docker-compose.yml

version: "3.7"

x-logging:
  &default-logging
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "10"

services:

  app: &default-django
    build:
      context: ./docker-app
    restart: unless-stopped
    command: >
      gunicorn
        qfieldcloud.wsgi:application
        --bind 0.0.0.0:8000
        --timeout ${GUNICORN_TIMEOUT_S}
        --max-requests ${GUNICORN_MAX_REQUESTS}
        --workers ${GUNICORN_WORKERS}
        --threads ${GUNICORN_THREADS}
    volumes:
      - static_volume:/usr/src/app/staticfiles
      - media_volume:/usr/src/app/mediafiles/
    environment:
      DJANGO_ALLOWED_HOSTS: ${DJANGO_ALLOWED_HOSTS}
      DJANGO_SETTINGS_MODULE: ${DJANGO_SETTINGS_MODULE}
      SECRET_KEY: ${SECRET_KEY}
      DEBUG: ${DEBUG}
      ENVIRONMENT: ${ENVIRONMENT}
      SQL_DATABASE: ${POSTGRES_DB}
      SQL_USER: ${POSTGRES_USER}
      SQL_PASSWORD: ${POSTGRES_PASSWORD}
      SQL_HOST: ${POSTGRES_HOST}
      SQL_PORT: ${POSTGRES_PORT}
      SQL_SSLMODE: ${POSTGRES_SSLMODE}
      STORAGE_ACCESS_KEY_ID: ${STORAGE_ACCESS_KEY_ID}
      STORAGE_SECRET_ACCESS_KEY: ${STORAGE_SECRET_ACCESS_KEY}
      STORAGE_BUCKET_NAME: ${STORAGE_BUCKET_NAME}
      STORAGE_REGION_NAME: ${STORAGE_REGION_NAME}
      STORAGE_ENDPOINT_URL: ${STORAGE_ENDPOINT_URL}
      QFIELDCLOUD_DEFAULT_NETWORK: ${QFIELDCLOUD_DEFAULT_NETWORK}
      SENTRY_DSN: ${SENTRY_DSN}
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REDIS_PORT: ${REDIS_PORT}
      GEODB_HOST: ${GEODB_HOST}
      GEODB_PORT: ${GEODB_PORT}
      GEODB_USER: ${GEODB_USER}
      GEODB_PASSWORD: ${GEODB_PASSWORD}
      GEODB_DB: ${GEODB_DB}
      ACCOUNT_EMAIL_VERIFICATION: ${ACCOUNT_EMAIL_VERIFICATION}
      EMAIL_HOST: ${EMAIL_HOST}
      EMAIL_USE_TLS: ${EMAIL_USE_TLS}
      EMAIL_USE_SSL: ${EMAIL_USE_SSL}
      EMAIL_PORT: ${EMAIL_PORT}
      EMAIL_HOST_USER: ${EMAIL_HOST_USER}
      EMAIL_HOST_PASSWORD: ${EMAIL_HOST_PASSWORD}
      DEFAULT_FROM_EMAIL: ${DEFAULT_FROM_EMAIL}
      # Settings below are specific to worker_wrapper
      # TODO : move this to the worker_wrapper service and keep things DRY (yaml syntax expert needed)
      TMP_DIRECTORY: ${TMP_DIRECTORY}
      QGIS_CONTAINER_NAME: ${COMPOSE_PROJECT_NAME}_qgis
      QFIELDCLOUD_HOST: ${QFIELDCLOUD_HOST}
      QFIELDCLOUD_ADMIN_URI: ${QFIELDCLOUD_ADMIN_URI}
      QFIELDCLOUD_RIBBON_HTML: ${QFIELDCLOUD_RIBBON_HTML}
      WEB_HTTP_PORT: ${WEB_HTTP_PORT}
      WEB_HTTPS_PORT: ${WEB_HTTPS_PORT}
      QFIELDCLOUD_WORKER_TIMEOUT_S: ${QFIELDCLOUD_WORKER_TIMEOUT_S}
      TRANSFORMATION_GRIDS_VOLUME_NAME: ${COMPOSE_PROJECT_NAME}_transformation_grids
    depends_on:
      - redis
    logging:
      driver: "json-file"
      options:
        max-size: "1000m"
        max-file: "5"
    labels:
      ofelia.enabled: "true"
      ofelia.job-exec.runcrons.schedule: 0 * * * * *
      ofelia.job-exec.runcrons.command: python manage.py runcrons

