Split data-plane services into infra project

docker-compose.live.yml

@@ -4,8 +4,9 @@
 # existing 172.30.0.0/24 meshcore-analytics_default bridge with independently
 # managed beacon and Discord services. Treat that bridge as external so Compose
 # never tries to remove it, and reserve a high, collision-free range for the
-# analytics proxies. Fresh/CI deployments must continue to use only
-# docker-compose.yml and its isolated network.
+# analytics proxies. The long-lived data-plane services are provided by the
+# meshcore-infra project on this external network and must be healthy before the
+# application project is reconciled.
 services:
   backend:
     environment:

docker-compose.yml

@@ -32,126 +32,6 @@ x-application-hardening: &application-hardening
     - /tmp:rw,noexec,nosuid,size=64m,mode=1777
 
 services:
-  timescaledb:
-    image: timescale/timescaledb@sha256:22e8a5ae7aef121d1537afe946dd7cc5deeeb63ab36ce19849d671bd3b663509
-    restart: always
-    logging: *json-log-limits
-    mem_limit: "4g"
-    memswap_limit: "4g"
-    stop_grace_period: 2m
-    # The image currently tunes timescaledb.max_background_workers to 16.
-    # Leave headroom for the Timescale launcher/schedulers, logical replication,
-    # and a policy worker so scheduled jobs do not fail their first launch.
-    command:
-      - postgres
-      - -c
-      - max_connections=300
-      - -c
-      - max_worker_processes=${POSTGRES_MAX_WORKER_PROCESSES:-24}
-      - -c
-      - max_parallel_workers_per_gather=0
-    ports:
-      - "${INFRA_BIND_ADDRESS:-127.0.0.1}:5432:5432"
-    environment:
-      POSTGRES_DB: ${POSTGRES_DB:-meshcore}
-      POSTGRES_USER: ${POSTGRES_USER:-meshcore}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD required}
-    volumes:
-      - timescaledb_data:/var/lib/postgresql/data
-      - ./backend/src/db/schema/base.sql:/docker-entrypoint-initdb.d/001_schema.sql:ro
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-meshcore} -d ${POSTGRES_DB:-meshcore}"]
-      interval: 30s
-      timeout: 10s
-      retries: 10
-      start_period: 30s
-
-  mosquitto:
-    <<: *internal-hosts
-    image: eclipse-mosquitto@sha256:9cfdd46ad59f3e3e5f592f6baf57ab23e1ad00605509d0f5c1e9b179c5314d87
-    restart: always
-    logging: *json-log-limits
-    mem_limit: "128m"
-    memswap_limit: "128m"
-    ports:
-      - "${INFRA_BIND_ADDRESS:-127.0.0.1}:9001:9001"
-    healthcheck:
-      test: ["CMD-SHELL", "pgrep mosquitto >/dev/null && nc -z 127.0.0.1 9001"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
-      start_period: 10s
-    volumes:
-      - ./mosquitto:/mosquitto/config
-      - mosquitto_data:/mosquitto/data
-      - mosquitto_log:/mosquitto/log
-
-  mosquitto-reloader:
-    <<: *internal-hosts
-    image: ${MOSQUITTO_RELOADER_IMAGE:-meshcore-analytics-mosquitto-reloader:local}
-    build:
-      context: .
-      dockerfile: Dockerfile.mosquitto-reloader
-      args:
-        SOURCE_REVISION: ${SOURCE_REVISION:-local}
-    restart: always
-    logging: *json-log-limits
-    mem_limit: "64m"
-    memswap_limit: "64m"
-    pid: "service:mosquitto"
-    # Match the broker UID inside the shared PID namespace so SIGHUP can be
-    # delivered without granting CAP_KILL or root.
-    user: "1883:1883"
-    cap_drop:
-      - ALL
-    security_opt:
-      - no-new-privileges:true
-    read_only: true
-    environment:
-      OWNER_ACL_RELOAD_TOKEN: ${JWT_SECRET:?JWT_SECRET required}
-      MOSQUITTO_LOG_PATH: /mosquitto/log/mosquitto.log
-    volumes:
-      - mosquitto_log:/mosquitto/log
-    depends_on:
-      mosquitto:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2).read()"]
-      interval: 30s
-      timeout: 5s
-      retries: 5
-
-  redis:
-    <<: *internal-hosts
-    image: redis@sha256:8b81dd37ff027bec4e516d41acfbe9fe2460070dc6d4a4570a2ac5b9d59df065
-    restart: always
-    logging: *json-log-limits
-    mem_limit: "512m"
-    memswap_limit: "512m"
-    command:
-      - redis-server
-      - --requirepass
-      - ${REDIS_PASSWORD:?REDIS_PASSWORD required}
-      - --maxmemory
-      - 448mb
-      - --maxmemory-policy
-      - noeviction
-      - --appendonly
-      - "yes"
-      - --appendfsync
-      - everysec
-    environment:
-      REDIS_PASSWORD: ${REDIS_PASSWORD}
-    ports:
-      - "${INFRA_BIND_ADDRESS:-127.0.0.1}:6379:6379"
-    volumes:
-      - redis_data:/data
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli -a $REDIS_PASSWORD --no-auth-warning ping"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
-
   # Apply additive, versioned migrations once before the application starts.
   # Base schema creation remains in the database init hook for fresh volumes;
   # this service keeps existing volumes current while backend startup stays fast.
@@ -172,10 +52,6 @@ services:
       DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
       DATABASE_STATEMENT_TIMEOUT_MS: 0
       NODE_ENV: production
-    depends_on:
-      timescaledb:
-        condition: service_healthy
-
   backend:
     <<: *internal-hosts
     image: ${BACKEND_IMAGE:-meshcore-analytics-backend:local}
@@ -285,16 +161,8 @@ services:
       DATA_LIFECYCLE_RECEIPT_MAX_AGE_DAYS: ${DATA_LIFECYCLE_RECEIPT_MAX_AGE_DAYS:-7}
       NODE_ENV: production
     depends_on:
-      timescaledb:
-        condition: service_healthy
       db-migrate:
         condition: service_completed_successfully
-      redis:
-        condition: service_healthy
-      mosquitto:
-        condition: service_healthy
-      mosquitto-reloader:
-        condition: service_healthy
     ports:
       - "127.0.0.1:3000:3000"
     volumes:
@@ -348,12 +216,8 @@ services:
       PATH_LEARNING_RUN_DEADLINE_MS: ${PATH_LEARNING_RUN_DEADLINE_MS:-2700000}
       NODE_ENV: production
     depends_on:
-      timescaledb:
-        condition: service_healthy
       db-migrate:
         condition: service_completed_successfully
-      redis:
-        condition: service_healthy
 
