docker-compose.deploy.yml

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
#
# OpenCRVS is also distributed under the terms of the Civil Registration
# & Healthcare Disclaimer located at http://opencrvs.org/license.
#
# Copyright (C) The OpenCRVS Authors. OpenCRVS and the OpenCRVS
# graphic logo are (registered/a) trademark(s) of Plan International.
version: '3.3'

services:
  # Configure reverse proxy for public endpoints
  # Note: these published port will override UFW rules as Docker manages it's own iptables
  # Only publish the exact ports that are required for OpenCRVS to work
  traefik:
    image: traefik:1.7.16
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /data/traefik/acme.json:/acme.json
    configs:
      - source: traefik.{{ts}}
        target: /etc/traefik/traefik.toml
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'traefik'
  metricbeat:
    image: docker.elastic.co/beats/metricbeat:7.17.0

    user: root
    volumes:
      - /proc:/hostfs/proc:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /:/hostfs:ro
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - ELASTICSEARCH_HOST=elasticsearch:9200
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_SUPERUSER_PASSWORD}
      - KIBANA_HOST=kibana:5601
      - KIBANA_USERNAME=${KIBANA_USERNAME}
      - KIBANA_PASSWORD=${KIBANA_PASSWORD}
      - BEATS_USERNAME=beats_system
      - BEATS_PASSWORD=${ROTATING_METRICBEAT_ELASTIC_PASSWORD}
    command: ['--strict.perms=false', '-system.hostfs=/hostfs']
    hostname: 'metricbeat-{{.Node.Hostname}}'
    restart: always
    deploy:
      mode: global
    networks:
      - overlay_net
    configs:
      - source: metricbeat-conf.{{ts}}
        target: /usr/share/metricbeat/metricbeat.yml
      - source: metricbeat-rollover-policy.{{ts}}
        target: /usr/share/metricbeat/rollover-policy.json
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'metricbeat'
  setup-kibana-config:
    image: curlimages/curl:7.83.1
    entrypoint:
      [
        'curl',
        '-u',
        'elastic:${ELASTICSEARCH_SUPERUSER_PASSWORD}',
        '-X',
        'POST',
        'http://kibana:5601/api/saved_objects/_import?overwrite=true',
        '-H',
        'kbn-xsrf: true',
        '--form',
        'file=@/config.ndjson'
      ]
    restart: on-failure
    depends_on:
      - kibana
    volumes:
      - '/opt/opencrvs/infrastructure/monitoring/kibana/config.ndjson:/config.ndjson'
    networks:
      - overlay_net
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'setup-kibana-config'
  kibana:
    image: docker.elastic.co/kibana/kibana:7.17.0
    restart: always
    deploy:
      labels:
        # https://doc.traefik.io/traefik/v1.7/configuration/backends/docker/#labels-overriding-default-behavior
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: kibana.{{hostname}}'
        - 'traefik.port=5601'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
    networks:
      - overlay_net
    environment:
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_SUPERUSER_PASSWORD}
    configs:
      - source: kibana.{{ts}}
        target: /usr/share/kibana/config/kibana.yml
    depends_on:
      - elasticsearch
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'kibana'
  # Configure mongo nodes as a replica set
  mongo1:
    command: mongod --auth --replSet rs0 --keyFile /etc/mongodb-keyfile
    hostname: 'mongo1'
    container_name: 'mongo1'
    volumes:
      - '/data/mongo:/data/db'
      - '/mongodb-keyfile:/mongodb-keyfile'
    # https://github.com/docker-library/mongo/issues/475
    entrypoint:
      - bash
      - -c
      - |
        cp /mongodb-keyfile /etc/mongodb-keyfile
        chmod 400 /etc/mongodb-keyfile
        chown 999:999 /etc/mongodb-keyfile
        exec docker-entrypoint.sh $$@
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${MONGODB_ADMIN_USER}
      - MONGO_INITDB_ROOT_PASSWORD=${MONGODB_ADMIN_PASSWORD}
      - USER_MGNT_MONGODB_PASSWORD=${USER_MGNT_MONGODB_PASSWORD}
      - HEARTH_MONGODB_PASSWORD=${HEARTH_MONGODB_PASSWORD}
      - CONFIG_MONGODB_PASSWORD=${CONFIG_MONGODB_PASSWORD}
      - OPENHIM_MONGODB_PASSWORD=${OPENHIM_MONGODB_PASSWORD}
      - WEBHOOKS_MONGODB_PASSWORD=${WEBHOOKS_MONGODB_PASSWORD}
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.data1 == true
    configs:
      - source: mongo-init.{{ts}}
        target: /docker-entrypoint-initdb.d/create-mongo-users.sh
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'mongo1'
  mongo-on-update:
    image: mongo:4.4
    command: bash /on-deploy.sh
    configs:
      - source: mongo-on-deploy.{{ts}}
        target: /on-deploy.sh
    deploy:
      replicas: 1
      restart_policy:
        condition: none
    depends_on:
      - mongo1
    environment:
      - REPLICAS=1
      - MONGODB_ADMIN_USER=${MONGODB_ADMIN_USER}
      - MONGODB_ADMIN_PASSWORD=${MONGODB_ADMIN_PASSWORD}
      - USER_MGNT_MONGODB_PASSWORD=${USER_MGNT_MONGODB_PASSWORD}
      - HEARTH_MONGODB_PASSWORD=${HEARTH_MONGODB_PASSWORD}
      - CONFIG_MONGODB_PASSWORD=${CONFIG_MONGODB_PASSWORD}
      - OPENHIM_MONGODB_PASSWORD=${OPENHIM_MONGODB_PASSWORD}
      - WEBHOOKS_MONGODB_PASSWORD=${WEBHOOKS_MONGODB_PASSWORD}
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'mongo-on-update'
  # Configure redis
  redis:
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'redis'
  # Configure elasticsearch
  elasticsearch:
    volumes:
      - '/data/elasticsearch:/usr/share/elasticsearch/data'
      - '/data/backups/elasticsearch:/data/backups/elasticsearch'
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.data1 == true
    environment:
      - ELASTIC_PASSWORD=${ELASTICSEARCH_SUPERUSER_PASSWORD}
      - path.repo=/data/backups/elasticsearch
      - cluster.name=docker-cluster
      - network.host=0.0.0.0
      - discovery.zen.minimum_master_nodes=1
      - discovery.type=single-node
      - xpack.security.enabled=true
      - xpack.security.authc.api_key.enabled=true
    ports:
      - 9200:9200
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'elasticsearch'

