docker-compose_migrid.org_full.yml

# docker-compose version
version: '3.7'

services:
# NOTE: not used in stand-alone mode
#  devdns:
#    image: ruudud/devdns
#    container_name: devdns
#    ports:
#        - "127.0.0.1:53:53/udp"
#    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock:ro
#    environment:
#      TZ: ${TZ}

  # NOTE: we use a shared volume init helper container to make sure volumes
  #       are fully created and instantiated before we try to bind mount
  #       subdirs from e.g. the state volume in the service containers.
  # NOTE: Even though no services are started then use network_mode: "host"
  #       to avoid creating virtual container networks.
  #       Lustre Networking (LNET) locks up if the network is changed
  #       while lustre is mounted.
  migrid-volume-init:
    container_name: migrid-volume-init
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    network_mode: "host"
    extends:
      file: docker-compose_shared.yml
      service: migrid-shared
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: 
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
    env_file:
      - migrid-httpd.env
    # NOTE: public hosts should create users through sign up and run like this
    command: /app/docker-entry.sh -V

  # The migrid core services including httpd and tightly integrated services
  # like job handling (grid script, monitor, sshmux, imnoty and vmproxy)

  # NOTE: in order to test the publishing of container services on the host
  #       with standard ports on 1.2.3.x one can set up a local dummy device:
  #       sudo ip link add dummylan type dummy
  #       sudo ip addr add 1.2.3.1/24 dev dummylan
  #       sudo ip link set dummylan up
  #
  #       Then use the local firewall to forward the standard low service ports
  #       to the exposed high ones.

  migrid:
    container_name: migrid
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    network_mode: "host"
    extends:
      file: docker-compose_shared.yml
      service: migrid-shared
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: httpd script monitor sshmux events cron transfers imnotify vmproxy notify crond rsyslogd
    depends_on:
      # IMPORTANT: finish volume init before migrid launch as explained above
      migrid-volume-init:
        condition: service_completed_successfully
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: migrid-log
        target: /home/mig/state/log
      - type: volume
        source: secrets
        target: /home/mig/state/secrets
      - type: volume
        source: user_home
        target: /home/mig/state/user_home
      - type: volume
        source: vgrid_home
        target: /home/mig/state/vgrid_home
      - type: volume
        source: vgrid_private_base
        target: /home/mig/state/vgrid_private_base
      - type: volume
        source: vgrid_public_base
        target: /home/mig/state/vgrid_public_base
      - type: volume
        source: vgrid_files_home
        target: /home/mig/state/vgrid_files_home
      - type: volume
        source: vgrid_files_writable
        target: /home/mig/state/vgrid_files_writable
      # NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount
      - type: bind
        source: ${VGRID_FILES_WRITABLE}
        target: /home/mig/state/vgrid_files_readonly
        read_only: true
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
      # NOTE: openid_store is a volatile state for apache mod auth openid and
      #       gains scalability and performance from using a fast local tmpfs
      - type: bind
        source: ${OPENID_STORE}
        target: /home/mig/state/openid_store
    env_file:
      - migrid-httpd.env
    command: /app/docker-entry.sh -k -V

  # Multiple containers with individual daemons not provided by base migrid
  migrid-openid:
    container_name: migrid-openid
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    network_mode: "host"
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: openid rsyslogd
    depends_on:
      - migrid
    #ports:
    #  # NOTE: expose the unique raw port(s) to host 
    #  - "8443:8443"
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-openid-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: migrid-log
        target: /home/mig/state/log
      - type: volume
        source: secrets
        target: /home/mig/state/secrets
      - type: volume
        source: user_home
        target: /home/mig/state/user_home
      - type: volume
        source: vgrid_home
        target: /home/mig/state/vgrid_home
      - type: volume
        source: vgrid_private_base
        target: /home/mig/state/vgrid_private_base
      - type: volume
        source: vgrid_public_base
        target: /home/mig/state/vgrid_public_base
      - type: volume
        source: vgrid_files_home
        target: /home/mig/state/vgrid_files_home
      - type: volume
        source: vgrid_files_writable
        target: /home/mig/state/vgrid_files_writable
      # NOTE: we don't need read-only vgrids/workgroups in the openid container
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
    command: /app/docker-entry.sh -k

