENABLED=true"
      - "SPICEDB_DISPATCH_UPSTREAM_ADDR=dns:///spicedb-dispatch:50053"
      - "SPICEDB_OTEL_PROVIDER=otlpgrpc"
      - "SPICEDB_OTEL_SAMPLE_RATIO=1"
      - "SPICEDB_TELEMETRY_ENDPOINT="
      - "SPICEDB_GRPC_LOG_REQUESTS_ENABLED=false"
      - "SPICEDB_GRPC_LOG_RESPONSES_ENABLED=false"
      - "SPICEDB_STREAMING_API_RESPONSE_DELAY_TIMEOUT=0s"
      - "SPICEDB_OTEL_ENDPOINT=otel-collector:4317"
      - "SPICEDB_OTEL_INSECURE=true"
      - "SPICEDB_ENABLE_PERFORMANCE_INSIGHT_METRICS=true"
    depends_on:
      migrate:
        condition: "service_completed_successfully"
      otel-collector:
        condition: "service_started"
    healthcheck:
      test: ["CMD", "/bin/grpc_health_probe", "-addr=localhost:50051"]
      interval: "5s"
      timeout: "30s"
      retries: 3
  spicedb-2:
    container_name: "spicedb-2"
    build: "."
    command: "serve"
    restart: "no"
    networks:
      default:
        # Shared DNS name resolving to every node, so each dispatcher's
        # hashring contains all nodes (as the Kubernetes resolver would).
        aliases:
          - "spicedb-dispatch"
    ports:
      - "9090" # prometheus metrics
      - "50051" # grpc endpoint
      - "8443" # http endpoint
      - "50053" # dispatch endpoint
    environment:
      - "SPICEDB_LOG_FORMAT=json"
      - "SPICEDB_LOG_LEVEL=info"
      - "SPICEDB_HTTP_ENABLED=true"
      - "SPICEDB_GRPC_PRESHARED_KEY=super-secret-key"
      - "SPICEDB_GRPC_SHUTDOWN_DRAIN_DELAY=2s"
      - "SPICEDB_DATASTORE_ENGINE=cockroachdb"
      - "SPICEDB_DATASTORE_CONN_URI=postgresql://root@crdb:26257/defaultdb?sslmode=disable"
      - "SPICEDB_DISPATCH_CLUSTER_ENABLED=true"
      - "SPICEDB_DISPATCH_UPSTREAM_ADDR=dns:///spicedb-dispatch:50053"
      - "SPICEDB_OTEL_PROVIDER=otlpgrpc"
      - "SPICEDB_OTEL_SAMPLE_RATIO=1"
      - "SPICEDB_TELEMETRY_ENDPOINT="
      - "SPICEDB_GRPC_LOG_REQUESTS_ENABLED=true"
      - "SPICEDB_GRPC_LOG_RESPONSES_ENABLED=false"
      - "SPICEDB_STREAMING_API_RESPONSE_DELAY_TIMEOUT=0s"
      - "SPICEDB_OTEL_ENDPOINT=otel-collector:4317"
      - "SPICEDB_OTEL_INSECURE=true"
      - "SPICEDB_ENABLE_PERFORMANCE_INSIGHT_METRICS=true"
    depends_on:
      migrate:
        condition: "service_completed_successfully"
      otel-collector:
        condition: "service_started"
    healthcheck:
      test: ["CMD", "/bin/grpc_health_probe", "-addr=localhost:50051"]
      interval: "5s"
      timeout: "30s"
      retries: 3
  prometheus:
    image: "prom/prometheus:v3.13.1"
    command:
      - "--config.file=/etc/prometheus/prometheus.yaml"
      - "--storage.tsdb.path=/prometheus"
    volumes:
      - "./development/prometheus.yaml:/etc/prometheus/prometheus.yaml"
    ports:
      - "9091:9090" # Prometheus UI
    restart: "unless-stopped"
  otel-collector:
    image: "otel/opentelemetry-collector:0.60.0"
    command: "--config /etc/otel-config.yaml"
    volumes:
      - "./development/otel-config.yaml:/etc/otel-config.yaml"
    ports:
      - "4317:4317" # OTLP gRPC
      - "8888" # Prometheus metrics for collector
    depends_on:
      - "tempo"
  loki:
    image: "grafana/loki:2.9.0"
    command: "-config.file=/etc/loki/loki.yaml"
    volumes:
      - "./development/loki.yaml:/etc/loki/loki.yaml"
    ports:
      - "3100" # Loki API
    restart: "unless-stopped"
  tempo:
    image: "grafana/tempo:1.5.0"
    command: "-search.enabled=true -config.file=/etc/tempo.yaml"
    volumes:
      - "./development/tempo.yaml:/etc/tempo.yaml"
    restart: "unless-stopped"
    ports:
      - "4317" # OTLP gRPC
      - "3100" # tempo
  grafana:
    image: "grafana/grafana:9.1.5-ubuntu"
    volumes:
      - "./development/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources"
      - "./development/grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards"
      - "./development/grafana/dashboards:/etc/grafana/dashboards"
    environment:
      - "GF_AUTH_ANONYMOUS_ENABLED=true"
      - "GF_AUTH_ANONYMOUS_ORG_ROLE=Admin"
      - "GF_AUTH_DISABLE_LOGIN_FORM=true"
    ports:
      - "3000:3000" # UI
    depends_on:
      - "tempo"
      - "prometheus"
      - "loki"