   path-history-worker:
     <<: [*internal-hosts, *application-hardening]
@@ -390,12 +254,8 @@ services:
       PATH_MULTI_MAX_OBSERVERS: ${PATH_MULTI_MAX_OBSERVERS:-128}
       NODE_ENV: production
     depends_on:
-      timescaledb:
-        condition: service_healthy
       db-migrate:
         condition: service_completed_successfully
-      redis:
-        condition: service_healthy
 
     deploy:
       resources:
@@ -430,12 +290,8 @@ services:
       DATA_LIFECYCLE_RETENTION_TARGETS: ${DATA_LIFECYCLE_RETENTION_TARGETS:-}
       NODE_ENV: production
     depends_on:
-      timescaledb:
-        condition: service_healthy
       db-migrate:
         condition: service_completed_successfully
-      redis:
-        condition: service_healthy
     volumes:
       - timescaledb_data:/health-volumes/database:ro
       - redis_data:/health-volumes/redis:ro
@@ -495,12 +351,8 @@ services:
       DATABASE_SKIP_SCHEMA_INIT: "true"
       NODE_ENV: production
     depends_on:
-      timescaledb:
-        condition: service_healthy
       db-migrate:
         condition: service_completed_successfully
-      redis:
-        condition: service_healthy
       backend:
         condition: service_healthy
       link-worker:
@@ -546,12 +398,8 @@ services:
       retries: 12
       start_period: 20s
     depends_on:
-      timescaledb:
-        condition: service_healthy
       db-migrate:
         condition: service_completed_successfully
-      redis:
-        condition: service_healthy
 
   # Canonical whole-region RF calculator. HopReach owns propagation and
   # raster output; UK Mesh supplies only the internal data adapter, versioned
@@ -757,8 +605,6 @@ services:
     depends_on:
       mesh-health-check-data-init:
         condition: service_completed_successfully
-      mosquitto:
-        condition: service_healthy
     ports:
       - "127.0.0.1:3090:3090"
     volumes:
@@ -1154,10 +1000,6 @@ services:
       interval: 30s
       timeout: 5s
       retries: 5
-    depends_on:
-      timescaledb:
-        condition: service_healthy
-
   redis-exporter:
     <<: *internal-hosts
     image: oliver006/redis_exporter@sha256:4c8000eb3525e0f6ed1327499861e272fcce358a9e7a87dd9db74c44607e6d8e
@@ -1179,10 +1021,6 @@ services:
       interval: 30s
       timeout: 5s
       retries: 5
-    depends_on:
-      redis:
-        condition: service_healthy
-
   node-exporter:
     <<: *internal-hosts
     image: prom/node-exporter@sha256:d00a542e409ee618a4edc67da14dd48c5da66726bbd5537ab2af9c1dfc442c8a