prometheus/deploy/docker-compose.yml

# Standalone compose for prometheus.x on the Hephaestus VPS.
#
# The service attaches to Hephaestus's existing docker network
# (hephaestus_default), so Hephaestus's Caddy can route prometheus.x to
# `prometheus:3700` with no changes to Hephaestus itself other than one new
# block in its Caddyfile.
#
# One volume (`data`) holds the SQLite DB, the service's ed25519 signing
# key, uploads that passed scan, and the snapshot build output. Env lives
# in an .env file alongside this one; the ones below are the defaults and
# can be overridden.

name: prometheus

services:
  prometheus:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
    image: prometheus:latest
    restart: unless-stopped
    depends_on:
      clamav:
        condition: service_healthy
      s3d:
        condition: service_started
    environment:
      BNS_NETWORK: chipnet
      CLAMD_HOST: clamav
      CLAMD_PORT: "3310"
      ADMIN_PUBLISHER: ${ADMIN_PUBLISHER:-}
      VIRUSTOTAL_API_KEY: ${VIRUSTOTAL_API_KEY:-}
      PAYMENT_REQUIRED: ${PAYMENT_REQUIRED:-}
      PROMETHEUS_PAYMENT_ADDRESS: ${PROMETHEUS_PAYMENT_ADDRESS:-}
      PROMETHEUS_LISTING_FEE_USD: ${PROMETHEUS_LISTING_FEE_USD:-1}
      BNS_GATEWAY: ${BNS_GATEWAY:-}
      # Sia-backed storage: when set, scan-clean uploads are pushed to the
      # sidecar s3d and the submit UI pre-fills the download URL. The
      # endpoint points at the internal s3d container, not the public
      # internet; the publicBase is Prometheus's own hostname so download
      # URLs route through /dl/<sha256> here.
      PROMETHEUS_S3_ENDPOINT: ${PROMETHEUS_S3_ENDPOINT:-http://s3d:8000}
      PROMETHEUS_S3_ACCESS_KEY: ${PROMETHEUS_S3_ACCESS_KEY:-}
      PROMETHEUS_S3_SECRET: ${PROMETHEUS_S3_SECRET:-}
      PROMETHEUS_S3_BUCKET: ${PROMETHEUS_S3_BUCKET:-prometheus}
      PROMETHEUS_S3_PREFIX: ${PROMETHEUS_S3_PREFIX:-apps/}
      PROMETHEUS_PUBLIC_BASE: ${PROMETHEUS_PUBLIC_BASE:-https://prometheus.x}
    volumes:
      - data:/data
    networks:
      - prometheus-internal
      - hephaestus
    expose:
      - "3700"
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--spider", "http://127.0.0.1:3700/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

  # ClamAV runs as a sibling container on an internal network — only
  # Prometheus can reach it. First start downloads ~250 MB of signatures via
  # freshclam into a volume; subsequent starts reuse it.
  clamav:
    image: clamav/clamav:stable
    restart: unless-stopped
    environment:
      CLAMAV_NO_MILTERD: "true"
    volumes:
      - clamav-sigs:/var/lib/clamav
      # Overlay our clamd.conf so the stream/file/scan size limits are
      # raised from the image defaults (25 MB / 100 MB / 400 MB) to the
      # 2 GiB cap Prometheus itself enforces. Without this a 100-MB APK
      # scan comes back as "INSTREAM size limit exceeded".
      - ./clamd.conf:/etc/clamav/clamd.conf:ro
    networks:
      - prometheus-internal
    expose:
      - "3310"
    healthcheck:
      test: ["CMD-SHELL", "clamdcheck.sh || clamdscan --ping 2>/dev/null || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 10
      # Signature download on first start can take a few minutes.
      start_period: 5m

  # s3d sidecar — Sia S3 gateway. Serves the write side (Prometheus PUTs
  # scan-clean uploads here) and the read side (Prometheus /dl/<sha256>
  # proxies back out). Not exposed on the public network: the only clients
  # are Prometheus and the operator via docker exec.
  #
  # First-time setup is `deploy/setup-s3d.sh` which copies the Pithos
  # connection export's data folder in and writes a fresh s3d.yml.
  s3d:
    image: ghcr.io/siafoundation/s3d:latest
    restart: unless-stopped
    command: ["-api.s3", "0.0.0.0:8000"]
    environment:
      S3D_CONFIG_FILE: /data/s3d.yml
      S3D_DATA_DIR: /data
    volumes:
      # Bind mount — operator pre-seeds s3d.db + s3d.yml here before first
      # start. A named volume would hide the files from the host, making
      # the Pithos-export import awkward.
      - ./s3d-data:/data
    networks:
      - prometheus-internal
    expose:
      - "8000"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8000/ >/dev/null 2>&1 || true; exit 0"]
      interval: 60s
      timeout: 5s
      retries: 3

volumes:
  data:
  clamav-sigs:

networks:
  # Internal: only Prometheus + clamav. Clamd never exposed off this network.
  prometheus-internal:
    driver: bridge
  # External: shared with Hephaestus so its Caddy can route prometheus.x.
  hephaestus:
    external: true
    name: hephaestus_default