compose.yml

services:
  app:
    image: ghcr.io/internetstandards/ctlssa:latest
    build: &app_build
      context: .
      cache_from:
        - ghcr.io/internetstandards/ctlssa:latest
        - type=gha
      cache_to:
        - type=gha
      args:
        BUILDKIT_INLINE_CACHE: 1
    develop: &app_develop
      watch:
        - path: src/
          action: sync+restart
          target: /src/src/
    entrypoint: uwsgi
    ports:
      - 8001:8001
    environment:
      - DEBUG="False"
      - CTLSSA_SECRET_KEY
      - CTLSSA_DJANGO_DATABASE=production
      - CTLSSA_DB_ENGINE=postgresql_psycopg2
      - CTLSSA_DB_HOST=db
      - CTLSSA_CERTSTREAM_SERVER_URL=ws://certstream:4000
      - CTLSSA_HOSTNAMES

    # uwsgi reloads on SIGTERM, so use SIGINT instead
    # https://uwsgi-docs.readthedocs.io/en/latest/Management.html#signals-for-controlling-uwsgi
    stop_signal: SIGINT
    restart: always
    depends_on:
      db:
        condition: service_healthy
      db-migrate:
        # wait for DB migration to be completed
        condition: service_completed_successfully
      app-ingest:
        condition: service_started
    healthcheck:
      test: curl --silent --fail http://127.0.0.1:8001
      interval: 5m
      start_period: 30s
      start_interval: 1s

  app-ingest:
    build: *app_build
    develop: *app_develop
    image: ghcr.io/internetstandards/ctlssa:latest
    environment:
      - DEBUG="False"
      - CTLSSA_SECRET_KEY
      - CTLSSA_DJANGO_DATABASE=production
      - CTLSSA_DB_ENGINE=postgresql_psycopg2
      - CTLSSA_DB_HOST=db
      - CTLSSA_CERTSTREAM_SERVER_URL=ws://certstream:4000
    entrypoint: ctlssa
    command: ingest
    restart: always
    # certstream library only listens to SIGINT
    # https://github.com/CaliDog/certstream-python/blob/master/certstream/core.py#L56
    stop_signal: SIGINT
    stop_grace_period: 3s
    depends_on:
      db:
        condition: service_healthy
      db-migrate:
        # wait for DB migration to be completed
        condition: service_completed_successfully
      certstream:
        condition: service_healthy

  certstream:
    build:
      context: vendor/certstream
    image: ghcr.io/internetstandards/certstream:latest
    environment:
      LOG_LEVEL: error
    restart: always
    healthcheck:
      test: wget -q 127.0.0.1:4000 -O /dev/null
      interval: 5m
      start_period: 30s
      start_interval: 1s

  db:
    image: postgres:15
    restart: always
    environment:
      POSTGRES_DB: ctlssa
      POSTGRES_USER: ctlssa
      POSTGRES_PASSWORD: ctlssa
    healthcheck:
      test: pg_isready -U $$POSTGRES_USER -d $$POSTGRES_PASSWORD
      interval: 5m
      start_period: 30s
      start_interval: 1s
    cpu_percent: ${CERTSTREAM_CPU_PERCENT:-10}
    volumes:
      - postgres:/var/lib/postgresql/data

  db-migrate:
    build: *app_build
    develop: *app_develop
    image: ghcr.io/internetstandards/ctlssa:latest
    restart: on-failure
    environment:
      CTLSSA_SECRET_KEY: '1'
      CTLSSA_DJANGO_DATABASE: production
      CTLSSA_DB_ENGINE: postgresql_psycopg2
      CTLSSA_DB_HOST: db
    entrypoint: ctlssa
    command: migrate
    depends_on:
      db:
        condition: service_healthy

  dev:
    build:
      target: dev
    environment:
      - CTLSSA_SECRET_KEY=1
      - CTLSSA_DJANGO_DATABASE=production
      - CTLSSA_DB_ENGINE=postgresql_psycopg2
      - CTLSSA_DB_HOST=db
    volumes:
      - .:/src
      - ./.root:/root

    profiles:
      - dev

volumes:
  postgres: