docker-compose.yml

x-common-env-vars:
  &common-env-vars
  DOCKERIZED: "True"
  REDIS_HOST: "redis"
  POSTGRES_HOST: "postgres"
  DJANGO_HOST: "django"
  NEXTJS_HOST: "nextjs"

x-backend-deps:
  &backend-deps
  postgres:
    condition: service_healthy
  redis:
    condition: service_healthy
  elasticsearch:
    condition: service_healthy

x-default:
  &default
  deploy:
    restart_policy:
      condition: "${DOCKER_DEFAULT_RESTART_POLICY:-unless-stopped}"
  environment:
    <<: *common-env-vars
  env_file: .env

x-django-default:
  &django-default
  <<: *default
  image: "ghcr.io/modularhistory/backend:${SHA:-latest}"
  depends_on:
    <<: *backend-deps
  env_file: .env
  environment:
    <<: *common-env-vars
  user: www-data

services:
  django:
    <<: *django-default
    command: gunicorn core.asgi:application --user www-data --bind 0.0.0.0:${DJANGO_PORT} -k uvicorn.workers.UvicornWorker --workers 9 --max-requests 100 --max-requests-jitter 50
    entrypoint: /.config/entrypoints/django
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl --fail http://localhost:${DJANGO_PORT}/healthcheck/ || exit 1"
        ]
      timeout: 7s
      interval: 30s
      retries: 3
      start_period: 60s
    ports:
      - "127.0.0.1:${DJANGO_PORT}:${DJANGO_PORT}"
    volumes:
      # NOTE: www-data must be granted permission to write to these directories
      # both in the container and on the host machine. Permissions to write in
      # the container are granted in Dockerfile.backend. Permissions to write on
      # the host machine must be granted manually; e.g.,
      #     sudo chown -R www-data:www-data .backups && sudo chmod g+w -R .backups
      - ./_volumes:/_volumes
      - ./.config:/.config
      - es_certs:${ELASTIC_CERTS_DIR}

  celery:
    <<: *django-default
    command: celery -A core worker --hostname=%h --loglevel=info -E
    entrypoint: /.config/entrypoints/celery
    environment:
      <<: *common-env-vars
      IS_CELERY: "True"
    healthcheck:
      test: celery -A core inspect ping -d celery@$$HOSTNAME
      timeout: 30s
      interval: 30s
      retries: 3
      start_period: 20s
    volumes:
      - ./_volumes:/_volumes
      - ./.config:/.config

  celery_beat:
    <<: *django-default
    command: celery -A core beat -l INFO --scheduler django_celery_beat.schedulers:DatabaseScheduler --pidfile /tmp/celerybeat.pid
    depends_on:
      <<: *backend-deps
      celery:
        condition: service_healthy
    healthcheck:
      test: [ "CMD-SHELL", "stat -t /tmp/celerybeat.pid || exit 1" ]
      timeout: 20s
      interval: 30s
      retries: 3
      start_period: 10s
    volumes:
      - ./.config:/.config

  create_es_certs:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.14.1
    environment:
      ELASTIC_PASSWORD: $ELASTIC_PASSWORD
    command: >
      bash -c '
        if [[ ! -f /certs/bundle.zip ]]; then
          bin/elasticsearch-certutil cert --silent --pem --in "${ELASTIC_CERTS_DIR}/instances.yml" -out /certs/bundle.zip;
          unzip /certs/bundle.zip -d /certs; 
        fi;
        chown -R 1000:0 /certs
      '
    user: "0"
    working_dir: /usr/share/elasticsearch
    volumes:
      - es_certs:/certs
      - ./.config/elasticsearch:${ELASTIC_CERTS_DIR}

  elasticsearch:
    <<: *default
    image: docker.elastic.co/elasticsearch/elasticsearch:7.14.1
    depends_on:
      create_es_certs:
        condition: service_completed_successfully
    environment:
      # https://www.elastic.co/guide/en/elasticsearch/reference/current/important-settings.html
      - node.name=modularhistory-es
      - cluster.name=es-docker-cluster
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms1536m -Xmx1536m"
      - xpack.ml.enabled=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=${ELASTIC_CERTS_DIR}/modularhistory-es/modularhistory-es.key
      - xpack.security.http.ssl.certificate_authorities=${ELASTIC_CERTS_DIR}/ca/ca.crt
      - xpack.security.http.ssl.certificate=${ELASTIC_CERTS_DIR}/modularhistory-es/modularhistory-es.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.certificate_authorities=${ELASTIC_CERTS_DIR}/ca/ca.crt
      - xpack.security.transport.ssl.certificate=${ELASTIC_CERTS_DIR}/modularhistory-es/modularhistory-es.crt
      - xpack.security.transport.ssl.key=${ELASTIC_CERTS_DIR}/modularhistory-es/modularhistory-es.key
      - xpack.security.http.ssl.client_authentication=optional
    expose:
      - "9200"
    healthcheck:
      test: curl --cacert ${ELASTIC_CERTS_DIR}/ca/ca.crt -s https://localhost:9200 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
      interval: 30s
      timeout: 10s
      retries: 5
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - es_data:/usr/share/elasticsearch/data
      - es_certs:${ELASTIC_CERTS_DIR}

  kibana:
    <<: *default
    image: docker.elastic.co/kibana/kibana:7.8.1
    depends_on:
      - elasticsearch
    environment:
      ELASTICSEARCH_URL: http://elasticsearch:9200
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
      ELASTICSEARCH_USERNAME: elastic
      # ELASTICSEARCH_PASSWORD: $ELASTIC_PASSWORD
    expose:
      - "5601"

  nextjs:
    <<: *default
    image: "ghcr.io/modularhistory/frontend:${SHA}"
    command: "npm run start"
    depends_on:
      - django
    environment:
      PORT: ${NEXTJS_PORT}
      NEXTAUTH_URL_INTERNAL: "http://nextjs:${NEXTJS_PORT}"
      NODE_ENV: "production"
    ports:
      - "127.0.0.1:${NEXTJS_PORT}:${NEXTJS_PORT}"
    volumes:
      - ./_volumes/static:/_volumes/static
      - ./_volumes/redirects:/_volumes/redirects

  redis:
    <<: *default
    image: redis
    command: redis-server /usr/local/etc/redis/redis.conf
    expose:
      - "6379"
    # TODO: https://stackoverflow.com/questions/47088261/restarting-an-unhealthy-docker-container-based-on-healthcheck
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 20s
      timeout: 10s
      retries: 3
      start_period: 20s
    volumes:
      - "data:/data"
      - ./.config/redis:/usr/local/etc/redis

  postgres:
    <<: *default
    image: postgres:14
    expose:
      - "5432"
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U postgres" ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./_volumes/db/init:/docker-entrypoint-initdb.d

  # redisinsight:
  #   image: redislabs/redisinsight:latest
  #   profiles: [ "debug" ]
  #   depends_on:
  #     - redis
  #   deploy:
  #     restart_policy:
  #       condition: "${DOCKER_DEFAULT_RESTART_POLICY:-unless-stopped}"
  #       max_attempts: 3
  #   env_file: .env
  #   environment:
  #     REDIS_HOSTS: "local:redis:6379"
  #   healthcheck:
  #     test:
  #       [
  #         "CMD-SHELL",
  #         "curl --fail http://localhost:8002/healthcheck/ || exit 1"
  #       ]
  #     timeout: 7s
  #     interval: 15s
  #     retries: 2
  #     start_period: 10s
  #   ports:
  #     - "127.0.0.1:${DJANGO_PORT}:${DJANGO_PORT}"
  #   volumes:
  #     - "redisinsight:/db"

  setup:
    image: "ghcr.io/modularhistory/backend:${SHA}"
    env_file: .env
    entrypoint: .config/entrypoints/setup
    command: exit 0
    working_dir: /media
    volumes:
      - .:/media

volumes:
  data: null
  postgres_data: null
  es_data: null
  es_certs: null
  # redisinsight: null