chore(docker): add OpenSearch service to compose

Single-node cluster with the security plugin disabled (in-cluster HTTP
only). jetstream and api now depend on it being healthy and receive
OPENSEARCH_URL via env.

docker-compose.yml

@@ -6,6 +6,27 @@ services:
     volumes:
       - ${DATA_VOLUME:-data}:/data
 
+  opensearch:
+    image: opensearchproject/opensearch:2.18.0
+    restart: unless-stopped
+    environment:
+      - discovery.type=single-node
+      - DISABLE_SECURITY_PLUGIN=true
+      - OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m
+    volumes:
+      - ${OPENSEARCH_VOLUME:-opensearch-data}:/usr/share/opensearch/data
+    expose:
+      - "9200"
+    healthcheck:
+      test: [
+        "CMD-SHELL",
+        "curl -fs http://localhost:9200/_cluster/health || exit 1",
+      ]
+      interval: 30s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+
   jetstream:
     build: .
     restart: unless-stopped
@@ -13,6 +34,10 @@ services:
     depends_on:
       migrate:
         condition: service_completed_successfully
+      opensearch:
+        condition: service_healthy
+    environment:
+      - OPENSEARCH_URL=http://opensearch:9200
     volumes:
       - ${DATA_VOLUME:-data}:/data
 
@@ -23,6 +48,10 @@ services:
     depends_on:
       migrate:
         condition: service_completed_successfully
+      opensearch:
+        condition: service_healthy
+    environment:
+      - OPENSEARCH_URL=http://opensearch:9200
     expose:
       - "8080"
     volumes:
@@ -36,3 +65,4 @@ services:
 
 volumes:
   data:
+  opensearch-data: