ca93cde06e
All checks were successful
CI / Unit & Component Tests (push) Successful in 3m18s
CI / OCR Service Tests (push) Successful in 21s
CI / Backend Unit Tests (push) Successful in 3m46s
CI / fail2ban Regex (push) Successful in 48s
CI / Semgrep Security Scan (push) Successful in 23s
CI / Compose Bucket Idempotency (push) Successful in 1m6s
Replace all references to the CX32 VPS (8 GB RAM, Hetzner Cloud) with the actual production server: a Hetzner Serverbörse dedicated server with an Intel Core i7-6700 (4C/8T, 3.4 GHz) and 64 GB RAM. Affected files: - .claude/personas/devops.md — monthly cost line + upgrade example - docs/infrastructure/production-compose.md — sizing section + cost table - docs/DEPLOYMENT.md — OCR memory table + OCR_MEM_LIMIT env var description - docs/adr/004-pdfbox-thumbnails.md — thumbnailExecutor memory ceiling note - docs/adr/021-tmpdir-persistent-volume-staging.md — OOMKill rationale in alternatives Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
65 lines
3.3 KiB
Markdown
65 lines
3.3 KiB
Markdown
# Production Docker Compose & Infrastructure
|
||
|
||
This document covers VPS sizing, monthly cost, and the Hetzner ecosystem rationale. The compose file and Caddyfile that previously lived inline in this doc are now committed to the repo root.
|
||
|
||
> **Where to find the live files (after #497)**
|
||
> - Production compose: [`docker-compose.prod.yml`](../../docker-compose.prod.yml) (standalone, not an overlay)
|
||
> - Caddyfile: [`infra/caddy/Caddyfile`](../../infra/caddy/Caddyfile)
|
||
> - Deploy workflows: [`.gitea/workflows/nightly.yml`](../../.gitea/workflows/nightly.yml) and [`.gitea/workflows/release.yml`](../../.gitea/workflows/release.yml)
|
||
> - Bootstrap checklist, secrets, rollback procedure: [`docs/DEPLOYMENT.md`](../DEPLOYMENT.md)
|
||
|
||
The original spec in this doc proposed an overlay pattern (`docker compose -f docker-compose.yml -f docker-compose.prod.yml`) with MinIO disabled in production in favour of Hetzner Object Storage. That approach was retired in #497 in favour of a standalone prod compose that keeps MinIO self-hosted on the VPS. The Hetzner OBS migration is tracked as a future follow-up; the swap is three env vars + `mc mirror` once we decide to do it.
|
||
|
||
---
|
||
|
||
## Observability stack
|
||
|
||
The observability stack (Prometheus, Loki, Grafana, Tempo, GlitchTip) ships as a separate `docker-compose.observability.yml` alongside the main stack. Configuration lives under `infra/observability/`.
|
||
|
||
→ See [docs/DEPLOYMENT.md §4](../DEPLOYMENT.md#4-logs--observability) for the full setup procedure, service URLs, first-run steps, and env var reference.
|
||
|
||
---
|
||
|
||
## Server Sizing
|
||
|
||
### Current Production Server: Hetzner Dedicated (Serverbörse)
|
||
|
||
**Specs**: Intel Core i7-6700 (4C/8T, 3.4 GHz), 64 GB RAM · acquired via Hetzner server auction
|
||
|
||
Comfortably handles the full application stack (Postgres, MinIO, OCR with `mem_limit: 12g`, backend, frontend, Caddy, full observability stack) with headroom to spare. The 64 GB RAM means OCR, Ollama inference, and the observability stack can all run concurrently without memory pressure.
|
||
|
||
### When to Reconsider Hardware
|
||
|
||
- CPU is Skylake (2015) — single-threaded performance is the likely bottleneck before RAM
|
||
- Profile with Grafana dashboards before concluding hardware is the constraint
|
||
- Most perceived performance issues are application bugs (unindexed queries, N+1 loads), not resource limits
|
||
|
||
---
|
||
|
||
## Monthly Cost Breakdown (production v1)
|
||
|
||
| Service | Cost |
|
||
|---|---|
|
||
| Hetzner dedicated server (Serverbörse, i7-6700, 64 GB RAM) | see invoice |
|
||
| Hetzner DNS | 0.00 EUR |
|
||
| Hetzner SMTP relay | ~1.00 EUR |
|
||
|
||
MinIO data lives on the server disk (no Object Storage line item yet). The Hetzner OBS migration would add ~5 EUR/mo at ~200 GB.
|
||
|
||
Equivalent SaaS stack: 200–300 EUR/mo.
|
||
|
||
---
|
||
|
||
## Hetzner Ecosystem Rationale
|
||
|
||
Everything possible runs on Hetzner. One provider, one bill, GDPR-compliant by default (German company, EU data centres).
|
||
|
||
| Service | Use today |
|
||
|---|---|
|
||
| **VPS (Cloud Servers)** | The whole application stack |
|
||
| **DNS** | Free, supports A/AAAA/CNAME/MX/TXT, API-accessible for Caddy ACME |
|
||
| **Firewall** | Network-level firewall (in addition to host `ufw`) |
|
||
| **Snapshots** | Quick VPS rollback after a bad deploy (0.013 EUR/GB/mo) |
|
||
| **SMTP relay** | Transactional email from `noreply@raddatz.cloud` |
|
||
| **Object Storage** | Not used today — MinIO stays on-VPS. Available when we decide to migrate |
|