  nginx:
    image: nginx:stable
    restart: unless-stopped
    volumes:
      - static_volume:/var/www/html/staticfiles/
      - media_volume:/var/www/html/mediafiles/
      - ./conf/nginx/pages/:/var/www/html/pages/
      - ./conf/nginx/templates/:/etc/nginx/templates/
      - ./conf/nginx/certs/:/etc/nginx/certs/:ro
      - ./conf/nginx/options-ssl-nginx.conf:/etc/nginx/options-ssl-nginx.conf
      - ./conf/nginx/ssl-dhparams.pem:/etc/nginx/ssl-dhparams.pem
      - certbot_www:/var/www/certbot
    ports:
      - ${WEB_HTTP_PORT}:80
      - ${WEB_HTTPS_PORT}:443
    environment:
      QFIELDCLOUD_HOST: ${QFIELDCLOUD_HOST}
      WEB_HTTP_PORT: ${WEB_HTTP_PORT}
      WEB_HTTPS_PORT: ${WEB_HTTPS_PORT}
      LETSENCRYPT_EMAIL: ${LETSENCRYPT_EMAIL}
      LETSENCRYPT_STAGING: ${LETSENCRYPT_STAGING}
      LETSENCRYPT_RSA_KEY_SIZE: ${LETSENCRYPT_RSA_KEY_SIZE}
    logging: *default-logging

  mkcert:
    image: vishnunair/docker-mkcert
    environment:
      domain: ${QFIELDCLOUD_HOST}
    volumes:
      - ./conf/nginx/certs/:/root/.local/share/mkcert/
    command: /bin/sh -c 'mkcert -install && for i in $$(echo $$domain | sed "s/,/ /g"); do [ ! -f /root/.local/share/mkcert/$$i.pem ] && mkcert $$i; done && tail -f -n0 /etc/hosts'

  certbot:
    image: certbot/certbot
    restart: unless-stopped
    volumes:
      - ./conf/certbot/conf:/etc/letsencrypt
      - certbot_www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

  qgis:
    build:
      context: ./docker-qgis
    tty: true
    command: bash -c "echo QGIS builded"
    logging: *default-logging

  redis:
    build:
      context: ./docker-redis
      args:
        REDIS_PASSWORD: ${REDIS_PASSWORD}
    restart: unless-stopped
    ports:
      - "${REDIS_PORT}:6379"
    logging: *default-logging

  worker_wrapper:
    <<: *default-django
    command: python manage.py dequeue
    user: root # TODO change me to least privileged docker-capable user on the host (/!\ docker users!=hosts users, use UID rather than username)
    volumes:
      # TODO : how can we reuse static/media volumes from default-django to keep things DRY (yaml syntax expert needed)
      - static_volume:/usr/src/app/staticfiles
      - media_volume:/usr/src/app/mediafiles/
      - transformation_grids:/transformation_grids
      - /var/run/docker.sock:/var/run/docker.sock
      - ${LOG_DIRECTORY}:/log
      - ${TMP_DIRECTORY}:/tmp
    logging: *default-logging
    depends_on:
      - redis
      - app

  ofelia:
    image: mcuadros/ofelia:v0.3.4
    depends_on:
      - app
    command: daemon --docker
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  mirror_transformation_grids:
    image: k3rnelpan1c/alpine-wget:latest
    command: |
      wget --mirror https://cdn.proj.org/ -P /transformation_grids --no-host-directories
      chmod a+r /transformation_grids/*
    volumes:
      - transformation_grids:/transformation_grids

volumes:
  static_volume:
  media_volume:
  transformation_grids:
  certbot_www: