docker-compose.prod.yml

# Copyright (c) 2022, 2023 Humanitarian OpenStreetMap Team
# This file is part of FMTM.
#
#     FMTM is free software: you can redistribute it and/or modify
#     it under the terms of the GNU General Public License as published by
#     the Free Software Foundation, either version 3 of the License, or
#     (at your option) any later version.
#
#     FMTM is distributed in the hope that it will be useful,
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#     GNU General Public License for more details.
#
#     You should have received a copy of the GNU General Public License
#     along with FMTM.  If not, see <https:#www.gnu.org/licenses/>.
#

version: "3"

volumes:
  fmtm_db_data:
  central_db_data:
  traefik-public-certificates:

networks:
  fmtm-prod:

services:
  traefik:
    image: "docker.io/traefik:v2.8"
    container_name: fmtm_proxy
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "traefik-public-certificates:/certificates"
    ports:
      - 80:80
      - 443:443
    networks:
      - fmtm-prod
    restart: unless-stopped
    command:
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@hotosm.org"
      - "--certificatesresolvers.letsencrypt.acme.storage=/certificates/acme.json"
      ## Enable below for staging tests
      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=fmtm_fmtm-prod"
      - "traefik.api.dashboard=false"
      - "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.https_redirect.redirectscheme.permanent=true"
      - "traefik.http.routers.http_catchall.rule=HostRegexp(`{any:.+}`) && !PathPrefix(`/.well-known/acme-challenge/`)"
      - "traefik.http.routers.http_catchall.entrypoints=web"
      - "traefik.http.routers.http_catchall.middlewares=https_redirect"

  fmtm-db:
    image: "postgis/postgis:14-3.3-alpine"
    container_name: fmtm_db
    volumes:
      - fmtm_db_data:/var/lib/postgresql/data/
    environment:
      - POSTGRES_USER=${FMTM_DB_USER:-fmtm}
      - POSTGRES_PASSWORD=${FMTM_DB_PASSWORD:-fmtm}
      - POSTGRES_DB=${FMTM_DB_NAME:-fmtm}
    ports:
      - "5432:5432"
    networks:
      - fmtm-prod
    restart: unless-stopped

  api:
    image: "quay.io/hotosm/fmtm-backend:latest"
    build:
      context: src/backend
      target: prod
    container_name: fmtm_api
    depends_on:
      - fmtm-db
      - central-proxy
      - traefik
    env_file:
      - .env
    networks:
      - fmtm-prod
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.tls=true"
      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
      # The Go regex below requires escaping or changing, is this possible?
      # - "traefik.http.routers.api.rule=HostRegexp(`${API_URL}`, `{regex:[a-z]+\.[a-z].*}`)"
      - "traefik.http.routers.api.rule=Host(`fmtm-api.hotosm.org`)"
      - "traefik.http.services.api-svc.loadbalancer.server.port=8000"
      - "traefik.http.routers.api.service=api-svc"

  ui-main:
    image: "quay.io/hotosm/fmtm-mf-main:latest"
    build:
      context: src/frontend/main
    container_name: fmtm_main
    depends_on:
      - api
      - traefik
    networks:
      - fmtm-prod
    environment:
      - BROTLI=true
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ui-main.tls=true"
      - "traefik.http.routers.ui-main.tls.certresolver=letsencrypt"
      # The Go regex below requires escaping or changing, is this possible?
      # - "traefik.http.routers.ui-main.rule=HostRegexp(`${FRONTEND_MAIN_URL}`, `{regex:[a-z]+\.[a-z].*}`)"
      - "traefik.http.routers.ui-main.rule=Host(`fmtm.hotosm.org`)"
      - "traefik.http.services.ui-main-svc.loadbalancer.server.port=8080"
      - "traefik.http.routers.ui-main.service=ui-main-svc"

  ui-map:
    image: "quay.io/hotosm/fmtm-mf-map:latest"
    build:
      context: src/frontend/fmtm_openlayer_map
    container_name: fmtm_map
    depends_on:
      - api
      - traefik
    networks:
      - fmtm-prod
    environment:
      - BROTLI=true
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ui-map.tls=true"
      - "traefik.http.routers.ui-map.tls.certresolver=letsencrypt"
      # The Go regex below requires escaping or changing, is this possible?
      # - "traefik.http.routers.ui-map.rule=HostRegexp(`${FRONTEND_MAP_URL}`, `{regex:[a-z]+\.[a-z].*}`)"
      - "traefik.http.routers.ui-map.rule=Host(`map.fmtm.hotosm.org`)"
      - "traefik.http.services.ui-map-svc.loadbalancer.server.port=8080"
      - "traefik.http.routers.ui-map.service=ui-map-svc"

  central-db:
    image: postgis/postgis:14-3.3-alpine
    container_name: central_db
    volumes:
      - central_db_data:/var/lib/postgresql/data/
    environment:
      - POSTGRES_USER=${CENTRAL_DB_USER:-odk}
      - POSTGRES_PASSWORD=${CENTRAL_DB_PASSWORD:-odk}
      - POSTGRES_DB=${CENTRAL_DB_NAME:-odk}
    networks:
      - fmtm-prod
    restart: unless-stopped

  central:
    image: "quay.io/hotosm/odkcentral-api:latest"
    build:
      context: odkcentral/api
    container_name: central_api
    depends_on:
      - central-db
      - pyxform
    env_file:
      - .env
    networks:
      - fmtm-prod
    restart: unless-stopped

  central-proxy:
    image: "quay.io/hotosm/odkcentral-proxy:latest"
    build:
      context: odkcentral/proxy
    container_name: central_proxy
    depends_on:
      - central
    networks:
      - fmtm-prod
    restart: unless-stopped

  pyxform:
    image: "ghcr.io/getodk/pyxform-http:v1.10.1.1"
    container_name: central_pyxform
    networks:
      - fmtm-prod
    restart: always