docker-compose.deploy.yml

# Copyright (c) 2022, 2023 Humanitarian OpenStreetMap Team
# This file is part of FMTM.
#
#     FMTM is free software: you can redistribute it and/or modify
#     it under the terms of the GNU General Public License as published by
#     the Free Software Foundation, either version 3 of the License, or
#     (at your option) any later version.
#
#     FMTM is distributed in the hope that it will be useful,
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#     GNU General Public License for more details.
#
#     You should have received a copy of the GNU General Public License
#     along with FMTM.  If not, see <https:#www.gnu.org/licenses/>.
#

version: "3"

volumes:
  fmtm_db_data:
  fmtm_logs:
  fmtm_images:
  fmtm_tiles:
  traefik-public-certificates:

networks:
  fmtm-net:
    name: fmtm-${GIT_BRANCH}

services:
  traefik:
    image: "docker.io/traefik:v2.8"
    container_name: fmtm_proxy
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "traefik-public-certificates:/certificates"
    ports:
      - 80:80
      - 443:443
    networks:
      - fmtm-net
    restart: unless-stopped
    command:
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@hotosm.org"
      - "--certificatesresolvers.letsencrypt.acme.storage=/certificates/acme.json"
      ## Enable below for staging tests
      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=fmtm-${GIT_BRANCH}"
      - "traefik.api.dashboard=false"
      - "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.https_redirect.redirectscheme.permanent=true"
      - "traefik.http.routers.http_catchall.rule=HostRegexp(`{any:.+}`) && !PathPrefix(`/.well-known/acme-challenge/`)"
      - "traefik.http.routers.http_catchall.entrypoints=web"
      - "traefik.http.routers.http_catchall.middlewares=https_redirect"

  fmtm-db:
    image: "postgis/postgis:14-3.3-alpine"
    container_name: fmtm_db
    volumes:
      - fmtm_db_data:/var/lib/postgresql/data/
    environment:
      - POSTGRES_USER=${FMTM_DB_USER:-fmtm}
      - POSTGRES_PASSWORD=${FMTM_DB_PASSWORD:-fmtm}
      - POSTGRES_DB=${FMTM_DB_NAME:-fmtm}
    ports:
      - "5433:5432"
    networks:
      - fmtm-net
    restart: unless-stopped

  api:
    image: "ghcr.io/hotosm/fmtm/backend:${API_VERSION}-${GIT_BRANCH}"
    build:
      context: src/backend
      target: prod
      args:
        APP_VERSION: ${API_VERSION}
    container_name: fmtm_api
    volumes:
      - fmtm_logs:/opt/logs
      - fmtm_images:/opt/app/images
      - fmtm_tiles:/opt/tiles
    depends_on:
      - fmtm-db
      - traefik
    env_file:
      - .env
    networks:
      - fmtm-net
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.tls=true"
      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
      - "traefik.http.routers.api.rule=Host(`${API_URL}`)"
      - "traefik.http.services.api-svc.loadbalancer.server.port=8000"
      - "traefik.http.routers.api.service=api-svc"

  ui-main:
    image: "ghcr.io/hotosm/fmtm/frontend/main:${FRONTEND_MAIN_VERSION}-${GIT_BRANCH}"
    build:
      context: src/frontend
      dockerfile: prod.dockerfile
      args:
        APP_VERSION: ${FRONTEND_MAIN_VERSION}
        API_URL: ${URL_SCHEME}://${API_URL}
        FRONTEND_MAIN_URL: ${URL_SCHEME}://${FRONTEND_MAIN_URL}
    container_name: fmtm_main
    depends_on:
      - api
      - traefik
    networks:
      - fmtm-net
    environment:
      - BROTLI=true
      - API_URL=${URL_SCHEME}://${API_URL}
      - FRONTEND_MAIN_URL=${URL_SCHEME}://${FRONTEND_MAIN_URL}
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ui-main.tls=true"
      - "traefik.http.routers.ui-main.tls.certresolver=letsencrypt"
      - "traefik.http.routers.ui-main.rule=Host(`${FRONTEND_MAIN_URL}`)"
      - "traefik.http.services.ui-main-svc.loadbalancer.server.port=8080"
      - "traefik.http.routers.ui-main.service=ui-main-svc"