matitos
9c3bee87ac
FastAPI backend with a single-strategy async engine, paper and Binance brokers, pure-python indicators, a backtester that shares the engine's portfolio math, and a Vue dashboard with a live WebSocket feed. Adds the Gitea Actions CI/CD workflow that deploys to Traefik via docker_default.
101 lines
4.1 KiB
YAML
101 lines
4.1 KiB
YAML
name: crypto_trading
|
|
|
|
services:
|
|
backend:
|
|
build: ./backend
|
|
image: crypto_trading-backend
|
|
container_name: crypto-trading-backend
|
|
restart: unless-stopped
|
|
mem_limit: ${CRYPTO_MEM_LIMIT:-1g}
|
|
cpus: ${CRYPTO_CPUS:-2}
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
# Reachable only on the internal network; the frontend nginx proxies to it.
|
|
expose:
|
|
- "8000"
|
|
environment:
|
|
- MODE=${CRYPTO_MODE:-paper}
|
|
- EXCHANGE=${CRYPTO_EXCHANGE:-binance}
|
|
- SYMBOL=${CRYPTO_SYMBOL:-BTC/USDT}
|
|
- TIMEFRAME=${CRYPTO_TIMEFRAME:-1m}
|
|
- POLL_INTERVAL=${CRYPTO_POLL_INTERVAL:-5}
|
|
- STARTING_BALANCE=${CRYPTO_STARTING_BALANCE:-10000}
|
|
- FEE_BPS=${CRYPTO_FEE_BPS:-10}
|
|
- SLIPPAGE_BPS=${CRYPTO_SLIPPAGE_BPS:-5}
|
|
- DATABASE_URL=sqlite:////data/trader.db
|
|
- CORS_ORIGINS=${CRYPTO_CORS_ORIGINS:-*}
|
|
- EXCHANGE_API_KEY=${CRYPTO_EXCHANGE_API_KEY:-}
|
|
- EXCHANGE_API_SECRET=${CRYPTO_EXCHANGE_API_SECRET:-}
|
|
- EXCHANGE_SANDBOX=${CRYPTO_EXCHANGE_SANDBOX:-false}
|
|
volumes:
|
|
# Persist the SQLite database across releases. Prefer an absolute host
|
|
# path (CRYPTO_DATA_DIR / PERSISTENT_MOUNT); the repo-relative default
|
|
# can be cleaned by runner maintenance.
|
|
- ${CRYPTO_DATA_DIR:-./data}:/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/health', timeout=5).status==200 else 1)\""]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 20s
|
|
networks:
|
|
- internal
|
|
|
|
frontend:
|
|
build: ./frontend
|
|
image: crypto_trading-frontend
|
|
container_name: crypto-trading-frontend
|
|
restart: unless-stopped
|
|
mem_limit: ${CRYPTO_MEM_LIMIT:-1g}
|
|
cpus: ${CRYPTO_CPUS:-2}
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
depends_on:
|
|
backend:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:80/ || exit 1"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
networks:
|
|
- internal
|
|
- docker_default
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=docker_default"
|
|
- "traefik.http.routers.crypto-trading.rule=Host(`crypto.${BASE_DOMAIN:-matitos.org}`)"
|
|
- "traefik.http.routers.crypto-trading.entrypoints=websecure"
|
|
- "traefik.http.routers.crypto-trading.tls.certresolver=myresolvercd"
|
|
- "traefik.http.services.crypto-trading.loadbalancer.server.port=80"
|
|
# Basic auth on the WebUI (htpasswd), required: the stack refuses to
|
|
# start when CRYPTO_FRONTEND_AUTH_USERS is unset (no admin/admin
|
|
# fallback). A per-source rate limit reduces credential brute-forcing.
|
|
- "traefik.http.routers.crypto-trading.middlewares=crypto-trading-auth@docker,crypto-trading-sec@docker,crypto-trading-authlimit@docker"
|
|
- "traefik.http.middlewares.crypto-trading-auth.basicauth.users=${CRYPTO_FRONTEND_AUTH_USERS:?CRYPTO_FRONTEND_AUTH_USERS is required (htpasswd string, e.g. htpasswd -nbB user pass)}"
|
|
- "traefik.http.middlewares.crypto-trading-authlimit.ratelimit.average=${CRYPTO_AUTH_RATE_LIMIT_AVERAGE:-10}"
|
|
- "traefik.http.middlewares.crypto-trading-authlimit.ratelimit.burst=${CRYPTO_AUTH_RATE_LIMIT_BURST:-5}"
|
|
- "traefik.http.middlewares.crypto-trading-sec.headers.stsSeconds=31536000"
|
|
- "traefik.http.middlewares.crypto-trading-sec.headers.stsIncludeSubdomains=true"
|
|
- "traefik.http.middlewares.crypto-trading-sec.headers.forceSTSHeader=true"
|
|
- "traefik.http.middlewares.crypto-trading-sec.headers.contentTypeNosniff=true"
|
|
- "traefik.http.middlewares.crypto-trading-sec.headers.browserXssFilter=true"
|
|
- "traefik.http.middlewares.crypto-trading-sec.headers.frameDeny=true"
|
|
- "traefik.http.middlewares.crypto-trading-sec.headers.referrerPolicy=strict-origin-when-cross-origin"
|
|
|
|
networks:
|
|
internal:
|
|
docker_default:
|
|
external: true
|