Standard patterns for all Compose-managed stacks in the VeriPath ecosystem.
All stacks that need to communicate with the GP booking app must use the shared external network:
networks:
gp_booking_network:
external: true
name: gp_booking_app_gp_booking_network
Do not define a new bridge network unless the stack is fully isolated.
Every service must use the standard logging YAML anchor:
x-logging: &default-logging
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
Applied to each service as:
services:
myservice:
logging: *default-logging
curl -f http://localhost:PORT/path/pg_isready -U user -d dbnameredis-cli pingnginx -tnc -z localhost PORTAll healthchecks must have interval, timeout, retries, and start_period defined.
| Service Type | CPU | Memory |
|---|---|---|
| Django app | 1.0 | 1G |
| Celery worker | 1.0 | 1G |
| Celery beat | 0.5 | 512M |
| PostgreSQL (main) | 1.5 | 2G |
| PostgreSQL (client) | 1.0 | 1G |
| Redis | 0.5 | 256M |
| Nginx reverse proxy | 0.25 | 128M |
| LiveKit | 1.0 | 512M |
| ERPNext web | 1.0 | 1G |
| ERPNext worker | 1.0 | 1G |
| ERPNext DB | 1.0 | 1.5G |
| Utility/stats services | 0.25-0.5 | 128-256M |
Set via deploy.resources.limits.
Never hardcode secrets. Use a .env file in the stack directory (gitignored):
services:
app:
env_file:
- ./.env
environment:
- CELERY_BROKER_URL=redis://:${REDIS_PASSWORD}@redis:6379/0
The .env file must never be committed. Use variable substitution in Compose files.
All exposed ports must bind to 127.0.0.1 only — never 0.0.0.0 — unless there is a specific reason for external access.
| Port | Service | Stack |
|---|---|---|
| 5433 | PostgreSQL (main) | GP Booking |
| 5434 | PostgreSQL (SIAAS) | GP Booking |
| 5436 | PostgreSQL (ERPNext) | ERPNext |
| 6379 | Redis | GP Booking |
| 3000 | Forgejo web | Forgejo |
| 3002 | Wiki.js | Wiki |
| 3050 | Forgejo API | Forgejo |
| 3051 | Webhooks | Forgejo |
| 3443 | Wiki.js (alt) | Wiki |
| 8000 | Django app | GP Booking |
| 8001 | AES PKI | AES |
| 8002 | AES TSA | AES |
| 8003 | AES Signer | AES |
| 8004 | AES Portal | AES |
| 8005 | ERPNext web | ERPNext |
| 8006 | Security Dashboard | Security |
| 8080 | DefectDojo nginx | DefectDojo |
| 8081 | Patient Portal | Portal |
| 8082 | Roundcube | |
| 8443 | Keycloak | Auth |
| 7880-7881 | LiveKit | GP Booking |
| 9000 | MinIO | Infra |
| 1025 | MailHog SMTP | Dev |
| 8025 | MailHog UI | Dev |
All proxy_pass directives must target 127.0.0.1:PORT — never internal Docker IPs (172.x.x.x).
# Rebuild and restart a single stack
cd /path/to/stack/
docker compose build
docker compose up -d
# Check health
docker compose ps
docker compose logs --tail=20