docker-compose.prod.yml

networks:
  private:


volumes:
  # static_assets:
  certs:
  dbdata:
  ssl-acme-challenge:
  celerybeat-schedule:


services:
  django:
    image: '${IMAGE_REPO-docker.pkg.github.com/monashbioinformaticsplatform/laxy}/laxy:${LAXY_IMAGE_TAG-latest}'
    # user: laxy
    # We must specify the .env file so that it gets sourced - otherwise every variable in .env would
    # need to be explicitly defined like: LAXY_DEBUG=${LAXY_DEBUG} in the environment section below.
    env_file:
      - .env
    environment:
      - LAXY_DEBUG=no
      - LAXY_STATIC_ROOT=/usr/share/nginx/html/backend_static
      - LAXY_STATIC_URL=${LAXY_FRONTEND_URL-//laxy.io}/backend_static/
      # Number of gunicorn workers
      - WEB_CONCURRENCY=${WEB_CONCURRENCY-4}
    restart: unless-stopped
    deploy:
      mode: replicated
      replicas: 3
    # volumes:
    #   - static_assets:/usr/share/nginx/html
    # Internal Docker network only
    expose:
      - '8001'
    # Publicly accessible
    # ports:
    #   - "8001:8001"
    networks:
      - private
    command: bash -c "sleep 10 && python3 manage.py makemigrations --no-input && python3 manage.py migrate --no-input && gunicorn laxy.wsgi -b 0.0.0.0:8001 --forwarded-allow-ips='*' --worker-class gevent --timeout 240"

  dev-frontend-server:
    image: '${IMAGE_REPO-docker.pkg.github.com/monashbioinformaticsplatform/laxy}/laxy:${LAXY_IMAGE_TAG-latest}'
    restart: 'no'
    command: echo "Service disabled in prod (but still required to be defined to override the image name)"
  # If we wanted to do a ninja frontend rebuild into static_assets
  #    command: bash -c "curl -sL https://deb.nodesource.com/setup_12.x | bash - &&
  #                      apt install --yes nodejs &&
  #                      cd /app/laxy_frontend &&
  #                      rm -rf node_modules &&
  #                      mkdir node_modules &&
  #                      npm install &&
  #                      npm run build:prod"
  #    env_file:
  #      - .env
  #    volumes:
  #      - static_assets:/app/laxy_frontend/dist
  #      - ./.env:/app/.env

  db:
    env_file:
      - .env
    #    environment:
    #      - POSTGRES_USER="${POSTGRES_USER}"
    #      - POSTGRES_PASSWORD="${POSTGRES_PASSWORD}"
    #      - POSTGRES_DB="${POSTGRES_DB}"
    #      - PGDATA="${PGDATA}"
    restart: unless-stopped
    deploy:
      # We always place the db container on the manager node so it
      # will be located with it's persistent volume container 'dbdata'
      placement:
        constraints: [ node.role == manager ]
    networks:
      - private

  rabbitmq:
    environment:
      - RABBITMQ_DEFAULT_USER=user
      - RABBITMQ_DEFAULT_PASS=pass
    ports:
      # rabbitmq management port accessible on host for monitoring, debugging
      - "15672:15672"
    restart: unless-stopped
    deploy:
    networks:
      - private

  queue-high:
    image: '${IMAGE_REPO-docker.pkg.github.com/monashbioinformaticsplatform/laxy}/laxy:${LAXY_IMAGE_TAG-latest}'
    # user: laxy
    command:
      [
        "celery",
        "-A",
        "laxy",
        "worker",
        "-E",
        "-l",
        "info",
        "-Ofair",
        "--broker=${LAXY_BROKER_URL}",
        "--concurrency=2"
      ]
    stop_grace_period: 5m
    stop_signal: SIGTERM
    env_file:
      - .env
    environment:
      - LAXY_DEBUG=no
    # - DEBUGGER_PORT=21002
    # ports:
    #   # for use when remote debugging
    #     - "21002:21002"
    restart: unless-stopped
    deploy:
      mode: replicated
      replicas: 3
    networks:
      - private

  queue-low:
    image: '${IMAGE_REPO-docker.pkg.github.com/monashbioinformaticsplatform/laxy}/laxy:${LAXY_IMAGE_TAG-latest}'
    # user: laxy
    command:
      [
        "celery",
        "-A",
        "laxy",
        "worker",
        "-E",
        "-l",
        "info",
        "-Ofair",
        "--broker=${LAXY_BROKER_URL}",
        "-Q",
        "low-priority",
        "--concurrency=8"
      ]
    stop_grace_period: 5m
    stop_signal: SIGTERM
    env_file:
      - .env
    environment:
      - LAXY_DEBUG=no
    # - DEBUGGER_PORT=21002
    # ports:
    #   # for use when remote debugging
    #     - "21002:21002"
    restart: unless-stopped
    deploy:
      mode: replicated
      replicas: 5
    networks:
      - private

  celery-beat:
    image: '${IMAGE_REPO-docker.pkg.github.com/monashbioinformaticsplatform/laxy}/laxy:${LAXY_IMAGE_TAG-latest}'
    # user: laxy
    env_file:
      - .env
    environment:
      - LAXY_DEBUG=no
    networks:
      - private

  flower:
    image: '${IMAGE_REPO-docker.pkg.github.com/monashbioinformaticsplatform/laxy}/laxy:${LAXY_IMAGE_TAG-latest}'
    env_file:
      - .env
    environment:
      - LAXY_DEBUG=no
      # - FLOWER_BASIC_AUTH=${FLOWER_USER:?must_set_FLOWER_USER_env_var}:${FLOWER_PASS:?must_set_FLOWER_PASS_env_var}
    ports:
      - '5556:5556'
    networks:
      - private

  nginx:
    image: '${IMAGE_REPO-docker.pkg.github.com/monashbioinformaticsplatform/laxy}/laxy-static-nginx:${LAXY_IMAGE_TAG-latest}'
    command: >
      sh -c "
        until [ -f /certs/fullchain.pem ] && [ -f /certs/key.pem ]; do
          echo `date`': Waiting for SSL certificates ..';
          sleep 5;
        done;

        # Templating the nginx.conf in this way has proven fragile in practise, so disabled for the moment
        # in favor of an nginx.conf external to to the container (via a host-bind volume)
        # export LAXY_FRONTEND_HOST=`echo $LAXY_FRONTEND_URL | cut -f 2 -d ':' | sed 's/\/\///g'`
        # export LAXY_API_HOST=`echo $LAXY_FRONTEND_API_URL | cut -f 2 -d ':' | sed 's/\/\///g'`
        #
        # if [ ! -f /etc/nginx/nginx.conf ] || [ -w /etc/nginx/nginx.conf ]; then
        #   # NOTE: Double dollar sign $$ prevents docker-compose interpolating
        #   envsubst '$${LAXY_FRONTEND_HOST} $${LAXY_API_HOST}' </etc/nginx/nginx.conf.template >/etc/nginx/nginx.conf
        # fi

        /usr/sbin/nginx -g 'daemon off;'
      "
    ports:
      # we need port 80 so nginx can redirect to 443, also for Let's Encrypt http-01 challenge
      - '80:80'
      - '443:443'
    depends_on:
      - ssl-certs-cron
    networks:
      - private
    volumes:
      # - static_assets:/usr/share/nginx/html:ro
      # We need read-only access to /usr/share/nginx/html/.well-known/acme-challenge to serve this for
      # the Let's Encrypt http-01 challenge
      - ssl-acme-challenge:/usr/share/nginx/html/.well-known/:ro
      - certs:/certs:ro
      - ./nginx.conf:/etc/nginx/nginx.conf:ro

  ssl-certs-cron:
    image: '${IMAGE_REPO-docker.pkg.github.com/monashbioinformaticsplatform/laxy}/ssl-certs:latest'
    environment:
      # No quotes !
      - ACME_SSL_DOMAINS=${ACME_SSL_DOMAINS-laxy.io api.laxy.io}
      - LAXY_ADMIN_EMAIL=${LAXY_ADMIN_EMAIL-}
    # Run certificate renewel/creation on startup if missing. Then run crond in foreground forever.
    #    command: >
    #      /bin/bash -c "
    #        [[ ! -f /certs/key.pem ]] && \
    #        cron && \
    #        anacron && \
    #        touch /var/log/ssl-certs-cron.log && \
    #        tail -f /var/log/ssl-certs-cron.log
    #      "
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
    volumes:
      # we need to write access to /usr/share/nginx/html/.well-known/ for
      # Let's Encrypt the http-01 challenge (acme-challenge)
      - ssl-acme-challenge:/usr/share/nginx/html/.well-known/
      # - static_assets:/usr/share/nginx/html
      - certs:/certs

  splash:
    networks:
      - private

##
##  shell-notebook is disabled by default on prod, but can be enabled here
##  temporarily if required for specific debugging or manual data migration tasks
##
# Examine the logs to find the token to login to the Jupyter notebook
# (eg docker-compose logs -f docker-compose.yml -f docker-compose.dev.yml shell-notebook )
#  shell-notebook:
#    build:
#      context: .
#      dockerfile: ./docker/laxy/Dockerfile
#    environment:
#      - LAXY_DEBUG=no
#      - LAXY_SENTRY_DSN=
#    env_file:
#      - .env
#    ports:
#      - "8999:8999"
#    logging:
#      driver: "json-file"
#      options:
#        max-size: "100k"
#        max-file: "1"
#    depends_on:
#      - db
#    networks:
#      - private
#    command: bash -c "sleep 10 &&
#      pip3 install jupyter ipython ipykernel django-extensions &&
#      python3 manage.py shell_plus --notebook"