docker-compose.yml

version: '3.8'
services:
  traefik:
    image: traefik:latest
    command:
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.file.directory=/conf/
      - --accesslog=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  traefik-forward-auth:
    image: thomseddon/traefik-forward-auth:2
    environment:
      - http_proxy=${http_proxy}
      - https_proxy=${https_proxy}
      - DEFAULT_PROVIDER=oidc
      - PROVIDERS_OIDC_ISSUER_URL=${OAUTH_ISSUER_URL}
      - PROVIDERS_OIDC_CLIENT_ID=${OAUTH_CLIENT_ID}
      - PROVIDERS_OIDC_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
      - SECRET=${AUTHENTICATION_SECRET}
      - COOKIE_DOMAIN=${GUI_HOST}
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4181"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
      - "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4181"

  lens:
    # NOTE: This will only host the default image. You will need to create your own image at docker hub using the provided Dockerfile.
    image: samply/lens-demo
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.lens.rule=Host(`${GUI_HOST}`)"
      - "traefik.http.routers.lens.tls=true"
      - "traefik.http.routers.lens.middlewares=traefik-forward-auth"

  spot:
    # NOTE: This will be replaced by https://github.com/samply/spot soon.
    image: docker.verbis.dkfz.de/ccp-private/central-spot
    environment:
      BEAM_SECRET: "${LOCAL_BEAM_SECRET}"
      BEAM_URL: http://beam-proxy:8081
      BEAM_PROXY_ID: ${LOCAL_BEAM_ID}
      BEAM_BROKER_ID: ${BROKER_HOST}
      BEAM_APP_ID: "focus"
    depends_on:
      - "beam-proxy"
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.spot.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolalloworiginlist=https://${GUI_HOST}"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolallowcredentials=true"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolmaxage=-1"
      - "traefik.http.routers.spot.rule=Host(`backend.${GUI_HOST}`)"
      - "traefik.http.routers.spot.tls=true"
      - "traefik.http.routers.spot.middlewares=corsheaders,traefik-forward-auth"

  beam-proxy:
    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
    environment:
      BROKER_URL: https://${BROKER_HOST}
      PROXY_ID: ${LOCAL_BEAM_ID}.${BROKER_HOST}
      APP_focus_KEY: ${LOCAL_BEAM_SECRET}
      PRIVKEY_FILE: /run/secrets/proxy.pem
      ALL_PROXY: ${http_proxy}
    secrets:
      - proxy.pem
      - root.crt.pem

secrets:
  proxy.pem:
    file: /etc/lens/pki/${LOCAL_BEAM_ID}.priv.pem
  root.crt.pem:
    file: ./rootcerts/${BROKER_HOST}-root.crt.pem