  setup-elasticsearch-users:
    image: ubuntu:bionic
    entrypoint: ['bash', '/usr/app/setup.sh']
    restart: on-failure
    depends_on:
      - elasticsearch
    environment:
      - ELASTICSEARCH_HOST=elasticsearch
      - ELASTIC_PASSWORD=${ELASTICSEARCH_SUPERUSER_PASSWORD}
      - METRICBEAT_ELASTIC_PASSWORD=${ROTATING_METRICBEAT_ELASTIC_PASSWORD}
      - APM_ELASTIC_PASSWORD=${ROTATING_APM_ELASTIC_PASSWORD}
      - SEARCH_ELASTIC_USERNAME=search-user
      - SEARCH_ELASTIC_PASSWORD=${ROTATING_SEARCH_ELASTIC_PASSWORD}
      - KIBANA_USERNAME=${KIBANA_USERNAME}
      - KIBANA_PASSWORD=${KIBANA_PASSWORD}
    volumes:
      - '/opt/opencrvs/infrastructure/elasticsearch:/usr/app'
    networks:
      - overlay_net
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'setup-elasticsearch-users'
  elastalert:
    image: jertel/elastalert2:2.3.0
    restart: unless-stopped
    volumes:
      - '/opt/opencrvs/infrastructure/monitoring/elastalert/elastalert.yaml:/opt/elastalert/config.yaml'
      - '/opt/opencrvs/infrastructure/monitoring/elastalert/rules:/opt/elastalert/rules'
    networks:
      - overlay_net
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'elastalert'

  logstash:
    image: logstash:7.17.0
    command: logstash -f /etc/logstash/logstash.conf --verbose
    depends_on:
      - elasticsearch
    ports:
      - '12201:12201'
      - '12201:12201/udp'
    configs:
      - source: logstash-pipeline.{{ts}}
        target: /etc/logstash/logstash.conf
      - source: logstash.{{ts}}
        target: /usr/share/logstash/config/logstash.yml
    environment:
      - ELASTICSEARCH_SUPERUSER_PASSWORD=${ELASTICSEARCH_SUPERUSER_PASSWORD}
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_SUPERUSER_PASSWORD}
    networks:
      - overlay_net
    restart: always
    deploy:
      replicas: 2
  apm-server:
    image: docker.elastic.co/apm/apm-server:7.15.2
    depends_on:
      - elasticsearch
      - kibana
    cap_add: ['CHOWN', 'DAC_OVERRIDE', 'SETGID', 'SETUID']
    cap_drop: ['ALL']
    restart: always
    ports:
      - 8200:8200
    networks:
      - overlay_net
    deploy:
      replicas: 2
    command:
      [
        'apm-server',
        '-e',
        '-c',
        'apm-server.yml',
        '-E',
        'output.elasticsearch.username=elastic',
        '-E',
        'output.elasticsearch.password=${ELASTICSEARCH_SUPERUSER_PASSWORD}',
        '-E',
        'kibana.username=${KIBANA_USERNAME}',
        '-E',
        'kibana.password=${KIBANA_PASSWORD}'
      ]
    configs:
      - source: apm.{{ts}}
        target: /usr/share/apm-server/apm-server.yml
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'apm-server'
  # Configure influxdb
  influxdb:
    volumes:
      - '/data/influxdb:/var/lib/influxdb'
      - '/data/backups/influxdb:/data/backups/influxdb'
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.data1 == true
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'influxdb'
  # Configure webapps and add traefik config
  client:
    environment:
      - COUNTRY_CONFIG_URL=https://countryconfig.{{hostname}}
      - HOST={{hostname}}
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: register.{{hostname}},{{hostname}}'
        - 'traefik.frontend.redirect.regex=^https?://{{hostname}}/(.*)'
        - 'traefik.frontend.redirect.replacement=https://register.{{hostname}}/$${1}'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
        - 'traefik.frontend.headers.customResponseHeaders=Pragma:no-cache||Cache-control:no-store||X-Robots-Tag:none'
        - 'traefik.port=80'
        - 'traefik.docker.network=opencrvs_overlay_net'
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'client'

  components:
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: styleguide.{{hostname}},{{hostname}}'
        - 'traefik.frontend.redirect.regex=^https?://{{hostname}}/(.*)'
        - 'traefik.frontend.redirect.replacement=https://styleguide.{{hostname}}/$${1}'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
        - 'traefik.frontend.headers.customResponseHeaders=Pragma:no-cache||Cache-control:no-store||X-Robots-Tag:none'
        - 'traefik.port=80'
        - 'traefik.docker.network=opencrvs_overlay_net'
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'components'

  countryconfig:
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: countryconfig.{{hostname}}'
        - 'traefik.port=3040'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
        - 'traefik.frontend.headers.customResponseHeaders=Pragma:no-cache||Cache-control:no-store||X-Robots-Tag:none'
      replicas: 2
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'countryconfig'
  login:
    environment:
      - COUNTRY_CONFIG_URL=https://countryconfig.{{hostname}}
      - HOST={{hostname}}
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: login.{{hostname}}'
        - 'traefik.port=80'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
        - 'traefik.frontend.headers.customResponseHeaders=Pragma:no-cache||Cache-control:no-store||X-Robots-Tag:none'
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'login'
  # Configure other service with deployment specifc details
  auth:
    secrets:
      - jwt-public-key.{{ts}}
      - jwt-private-key.{{ts}}
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
      - CERT_PRIVATE_KEY_PATH=/run/secrets/jwt-private-key.{{ts}}
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
      - DOMAIN={{hostname}}
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: auth.{{hostname}}'
        - 'traefik.port=4040'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
        - 'traefik.frontend.headers.customResponseHeaders=Pragma:no-cache||Cache-control:no-store||X-Robots-Tag:none'
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'auth'

  user-mgnt:
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
      - MONGO_URL=mongodb://user-mgnt:${USER_MGNT_MONGODB_PASSWORD}@mongo1/user-mgnt?replicaSet=rs0
    deploy:
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'user-mgnt'
  notification:
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
    deploy:
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'notification'
  gateway:
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
      - DOMAIN={{hostname}}
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: gateway.{{hostname}}'
        - 'traefik.port=7070'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
        - 'traefik.frontend.headers.customResponseHeaders=Pragma:no-cache||Cache-control:no-store||X-Robots-Tag:none'
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'gateway'
  workflow:
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
    deploy:
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'workflow'
  search:
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - ES_HOST=search-user:${ROTATING_SEARCH_ELASTIC_PASSWORD}@elasticsearch:9200
      - APN_SERVICE_URL=http://apm-server:8200
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
    deploy:
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'search'
  metrics:
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
    deploy:
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'metrics'
  config:
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
      - MONGO_URL=mongodb://config:${CONFIG_MONGODB_PASSWORD}@mongo1/application-config?replicaSet=rs0
      - DOMAIN={{hostname}}
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: config.{{hostname}}'
        - 'traefik.port=2021'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
        - 'traefik.frontend.headers.customResponseHeaders=Pragma:no-cache||Cache-control:no-store||X-Robots-Tag:none'
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'config'
  migration:
    environment:
      - HEARTH_MONGO_URL=mongodb://hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/hearth-dev?replicaSet=rs0
      - OPENHIM_MONGO_URL=mongodb://openhim:${OPENHIM_MONGODB_PASSWORD}@mongo1/openhim-dev?replicaSet=rs0
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'migration'
  # Configure other dependencies with deployment specifc details
  hearth:
    environment:
      - mongodb__url=mongodb://hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/hearth-dev?replicaSet=rs0
      - logger__level=warn
    depends_on:
      - mongo1
    deploy:
      replicas: 2
    secrets:
      - jwt-public-key.{{ts}}
    configs:
      - source: hearth-check-dupe-plugin.{{ts}}
        target: /src/hearth/lib/plugins/checkDuplicateTask.js
      - source: hearth-queryparam-extensions-conf.{{ts}}
        target: /src/hearth/config/queryparam-extensions.json
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'hearth'
  openhim-core:
    environment:
      - mongo_url=mongodb://openhim:${OPENHIM_MONGODB_PASSWORD}@mongo1/openhim-dev?replicaSet=rs0
      - mongo_atnaUrl=mongodb://openhim:${OPENHIM_MONGODB_PASSWORD}@mongo1/openhim-dev?replicaSet=rs0
    depends_on:
      - mongo1
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.openhim-api.frontend.rule=Host: openhim-api.{{hostname}}'
        - 'traefik.openhim-api.protocol=https'
        - 'traefik.openhim-api.port=8080'
        - 'traefik.router.frontend.rule=Host: api.{{hostname}}'
        - 'traefik.router.port=5001'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'openhim-core'
  openhim-console:
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: openhim.{{hostname}}'
        - 'traefik.port=80'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
      replicas: 2
    configs:
      - source: openhim-console-conf.{{ts}}
        target: /usr/share/nginx/html/config/default.json
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'openhim-console'

  webhooks:
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - APN_SERVICE_URL=http://apm-server:8200
      - MONGO_URL=mongodb://webhooks:${WEBHOOKS_MONGODB_PASSWORD}@mongo1/webhooks?replicaSet=rs0
      - CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.frontend.rule=Host: webhooks.{{hostname}}'
        - 'traefik.port=2525'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.frontend.headers.STSSeconds=31536000'
        - 'traefik.frontend.headers.STSIncludeSubdomains=true'
        - 'traefik.frontend.headers.STSPreload=true'
        - 'traefik.frontend.headers.customResponseHeaders=Pragma:no-cache||Cache-control:no-store||X-Robots-Tag:none'
      replicas: 2
    networks:
      - overlay_net
    logging:
      driver: gelf
      options:
        gelf-address: 'udp://127.0.0.1:12201'
        tag: 'webhooks'
secrets:
  jwt-public-key.{{ts}}:
    external: true
  jwt-private-key.{{ts}}:
    external: true
configs:
  openhim-console-conf.{{ts}}:
    file: ./infrastructure/openhim-console-config.deploy.json
  traefik.{{ts}}:
    file: ./infrastructure/traefik.toml
  hearth-check-dupe-plugin.{{ts}}:
    file: ./infrastructure/hearth-plugins/checkDuplicateTask.js
  hearth-queryparam-extensions-conf.{{ts}}:
    file: ./infrastructure/hearth-queryparam-extensions.json
  metricbeat-conf.{{ts}}:
    file: ./infrastructure/monitoring/beats/metricbeat.yml
  mongo-init.{{ts}}:
    file: ./infrastructure/mongodb/docker-entrypoint-initdb.d/create-mongo-users.sh
  mongo-on-deploy.{{ts}}:
    file: ./infrastructure/mongodb/on-deploy.sh
  metricbeat-rollover-policy.{{ts}}:
    file: ./infrastructure/monitoring/beats/rollover-policy.json
  kibana.{{ts}}:
    file: ./infrastructure/monitoring/kibana/kibana.yml
  apm.{{ts}}:
    file: ./infrastructure/monitoring/apm/apm-server.yml
  logstash.{{ts}}:
    file: ./infrastructure/monitoring/logstash/logstash.yml
  logstash-pipeline.{{ts}}:
    file: ./infrastructure/monitoring/logstash/logstash.conf
networks:
  overlay_net:
    driver: overlay
    attachable: true