  migrid-sftp:
    container_name: migrid-sftp
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    network_mode: "host"
    # NOTE: sshd requires capability to write audit log on login attempts
    cap_add:
      - AUDIT_WRITE
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: sftp sftpsubsys rsyslogd
    depends_on:
      - migrid
    #ports:
    #  # NOTE: expose the unique raw port(s) to host 
    #  - "2222:2222"
    #  - "22222:22222"
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-sftp-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: migrid-log
        target: /home/mig/state/log
      - type: volume
        source: secrets
        target: /home/mig/state/secrets
      - type: volume
        source: user_home
        target: /home/mig/state/user_home
      - type: volume
        source: vgrid_home
        target: /home/mig/state/vgrid_home
      - type: volume
        source: vgrid_private_base
        target: /home/mig/state/vgrid_private_base
      - type: volume
        source: vgrid_public_base
        target: /home/mig/state/vgrid_public_base
      - type: volume
        source: vgrid_files_home
        target: /home/mig/state/vgrid_files_home
      - type: volume
        source: vgrid_files_writable
        target: /home/mig/state/vgrid_files_writable
      # NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount
      - type: bind
        source: ${VGRID_FILES_WRITABLE}
        target: /home/mig/state/vgrid_files_readonly
        read_only: true
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
    command: /app/docker-entry.sh -k

  migrid-ftps:
    container_name: migrid-ftps
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    network_mode: "host"
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: ftps rsyslogd
    depends_on:
      - migrid
    #ports:
    #  # NOTE: expose the unique raw port(s) to host 
    #  - "8021:8021"
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-ftps-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: migrid-log
        target: /home/mig/state/log
      - type: volume
        source: secrets
        target: /home/mig/state/secrets
      - type: volume
        source: user_home
        target: /home/mig/state/user_home
      - type: volume
        source: vgrid_home
        target: /home/mig/state/vgrid_home
      - type: volume
        source: vgrid_private_base
        target: /home/mig/state/vgrid_private_base
      - type: volume
        source: vgrid_public_base
        target: /home/mig/state/vgrid_public_base
      - type: volume
        source: vgrid_files_home
        target: /home/mig/state/vgrid_files_home
      - type: volume
        source: vgrid_files_writable
        target: /home/mig/state/vgrid_files_writable
      # NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount
      - type: bind
        source: ${VGRID_FILES_WRITABLE}
        target: /home/mig/state/vgrid_files_readonly
        read_only: true
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
    command: /app/docker-entry.sh -k

  migrid-webdavs:
    container_name: migrid-webdavs
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    network_mode: "host"
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: webdavs rsyslogd
    depends_on:
      - migrid
    #ports:
    #  # NOTE: expose the unique raw port(s) to host 
    #  - "4443:4443"
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-webdavs-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: migrid-log
        target: /home/mig/state/log
      - type: volume
        source: secrets
        target: /home/mig/state/secrets
      - type: volume
        source: user_home
        target: /home/mig/state/user_home
      - type: volume
        source: vgrid_home
        target: /home/mig/state/vgrid_home
      - type: volume
        source: vgrid_private_base
        target: /home/mig/state/vgrid_private_base
      - type: volume
        source: vgrid_public_base
        target: /home/mig/state/vgrid_public_base
      - type: volume
        source: vgrid_files_home
        target: /home/mig/state/vgrid_files_home
      - type: volume
        source: vgrid_files_writable
        target: /home/mig/state/vgrid_files_writable
      # NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount
      - type: bind
        source: ${VGRID_FILES_WRITABLE}
        target: /home/mig/state/vgrid_files_readonly
        read_only: true
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
    command: /app/docker-entry.sh -k

  migrid-lustre-quota:
    container_name: migrid-lustre-quota
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    network_mode: "host"
    environment:
      TZ: ${TZ}
    depends_on:
      - migrid
    cap_add:
      - SYS_ADMIN
    volumes:
      - type: bind
        source: ${QUOTA_LUSTRE_BASE}
        target: /lustre/${DOMAIN}
      - type: bind
        source: ${QUOTA_GOCRYPTFS_XRAY}
        target: /usr/local/bin/gocryptfs-xray
      - type: bind
        source: ${QUOTA_GOCRYPTFS_SOCK}
        target: /var/run/gocryptfs.${DOMAIN}.sock
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: state
        target: /home/mig/state
    command: miglustrequota.py -c /home/mig/mig/server/MiGserver.conf

# NOTE: not used in stand-alone production mode
#  nginx-proxy:
#    image: jwilder/nginx-proxy
#    container_name: nginx-proxy
#    network_mode: "host"
#    # TODO: can we add an httpd health check and switch to wait for condition
#    #       service_healthy to avoid the storm of initial avoid nginx errors
#    #       from racing apache during start up? Apparently that will not work
#    #       with on-going jupyter integration due to swarm mode, however.
#    depends_on:
#      - migrid
#    #ports:
#    #  # NOTE: expose the unique raw port(s) to host 
#    #  - "80:80"
#    #  - "443:443"
#    volumes:
#      - /var/run/docker.sock:/tmp/docker.sock:ro
#      - ./nginx-proxy-development.conf:/etc/nginx/conf.d/migrid.conf
#      - ./nginx-harden-https.conf:/etc/nginx/harden-https.conf
#      - ./certs/MiG/site/server.crt:/etc/nginx/certs/server.crt
#      - ./certs/dhparams.pem:/etc/nginx/dhparam/dhparam.pem

volumes:
  certs:
    # Volume for generated certificates (provided by migrid)
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/certs
      o: bind

  httpd:
    # Volume used for httpd config (provided by migrid)
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/httpd
      o: bind

  mig:
    # Volume used to contain the migrid code and conf (provided by migrid at svn/git)
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/mig
      o: bind

  state:
    # Volume used to contain the migrid state (provided by migrid)
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/state
      o: bind
  
  secrets:
    # Volume used to contain the migrid secrets
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/secrets
      o: bind

  user_home:
    # Volume used to contain the migrid user_home
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/user_home
      o: bind

  vgrid_home:
    # Volume used to contain the migrid vgrid_home
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/vgrid_home
      o: bind
  
  vgrid_private_base:
    # Volume used to contain the migrid vgrid_private_base
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/vgrid_private_base
      o: bind

  vgrid_public_base:
    # Volume used to contain the migrid vgrid_public_base
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/vgrid_public_base
      o: bind

  vgrid_files_home:
    # Volume used to contain the migrid vgrid_files_home
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/vgrid_files_home
      o: bind

  vgrid_files_writable:
    # Volume used to contain the migrid vgrid_files_writable
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/vgrid_files_writable
      o: bind

  migrid-syslog:
    # Volume used for exposing migrid container system log
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/syslog/migrid
      o: bind

  migrid-openid-syslog:
    # Volume used for exposing migrid openid container system log
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/syslog/migrid-openid
      o: bind

  migrid-sftp-syslog:
    # Volume used for exposing migrid sftp container system log
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/syslog/migrid-sftp
      o: bind

  migrid-webdavs-syslog:
    # Volume used for exposing migrid webdavs container system log
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/syslog/migrid-webdavs
      o: bind

  migrid-ftps-syslog:
    # Volume used for exposing migrid ftps container system log
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/syslog/migrid-ftps
      o: bind
  
  migrid-log:
    # Volume used to contain the migrid state log
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/storage/miglog
      o: bind