docker-compose.yaml

x-django:
  &default-django
  image: git.ubuntu-eu.org/ubuntuusers/inyokaproject
  environment:
    DJANGO_SETTINGS_MODULE: production_settings
  secrets:
    - inyoka-postgres-password
    - inyoka-redis-password
    - inyoka-secret-key
    - inyoka-secret-key-fallback
    - inyoka-akismet-key
    - inyoka-sentry-dsn
  configs:
    - source: inyoka-config
      target: /inyoka/code/production_settings.py
    - inyoka-base-domain
    - inyoka-media-domain
    - inyoka-static-domain
  volumes:
    - media-files:/srv/www/media

x-healthcheck-defaults:
  &healthcheck_defaults
  # https://docs.docker.com/reference/dockerfile/#healthcheck
  timeout: 1m
  start_period: 10s


services:
  postgres:
    # pin postgres major version to prevent unexpected database migrations
    # debian image is used, as alpine can have problems with locals
    # see https://github.com/docker-library/docs/blob/master/postgres/README.md#locale-customization
    image: docker.io/library/postgres:14.23-trixie
    environment:
      POSTGRES_DB: inyoka
      # TODO defines superuser name -> do not use superuser from inyoka?
      POSTGRES_USER: inyoka
      POSTGRES_PASSWORD_FILE: /run/secrets/inyoka-postgres-password
      POSTGRES_HOST_AUTH_METHOD: "scram-sha-256"
      POSTGRES_INITDB_ARGS: "--data-checksums"
    # https://github.com/docker-library/postgres/blob/a83005b407ee6d810413500d8a041c957fb10cf0/14/bullseye/Dockerfile#L211-L213
    # https://www.postgresql.org/docs/14/server-start.html suggests no timeout
    stop_grace_period: 5m
    command: postgres -c 'config_file=/etc/postgresql/postgresql.conf'
    configs:
      - source: postgres-config
        target: /etc/postgresql/postgresql.conf
    secrets:
      - inyoka-postgres-password
    volumes:
      - postgres-data:/var/lib/postgresql/data
      # increase shared memory like recommended at https://github.com/docker-library/docs/blob/master/postgres/README.md#caveats
      # shm_size is not supported in docker swarm
      # workaround: https://github.com/moby/moby/issues/26714#issuecomment-579820612
      - type: tmpfs
        target: /dev/shm
        tmpfs:
          size: 268435456
    healthcheck:
      <<: *healthcheck_defaults
      test: ['CMD', 'pg_isready']

  inyoka-worker:
    << : *default-django
    command: /inyoka/venv/bin/gunicorn -b 0.0.0.0:8000 --workers 24 --max-requests 500 --no-control-socket inyoka.wsgi:application
    healthcheck:
      <<: *healthcheck_defaults
      test: python -c 'import http.client; conn = http.client.HTTPConnection("localhost", 8000); conn.request("GET", "/"); res = conn.getresponse(); assert len(res.read()) > 0'

  redis:
    image: docker.io/library/redis:8.6.4-alpine
    command: redis-server /etc/redis/redis.conf
    configs:
     - source: redis-config
       target: /etc/redis/redis.conf
       uid: "999" # see `id redis` inside the redis container
       gid: "1000"
       mode: 0440
    secrets:
      - inyoka-redis-password
    volumes:
      - redis-data:/data
    healthcheck:
      <<: *healthcheck_defaults
      test: nc -z 127.0.0.1 6379

  celeryworker:
    << : *default-django
    command: /inyoka/venv/bin/celery --app=inyoka worker --loglevel=INFO --concurrency=8
    healthcheck:
      <<: *healthcheck_defaults
      test: ['CMD-SHELL', 'cat /proc/1/cmdline | grep --text "celery" | grep --text "worker" || false']

  celerybeat:
    << : *default-django
    command: /inyoka/venv/bin/celery --app=inyoka beat --pidfile /tmp/celerybeat.pid --loglevel=INFO --schedule /volume/celerybeat-schedule/celerybeat-schedule
    volumes:
      - celerybeat-schedule:/volume/celerybeat-schedule
    healthcheck:
      <<: *healthcheck_defaults
      test: ['CMD-SHELL', 'cat /proc/1/cmdline | grep --text "celery" | grep --text "beat" || false']

  caddy:
    image: git.ubuntu-eu.org/ubuntuusers/caddy-inyoka
    volumes:
      - caddy_data:/data
      - caddy_config:/config
      - media-files:/srv/www/media:ro
    configs:
      - source: Caddyfile
        target: /etc/caddy/Caddyfile
      - caddy-email
      - inyoka-base-domain
      - inyoka-media-domain
      - inyoka-static-domain
    healthcheck:
      <<: *healthcheck_defaults
      test: ['CMD-SHELL', 'wget http://localhost:2024 -O - -o /dev/null']

  clamav:
    image: clamav/clamav:1.5
    user: clamav
    entrypoint: /init-unprivileged
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 4GB
    volumes:
      - media-files:/srv/www/media:ro
    configs:
      - source: clamd-config
        target: /etc/clamav/clamd.conf

configs:
  inyoka-config:
    file: ./production_settings.py
    template_driver: golang
  clamd-config:
    file: ./clamd.conf
    template_driver: golang
  postgres-config:
    file: ./postgres.conf
    template_driver: golang
  redis-config:
    file: ./redis.conf
    template_driver: golang
  Caddyfile:
    file: ./Caddyfile
    template_driver: golang
  inyoka-base-domain:
    external: true
  inyoka-media-domain:
    external: true
  inyoka-static-domain:
    external: true
  caddy-email:
    external: true


secrets:
  inyoka-postgres-password:
    external: true
  inyoka-redis-password:
    external: true
  inyoka-secret-key:
    external: true
  inyoka-secret-key-fallback:
    external: true
  inyoka-akismet-key:
    external: true
  inyoka-sentry-dsn:
    external: true

# https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference
volumes:
  celerybeat-schedule: {}
  postgres-data: {}
  redis-data: {}
  media-files: {}
  caddy_data: {}
  caddy_config: {}