2e864e5b81
All checks were successful
CI / Unit & Component Tests (pull_request) Successful in 3m3s
CI / OCR Service Tests (pull_request) Successful in 16s
CI / Backend Unit Tests (pull_request) Successful in 2m42s
CI / fail2ban Regex (pull_request) Successful in 39s
CI / Compose Bucket Idempotency (pull_request) Successful in 57s
Replace with a cross-reference to DEPLOYMENT.md §4 now that the obs stack shipped as docker-compose.observability.yml. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
71 lines
3.3 KiB
Markdown
71 lines
3.3 KiB
Markdown
# Production Docker Compose & Infrastructure
|
||
|
||
This document covers VPS sizing, monthly cost, and the Hetzner ecosystem rationale. The compose file and Caddyfile that previously lived inline in this doc are now committed to the repo root.
|
||
|
||
> **Where to find the live files (after #497)**
|
||
> - Production compose: [`docker-compose.prod.yml`](../../docker-compose.prod.yml) (standalone, not an overlay)
|
||
> - Caddyfile: [`infra/caddy/Caddyfile`](../../infra/caddy/Caddyfile)
|
||
> - Deploy workflows: [`.gitea/workflows/nightly.yml`](../../.gitea/workflows/nightly.yml) and [`.gitea/workflows/release.yml`](../../.gitea/workflows/release.yml)
|
||
> - Bootstrap checklist, secrets, rollback procedure: [`docs/DEPLOYMENT.md`](../DEPLOYMENT.md)
|
||
|
||
The original spec in this doc proposed an overlay pattern (`docker compose -f docker-compose.yml -f docker-compose.prod.yml`) with MinIO disabled in production in favour of Hetzner Object Storage. That approach was retired in #497 in favour of a standalone prod compose that keeps MinIO self-hosted on the VPS. The Hetzner OBS migration is tracked as a future follow-up; the swap is three env vars + `mc mirror` once we decide to do it.
|
||
|
||
---
|
||
|
||
## Observability stack
|
||
|
||
The observability stack (Prometheus, Loki, Grafana, Tempo, GlitchTip) ships as a separate `docker-compose.observability.yml` alongside the main stack. Configuration lives under `infra/observability/`.
|
||
|
||
→ See [docs/DEPLOYMENT.md §4](../DEPLOYMENT.md#4-logs--observability) for the full setup procedure, service URLs, first-run steps, and env var reference.
|
||
|
||
---
|
||
|
||
## VPS Sizing Recommendations
|
||
|
||
### Recommended: Hetzner CX32
|
||
|
||
**Specs**: 4 vCPU, 8 GB RAM, 80 GB SSD · **Cost**: 17 EUR/mo
|
||
|
||
Sufficient for the application stack (Postgres, MinIO, OCR with `mem_limit: 12g`, backend, frontend, Caddy) on a CX32 today. Once the observability stack lands (Prometheus/Loki/Grafana/Alertmanager add ~2 GB) consider a CX42.
|
||
|
||
### When to Upgrade: Hetzner CX42
|
||
|
||
**Specs**: 8 vCPU, 16 GB RAM · **Cost**: 29 EUR/mo
|
||
|
||
Upgrade when:
|
||
- Observability stack adds memory pressure (Loki + Grafana with >30 days retention)
|
||
- OCR throughput needs scaling beyond a single-node Surya/Kraken setup
|
||
- Real user load profiled in Grafana shows response-time degradation
|
||
|
||
Never upgrade the VPS tier before profiling — most perceived performance issues are application bugs, not resource constraints.
|
||
|
||
---
|
||
|
||
## Monthly Cost Breakdown (production v1)
|
||
|
||
| Service | Cost |
|
||
|---|---|
|
||
| Hetzner CX32 VPS | 17.00 EUR |
|
||
| Hetzner DNS | 0.00 EUR |
|
||
| Hetzner SMTP relay | ~1.00 EUR |
|
||
| **Total** | **~18 EUR/mo** |
|
||
|
||
MinIO data lives on the VPS disk (no Object Storage line item yet). The Hetzner OBS migration would add ~5 EUR/mo at ~200 GB.
|
||
|
||
Equivalent SaaS stack: 200–300 EUR/mo.
|
||
|
||
---
|
||
|
||
## Hetzner Ecosystem Rationale
|
||
|
||
Everything possible runs on Hetzner. One provider, one bill, GDPR-compliant by default (German company, EU data centres).
|
||
|
||
| Service | Use today |
|
||
|---|---|
|
||
| **VPS (Cloud Servers)** | The whole application stack |
|
||
| **DNS** | Free, supports A/AAAA/CNAME/MX/TXT, API-accessible for Caddy ACME |
|
||
| **Firewall** | Network-level firewall (in addition to host `ufw`) |
|
||
| **Snapshots** | Quick VPS rollback after a bad deploy (0.013 EUR/GB/mo) |
|
||
| **SMTP relay** | Transactional email from `noreply@raddatz.cloud` |
|
||
| **Object Storage** | Not used today — MinIO stays on-VPS. Available when we decide to migrate |
|