name: argus

services:
  argus-hub:
    build:
      context: .
      dockerfile: Dockerfile.hub
    container_name: argus-hub
    restart: unless-stopped
    mem_limit: 192m
    cpus: "0.25"
    env_file:
      - .env
    environment:
      ARGUS_HUB_ADDR: ":8080"
      ARGUS_STORE_DRIVER: ${ARGUS_STORE_DRIVER:-postgres}
      ARGUS_STORE_DSN: ${ARGUS_STORE_DSN}
      ARGUS_RETENTION_LOGS: "72h"
      ARGUS_RETENTION_METRICS: "168h"
      ARGUS_RETENTION_EVENTS: "720h"
      ARGUS_PURGE_INTERVAL: "10m"
      ARGUS_PURGE_TIMEOUT: "30s"
      ARGUS_INGEST_CONCURRENCY: "8"
      GOMEMLIMIT: "160MiB"
    ports:
      - "8080:8080"

  argus-agent:
    build:
      context: .
      dockerfile: Dockerfile.agent
    container_name: argus-agent
    restart: unless-stopped
    mem_limit: 96m
    cpus: "0.15"
    env_file:
      - .env
    environment:
      ARGUS_HUB_URL: http://argus-hub:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Tracepoint attachment reads the tracefs events directory.
      - /sys/kernel/tracing:/sys/kernel/tracing:ro
      - argus-agent-buffer:/var/lib/argus/buffer
    group_add:
      - "989"
    # Kernel collector (ARGUS_EBPF). Harmless while the flag is off.
    cap_add:
      - BPF
      - PERFMON
      # Docker drops the cgroup-level bpf permission, so the fine-grained
      # capabilities alone cannot attach tracepoints inside a container.
      - SYS_ADMIN
    depends_on:
      argus-hub:
        condition: service_started

  argus-web:
    build:
      context: ./web
      dockerfile: Dockerfile
    container_name: argus-web
    restart: unless-stopped
    mem_limit: 64m
    cpus: "0.10"
    ports:
      - "3000:80"
    environment:
      ARGUS_AGENT_TOKEN: ${ARGUS_AGENT_TOKEN:-}
    depends_on:
      - argus-hub

volumes:
  argus-agent-buffer: