docker-compose.yaml

# ===========================================================================================
# PRE-REQUISITE:
#   This docker-compose script depends on one file on the host machine: ~/.kube/config
#   This is obtained by logging into https://portal.nrp-nautlius.io and clicking "Get Config".
#   You must have access to the braingeneers namespace. If you don't have access see the
#   wiki Permissions page or Onboarding page for instructions.
#
# BUG WARNING:
#   Define environment variables using dictionary form, don't use "=". Although it's
#   legal yaml syntax the nginx-proxy service will not work correctly when it parses the services.secrets:
#   follow the example in the whoami demo service.
#
#   Do this:
#     environment:
#       VIRTUAL_HOST: "whoami.braingeneers.gi.ucsc.edu"
#
#    Don't do this:
#      environment:
#        - VIRTUAL_HOST=whoami.braingeneers.gi.ucsc.edu
# ===========================================================================================

services:

  # The secret-fetcher container retrieves all secrets in the `braingeneers` namespace on kubernetes.
  # The files are saved to a shared volume typically mounted at `/secrets`. So for example, the AWS credentials
  # file would be found at `/secrets/prp-s3-credentials/credentials`.
  # The secret-fetcher container is typically a dependency of other containers that need access to the secrets.
  secret-fetcher:
    image: braingeneers/secret-fetcher:latest
    container_name: secret-fetcher
    user: root
    restart: unless-stopped
    volumes:
      - ~/.kube/config:/.kube/config
      - secrets:/secrets
    networks:
      - braingeneers-net
    healthcheck:
      test: ["CMD", "/healthcheck.sh"]
      interval: 5s
      timeout: 5s
      retries: 120  # Retries allows for max of 10 minutes for secrets to be fetched before service is permanently marked as unhealthy

  # MQTT broker
  mqtt:
    image: braingeneers/mqtt:latest   # derived from emqx/emqx:5.0.4
    container_name: mqtt
    restart: unless-stopped
    ports:
      - "1883:1883"
      - "8083:8083"
      - "8883:8883"
      - "8084:8084"
      - "18083:18083"
    environment:
      EMQX_NAME: braingeneers_emqx
      EMQX_HOST: 127.0.0.1
    networks:
      braingeneers-net:
        aliases:
          - mqtt.braingeneers.gi.ucsc.edu

  # Provides a web interface and REST API for generating JWT tokens for service accounts.
  service-accounts:
    build:
      context: ./service-accounts
      dockerfile: Dockerfile
    container_name: service-accounts
    restart: unless-stopped
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--env'
      - '/secrets/service-accounts/service-accounts.env'
      - '/bin/bash'
      - '-c'
      - 'python /app/token_service.py'
    volumes:
      - ./service-accounts/app:/app
      - secrets:/secrets
    depends_on:
      secret-fetcher:
        condition: service_healthy
    environment:
      VIRTUAL_HOST: "service-accounts.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "80"
      LETSENCRYPT_HOST: "service-accounts.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    networks:
      - braingeneers-net

  # This is a proxy service that auto discovers other services that have env variables:
  # VIRTUAL_HOST, VIRTUAL_PORT, LETSENCRYPT_HOST, LETSENCRYPT_EMAIL set. It also forces authentication through
  # oauth2_proxy. The service-proxy container is used to route traffic to the appropriate service based on the domain name.
  service-proxy:
    image: nginxproxy/nginx-proxy:latest
    container_name: service-proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8080:80"
      - "8443:443"
    volumes:
      - vol-certs:/etc/nginx/certs
      - vol-vhost:/etc/nginx/vhost.d
      - vol-html:/usr/share/nginx/html
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./service-proxy/default:/etc/nginx/vhost.d/default:ro
      - ./service-proxy/auth.braingeneers.gi.ucsc.edu:/etc/nginx/vhost.d/auth.braingeneers.gi.ucsc.edu:ro
      - ./service-proxy/mxvisuals.braingeneers.gi.ucsc.edu:/etc/nginx/vhost.d/mxvisuals.braingeneers.gi.ucsc.edu:ro
      - ./service-proxy/mxvisuals-backend.braingeneers.gi.ucsc.edu:/etc/nginx/vhost.d/mxvisuals-backend.braingeneers.gi.ucsc.edu:ro
    networks:
      - braingeneers-net

  # The oauth2_proxy container is used to authenticate users to cilogon.org before they can access braingeneers services.
  oauth2-proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:latest-alpine
    container_name: oauth2-proxy
    restart: unless-stopped
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--env'
      - '/secrets/oauth2-proxy/oauth2.env'
      - '/bin/sh'
      - '-c'
      - '/bin/oauth2-proxy --config=/etc/oauth2-proxy/oauth2-proxy.cfg'
    networks:
      - braingeneers-net
    environment:
      VIRTUAL_HOST: "auth.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "4180"
      LETSENCRYPT_HOST: "auth.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    volumes:
      - ./oauth2-proxy/oauth2-proxy.cfg:/etc/oauth2-proxy/oauth2-proxy.cfg
      - ./oauth2-proxy/error.html:/etc/oauth2_custom_templates/error.html
      - secrets:/secrets
    depends_on:
      secret-fetcher:
        condition: service_healthy

#  # The nginx-proxy container is used to route traffic to the appropriate service based on the domain name.
#  nginx-proxy:
#    image: jwilder/nginx-proxy:latest  # braingeneers/nginx-proxy:latest  # derived from jwilder/nginx-proxy:latest
#    container_name: nginx-proxy
#    restart: unless-stopped
#    volumes:
#      - vol-certs:/etc/nginx/certs  # Cache SSL certificates on the host
#      - vol-vhost:/etc/nginx/vhost.d
#      - vol-html:/usr/share/nginx/html
#      - /var/run/docker.sock:/tmp/docker.sock:ro  # Unix socket mount to access docker API read-only
#    networks:
#      - braingeneers-net
##    environment:
##      DEBUG: "true"
##      VERBOSE: "true"
##      FORCE_INTERVAL: 15s
##      LETSENCRYPT_HOST: braingeneers.gi.ucsc.edu
##      LETSENCRYPT_EMAIL: braingeners-admins-group@ucsc.edu
##      LETSENCRYPT_TEST: "false"
##      DEFAULT_HOST: braingeneers.gi.ucsc.edu
##      DEFAULT_PORT: "8080"
#    ports:
#      - "80:80"
#      - "443:443"

  # Debugging container to test nginx-proxy
  whoami:
    image: jwilder/whoami
    expose:
      - "8000"
    environment:
      VIRTUAL_HOST: "whoami.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "8000"
      LETSENCRYPT_HOST: "whoami.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    networks:
      - braingeneers-net

  # Ella's website (maxwell related)
  mxvisuals:
#    image: davidparks21/mxvisuals-frontend:3.0
    image: mirellameelo/visualsmaxwell-frontend:v2.0
    container_name: mxvisuals
    expose:
      - "3000"
    restart: unless-stopped
    environment:
      VIRTUAL_HOST: "mxvisuals.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "3000"
      LETSENCRYPT_HOST: "mxvisuals.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    networks:
      - braingeneers-net

  # Ella's website (maxwell related)
  mxvisuals-backend:
#    image: davidparks21/mxvisuals-backend:3.0
    image: mirellameelo/visualsmaxwell-backend:v1.6
    container_name: mxvisuals-backend
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    restart: unless-stopped
    command:
      - "--copy"
      - "/secrets/prp-s3-credentials/credentials:/home/jovyan/.aws/credentials"
      - "--copy"
      - "/secrets/service-accounts/config.json:/opt/conda/lib/python3.10/site-packages/braingeneers/iot/service_account/config.json"
      - "python3"
      - "-u"
      - "app.py"
    expose:
      - "5000"
    environment:
      DEBUG: "true"
      VIRTUAL_HOST: "mxvisuals-backend.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "5000"
      LETSENCRYPT_HOST: "mxvisuals-backend.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    networks:
      - braingeneers-net
    volumes:
      - secrets:/secrets
    depends_on:
      secret-fetcher:
        condition: service_healthy

  # The letsencrypt container is used to automatically generate SSL certificates for the domain names.
  # https://github.com/jwilder/docker-letsencrypt-nginx-proxy-companion
  letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    container_name: letsencrypt
    environment:
      VIRTUAL_HOST: "ssl.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "80"
      LETSENCRYPT_HOST: "ssl.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
      NGINX_PROXY_CONTAINER: "service-proxy"
      LETSENCRYPT_TEST: "false"   # true | false for debugging | production (remember to set corresponding value in NGINX)
      DEBUG: "0"   # 1 | 0 for debugging | production (remember to set corresponding value in nginx-proxy)
      # ACME_CA_URI: "https://acme-staging-v02.api.letsencrypt.org/directory"    # comment out for production use
    restart: unless-stopped
    volumes:
      - vol-certs:/etc/nginx/certs:rw  # Shared with nginx-proxy
      - vol-vhost:/etc/nginx/vhost.d
      - vol-html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro  # Unix socket mount to access docker API read-only
    depends_on:
      - service-proxy
    networks:
      - braingeneers-net

  # The dashboard container is used to host the braingeneers dashboard.
  dashboard:
    image: quay.io/ucsc_cgl/brain_dashboard:1.5
    container_name: dashboard
    expose:
      - "8050"
    restart: unless-stopped
    environment:
      VIRTUAL_HOST: "dashboard.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "8050"
      LETSENCRYPT_HOST: "dashboard.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeners-admins-group@ucsc.edu"
    networks:
      - braingeneers-net
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - secrets:/secrets

  # Slack bridge service, replicates messages between Slack and MQTT
  # Documentation: https://github.com/braingeneers/wiki/blob/main/api_data/slack-bridge.md
  slack-bridge:
    image: braingeneers/service-slack-bridge:latest
    container_name: slack-bridge
    ports:
      - "3000:3000"
    networks:
      - braingeneers-net
    restart: unless-stopped
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - secrets:/secrets

  # Shadows frontend web service maintained by Pierre
  shadows-vue:
    container_name: shadows_frontend
    build: shadows_vue/
    image: shadows_viewer:latest
    restart: unless-stopped
    networks:
      - braingeneers-net
    environment:
      VIRTUAL_HOST: "datahub.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "80"
      LETSENCRYPT_HOST: "datahub.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
      VUE_APP_API_ENDPOINT: "https://braingeneers.gi.ucsc.edu/shadows"
      VUE_APP_API_AUTH_ENDPOINT: "https://braingeneers.gi.ucsc.edu/shadows"
      VUE_APP_S3_ENDPOINT: "https://s3-west.nrp-nautilus.io"

  # picroscope experiment control console
  # plotly dash
  picroscope-console:
    build:  plotly-dash-picroscope-control-console/ 
    container_name: plotly-picroscope-console
    networks:
      - braingeneers-net
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--copy'
      - '/secrets/picroscope-console-user-credentials/users.py:/console/users.py'
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '/bin/bash'
      - '-c'
      - 'python app.py'
    environment:
      VIRTUAL_HOST: "picroscope.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "8050"
      LETSENCRYPT_HOST: "picroscope.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - ./plotly-dash-picroscope-control-console/.env:/console/.env
      - secrets:/secrets
    restart: unless-stopped

  shadows-db:
    container_name: strapi-shadows-db
    build: strapi-shadows-db/
    image: mystrapi:latest
    restart: unless-stopped
    networks:
     - braingeneers-net
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--copy'
      - '/secrets/strapi-shadows-db/strapi_shadows_db.env:/opt/app/.env'
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '--env'
      - '/secrets/strapi-shadows-db/strapi_shadows_db.env'
      - '/bin/bash'
      - '-c'
      - 'echo "app keys and salt: $$APP_KEYS $$API_TOKEN_SALT" && cron && npm run develop'
    environment:
      VIRTUAL_HOST: "shadows-db.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "1337"
      LETSENCRYPT_HOST: "shadows-db.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - secrets:/secrets
      - vol-strapi-shadows-db:/opt/app/.tmp
      - ./strapi-shadows-db/config:/opt/app/config
      - ./strapi-shadows-db/src:/opt/app/src
      - ./strapi-shadows-db/package.json:/opt/package.json
      - ./strapi-shadows-db/package-lock.json:/opt/package-lock.json

  # job-launcher launches NRP jobs based on MQTT messages see repo mqtt_job_listener
  job-launcher:
    image: braingeneers/job-launcher:latest
    container_name: job-launcher
    networks:
      - braingeneers-net
    restart: unless-stopped
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - secrets:/secrets

  # Redis service
  redis:
    image: braingeneers/redis:latest
    container_name: redis
    networks:
      braingeneers-net:
        aliases:
          - redis.braingeneers.gi.ucsc.edu
    restart: unless-stopped
    volumes:
      - secrets:/secrets
    depends_on:
      secret-fetcher:
        condition: service_healthy
    ports:
     - "6379:6379"

  # Centralizes MQTT messages of the "telemetry" topic to s3; maintainer: lblauvel@ucsc.edu
  mqtt-logging-s3:
    image: quay.io/ucsc_cgl/mqtt-logging-s3:latest
    restart: unless-stopped
    volumes:
      - secrets:/secrets
    networks:
      - braingeneers-net
    depends_on:
      secret-fetcher:
        condition: service_healthy

  # Checks s3 for log files and combines them on a schedule; maintainer: lblauvel@ucsc.edu
  mqtt-logging-s3-aggregator:
    image: quay.io/ucsc_cgl/mqtt-logging-s3-aggregator:latest
    restart: unless-stopped
    volumes:
      - secrets:/secrets
    networks:
      - braingeneers-net
    depends_on:
      secret-fetcher:
        condition: service_healthy

  # Listens to MQTT and launches workflows on the "start/workflow" topic; maintainer: lblauvel@ucsc.edu
  nextflow-launcher:
    image: quay.io/ucsc_cgl/nextflow-launcher:latest
    container_name: nextflow-launcher
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '--copy'
      - '/secrets/nextflow-service-account/kube-config:/root/.kube/config'
      - 'python3.11'
      - '/usr/local/bin/run.py'
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - secrets:/secrets
      - /workflows:/workflows
    networks:
      - braingeneers-net
    restart: unless-stopped

  rustdesk-hbbs:
    container_name: rustdesk-hbbs
    ports:
      - 21115:21115
      - 21116:21116
      - 21116:21116/udp
      - 21118:21118
    image: braingeneers/rustdesk-server:latest
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '--copy'
      - '/secrets/rustdesk-credentials/id_ed25519:/root/.ssh/id_ed25519'
      - '--copy'
      - '/secrets/rustdesk-credentials/id_ed25519.pub:/root/.ssh/id_ed25519.pub'
      - '/usr/bin/bash'
      - '-c'
      - 'hbbs -r rustdesk.example.com:21117'
    volumes:
#      - rustdesk-data:/root/db_v2.sqlite3
#      - rustdesk-data:/root/db_v2.sqlite3-shm
#      - rustdesk-data:/root/db_v2.sqlite3-wal
      - rustdesk-data:/root/rustdesk-data
      - secrets:/secrets
    networks:
      - braingeneers-net
    depends_on:
      rustdesk-hbbr:
        condition: service_started
      secret-fetcher:
        condition: service_healthy
    restart: unless-stopped

  rustdesk-hbbr:
    container_name: rustdesk-hbbr
    ports:
      - 21117:21117
      - 21119:21119
    image: braingeneers/rustdesk-server:latest
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '--copy'
      - '/secrets/rustdesk-credentials/id_ed25519:/root/.ssh/id_ed25519'
      - '--copy'
      - '/secrets/rustdesk-credentials/id_ed25519.pub:/root/.ssh/id_ed25519.pub'
      - '/usr/bin/bash'
      - '-c'
      - './hbbr_entrypoint.sh'
    volumes:
#      - rustdesk-data:/root/db_v2.sqlite3
#      - rustdesk-data:/root/db_v2.sqlite3-shm
#      - rustdesk-data:/root/db_v2.sqlite3-wal
      - rustdesk-data:/root/rustdesk-data
      - secrets:/secrets
    networks:
      - braingeneers-net
    depends_on:
      secret-fetcher:
        condition: service_healthy
    restart: unless-stopped

  mqtt-job-listener:
    image: surygeng/spike_sorting_listener:v0.1
    container_name: mqtt-job-listener
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '--copy'
      - '/secrets/kube-config/config:/root/.kube/config'
      - 'python'
      - 'mqtt_listener.py'
    networks:
      - braingeneers-net
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - secrets:/secrets
    restart: unless-stopped

  # Job scanner service managed by Sury
  job-scanner:
    image: surygeng/job_scanner:v0.1
    container_name: job-scanner
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '--copy'
      - '/secrets/kube-config/config:/root/.kube/config'
      - 'python'
      - 'scan_pod.py'
    networks:
      - braingeneers-net
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - secrets:/secrets
    restart: unless-stopped

  # maxwell recording dashboard managed by Sury
  maxwell-dashboard:
    image: surygeng/maxwell_dashboard:v0.1
    container_name: maxwell-dashboard
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    expose: 
      - "8050"
    command:
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '--copy'
      - '/secrets/kube-config/config:/root/.kube/config'
      - "--copy"
      - "/secrets/service-accounts/config.json:/opt/conda/lib/python3.10/site-packages/braingeneers/iot/service_account/config.json"
      - 'python'
      - 'app.py'
    environment:
      VIRTUAL_HOST: "mxwdash.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "8050"
      LETSENCRYPT_HOST: "mxwdash.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    networks:
      - braingeneers-net
    depends_on:
      secret-fetcher:
        condition: service_healthy
    volumes:
      - secrets:/secrets
    restart: unless-stopped

#  # Auto help desk service
#  auto-helpdesk:
#    image: sakachan/mqttconnection:latest
#    container_name: mqttconnection
#    entrypoint: /secrets/entrypoint-secrets-setup.sh
#    restart: unless-stopped
#    networks:
#      - braingeneers-net
#    command:
#      - "--copy"
#      - "/secrets/prp-s3-credentials/credentials:/home/jovyan/.aws/credentials"
#      - "python"
#      - "-u"
#      - "mqttGeminiConnection.py"
#    volumes:
#      - secrets:/secrets
#    depends_on:
#      slack-bridge:
#        condition: service_started
#      secret-fetcher:
#        condition: service_healthy

  # Braingeneers AI Research Assistant (BAIRA) service (maintainer: Kamran, Jasmin)
  baira:
    image: kamranhussain05/baira:latest
    user: root
    container_name: baira
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    restart: unless-stopped
    networks:
      - braingeneers-net
    command:
      - "--copy"
      - "/secrets/baira/baira_credentials:/console/credentials"
      - "--copy"
      - "/secrets/baira/baira_credentials:/root/.aws/credentials"
      - "--copy"
      - "/secrets/baira/baira_credentials:/home/jovyan/.aws/credentials"
      - "whoami && python main_agent/main.py"
    volumes:
      - secrets:/secrets
    depends_on:
      slack-bridge:
        condition: service_started
      secret-fetcher:
        condition: service_healthy

  # Live Stream Server for Picroscope (maintainer: Max, Pierre)
  picroscope-videostream:
    build: picroscope-videostream/
    container_name: tinc-livestream
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - "--copy"
      - "/secrets/picroscope-videostream/picroscope-videostream-rsa_key.priv:/etc/tinc/netname/rsa_key.priv"
      - "--copy"
      - "/secrets/picroscope-videostream/picroscope-videostream-evee:/etc/tinc/netname/hosts/evee"
      - "--copy"
      - "/secrets/picroscope-videostream/picroscope-videostream-home:/etc/tinc/netname/hosts/home"
      - "--copy"
      - "/secrets/picroscope-videostream/picroscope-videostream-octofarm:/etc/tinc/netname/hosts/octofarm"
      - "--copy"
      - "/secrets/picroscope-videostream/picroscope-videostream-server:/etc/tinc/netname/hosts/server"
      - "--copy"
      - "/secrets/picroscope-videostream/picroscope-videostream-nginx-htpasswd:/etc/nginx/.htpasswd"
      - "bash"
      - "-c"
      - "/entrypoint.sh"
    expose:
      - "8888"
    ports:
      - "700:700/tcp"
      - "700:700/udp"
    volumes:
      - secrets:/secrets
    depends_on:
      secret-fetcher:
        condition: service_healthy
    environment:
        IP_ADDR: "128.114.198.51"
        ADDRESS: "10.20.30.1"
        NETMASK: "255.255.255.0"
        NETWORK: "10.20.30.0/24"
        RUNMODE: "server"
        VIRTUAL_HOST: "livestream.braingeneers.gi.ucsc.edu"
        VIRTUAL_PORT: "8888"
        LETSENCRYPT_HOST: "livestream.braingeneers.gi.ucsc.edu"
        LETSENCRYPT_EMAIL: "braingeneers-admins-group@ucsc.edu"
    networks:
      - braingeneers-net
    cap_add:
      - NET_ADMIN
    dns: 8.8.8.8
    restart: unless-stopped


  # Search engine and browser for experiments in NRP S3
  search:
    image: braingeneers/search
    container_name: search
    restart: unless-stopped
    expose:
      - "8080"
    environment:
      VIRTUAL_HOST: "search.braingeneers.gi.ucsc.edu"
      VIRTUAL_PORT: "8080"
      LETSENCRYPT_HOST: "search.braingeneers.gi.ucsc.edu"
      LETSENCRYPT_EMAIL: "braingeners-admins-group@ucsc.edu"
      S3_ENDPOINT: "https://s3.braingeneers.gi.ucsc.edu"
      S3_PROFILE: "prp-braingeneers"
      S3_BUCKET: "braingeneers"
    volumes:
      - search-db:/root/data
      - secrets:/secrets
    depends_on:
      secret-fetcher:
        condition: service_healthy
    entrypoint: /secrets/entrypoint-secrets-setup.sh
    command:
      - '--copy'
      - '/secrets/prp-s3-credentials/credentials:/root/.aws/credentials'
      - '/bin/bash'
      - '-c'
      - 'sqlite3 -init create.sql data/braingeneers.db .quit; cron; python main.py'
    networks:
      - braingeneers-net

# The braingeneers-net network is used to connect the containers together.
networks:
  braingeneers-net:
    driver: bridge


# Volumes are persisted on the host machine.
# All services should be able to cold start when volumes are cleared, these are not a place for
# permanent files that can't be replaced, those should be stored on S3 and copied in if needed.
volumes:

  # A shared volume for secrets only in-memory for security this is populated by the secret-fetcher service
  secrets:
    driver_opts:
      type: tmpfs
      device: tmpfs

  # Volumes for nginx-proxy, letsencrypt, and oauth2-proxy shared for SSL certificates
  vol-certs:
  vol-vhost:
  vol-html:

  # Volume for strapi shadows database
  vol-strapi-shadows-db:

  # Volume for rustdesk
  rustdesk-data:

  # Volume for search
  search-db: