docker-compose_development_gdp.yml

# docker-compose version
version: '3.7'

services:
  devmail:
    image: ${CONTAINER_REGISTRY}/mwader/postfix-relay
    container_name: devmail
    depends_on:
      - devdns
    # TODO: is host port expose needed or should we use a docker-network?
    ports:
      - "127.0.0.1:${SMTP_LISTEN_PORT}:25"
    environment:
      POSTFIX_myhostname: ${SMTP_SERVER}
    networks:
      default:
        aliases:
          - mail.migrid.test

  devdns:
    image: ${CONTAINER_REGISTRY}/ruudud/devdns
    container_name: devdns
    ports:
        - "127.0.0.1:53:53/udp"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      TZ: ${TZ}
      NETWORK: ${DOCKER_NETWORK:-docker-migrid_default}

  # NOTE: we use a shared volume init helper container to make sure volumes
  #       are fully created and instantiated before we try to bind mount
  #       subdirs from e.g. the state volume in the service containers.
  migrid-volume-init:
    container_name: migrid-volume-init
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    extends:
      file: docker-compose_shared.yml
      service: migrid-shared
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: 
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
    env_file:
      - migrid-httpd.env
    # NOTE: public hosts should create users through sign up and run like this
    command: /app/docker-entry.sh -V -c

  # The migrid core services including httpd and tightly integrated services
  # like job handling (grid script, monitor, sshmux, imnoty and vmproxy)

  # NOTE: in order to test the publishing of container services on the host
  #       with standard ports on 1.2.3.x one can set up a local dummy device:
  #       sudo ip link add dummylan type dummy
  #       sudo ip addr add 1.2.3.1/24 dev dummylan
  #       sudo ip link set dummylan up
  #
  #       Then use the local firewall to forward the standard low service ports
  #       to the exposed high ones.

  migrid:
    container_name: migrid
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    extends:
      file: docker-compose_shared.yml
      service: migrid-shared
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: httpd script monitor sshmux events cron transfers imnotify vmproxy notify crond rsyslogd
    depends_on:
      devdns:
        condition: service_started
      # IMPORTANT: finish volume init before migrid launch as explained above
      migrid-volume-init:
        condition: service_completed_successfully
    networks:
      default:
        aliases:
          - www.gdp.test
          - cert.gdp.test
          - ext.gdp.test
          - oid.gdp.test
          - sid.gdp.test
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: log
        target: /home/mig/state/log
      # NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount
      - type: bind
        source: ${VGRID_FILES_WRITABLE}
        target: /home/mig/state/vgrid_files_readonly
        read_only: true
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
      # NOTE: openid_store is a volatile state for apache mod auth openid and
      #       gains scalability and performance from using a fast local tmpfs
      - type: bind
        source: ${OPENID_STORE}
        target: /home/mig/state/openid_store
      # To avoid a bit of docker dbus noise
      - type: bind
        source: /run/dbus/system_bus_socket
        target: /run/dbus/system_bus_socket
    env_file:
      - migrid-httpd.env
    # IMPORTANT: please ONLY run with this test@ user for non-public hosts
    command: /app/docker-entry.sh -V -c -u ${MIG_TEST_USER} -p ${MIG_TEST_USER_PASSWORD} -s "sftp ftps webdavs"
    # NOTE: public hosts should create users through sign up and run like this
    #command: /app/docker-entry.sh -V

  # Multiple containers with individual daemons not provided by base migrid
  migrid-openid:
    container_name: migrid-openid
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: openid rsyslogd
    depends_on:
      # IMPORTANT: daemons may require DNS to bind to domain ports
      devdns:
        condition: service_started
      # IMPORTANT: finish volume init before launch as explained above
      migrid-volume-init:
        condition: service_completed_successfully
    ports:
      # NOTE: expose the unique raw port(s) to host 
      - "${OPENID_PORT}:${OPENID_PORT}"
    networks:
      default:
        aliases:
          - openid.gdp.test
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-openid-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: log
        target: /home/mig/state/log
      # NOTE: we don't need read-only vgrids/workgroups in the openid container
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
    command: /app/docker-entry.sh

  migrid-sftp:
    container_name: migrid-sftp
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: sftp sftpsubsys rsyslogd
    depends_on:
      # IMPORTANT: daemons may require DNS to bind to domain ports
      devdns:
        condition: service_started
      # IMPORTANT: finish volume init before launch as explained above
      migrid-volume-init:
        condition: service_completed_successfully
    ports:
      # NOTE: expose the unique raw port(s) to host 
      - "${SFTP_PORT}:${SFTP_PORT}"
      - "${SFTP_SUBSYS_PORT}:${SFTP_SUBSYS_PORT}"
    networks:
      default:
        aliases:
          - sftp.gdp.test
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-sftp-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: log
        target: /home/mig/state/log
      # NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount
      - type: bind
        source: ${VGRID_FILES_WRITABLE}
        target: /home/mig/state/vgrid_files_readonly
        read_only: true
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
    command: /app/docker-entry.sh

  migrid-ftps:
    container_name: migrid-ftps
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: ftps rsyslogd
    depends_on:
      # IMPORTANT: daemons may require DNS to bind to domain ports
      devdns:
        condition: service_started
      # IMPORTANT: finish volume init before launch as explained above
      migrid-volume-init:
        condition: service_completed_successfully
    ports:
      # NOTE: expose the unique raw port(s) to host
      - "${FTPS_CTRL_PORT}:${FTPS_CTRL_PORT}"
      # IMPORTANT: FTPS_PASV_PORTS is colon-separated but range needs hyphen
      # NOTE: compose does not support shell-style replacement so we can't use
      #- "${FTPS_PASV_PORTS/:/-}:${FTPS_PASV_PORTS/:/-}"
      # hard-code them for now.
      - "8100-8399:8100-8399"
    networks:
      default:
        aliases:
          - ftps.gdp.test
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-ftps-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: log
        target: /home/mig/state/log
      # NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount
      - type: bind
        source: ${VGRID_FILES_WRITABLE}
        target: /home/mig/state/vgrid_files_readonly
        read_only: true
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
    command: /app/docker-entry.sh

  migrid-webdavs:
    container_name: migrid-webdavs
    image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}
    environment:
      TZ: ${TZ}
      # RUN_SERVICES specifies which daemons to launch
      # Available target service names follow migrid init script and are:
      #   httpd script monitor sshmux events cron transfers
      #   openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy
      RUN_SERVICES: webdavs rsyslogd
    depends_on:
      # IMPORTANT: daemons may require DNS to bind to domain ports
      devdns:
        condition: service_started
      # IMPORTANT: finish volume init before launch as explained above
      migrid-volume-init:
        condition: service_completed_successfully
    ports:
      # NOTE: expose the unique raw port(s) to host 
      - "${DAVS_PORT}:${DAVS_PORT}"
    networks:
      default:
        aliases:
          - webdavs.gdp.test
    volumes:
      - type: volume
        source: httpd
        target: /etc/httpd
      - type: volume
        source: mig
        target: /home/mig/mig
      - type: volume
        source: certs
        target: /etc/httpd/MiG-certificates
      - type: volume
        source: migrid-webdavs-syslog
        target: /var/log
      - type: volume
        source: state
        target: /home/mig/state
      - type: volume
        source: log
        target: /home/mig/state/log
      # NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount
      - type: bind
        source: ${VGRID_FILES_WRITABLE}
        target: /home/mig/state/vgrid_files_readonly
        read_only: true
      # NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs
      - type: bind
        source: ${MIG_SYSTEM_RUN}
        target: /home/mig/state/mig_system_run
    command: /app/docker-entry.sh

  nginx-proxy:
    image: ${CONTAINER_REGISTRY}/jwilder/nginx-proxy
    environment:
      TZ: ${TZ}
    container_name: nginx-proxy
    # TODO: can we add an httpd health check and switch to wait for condition
    #       service_healthy to avoid the storm of initial avoid nginx errors
    #       from racing apache during start up? Apparently that will not work
    #       with on-going jupyter integration due to swarm mode, however.
    depends_on:
      # IMPORTANT: daemons may require DNS to bind to domain ports
      devdns:
        condition: service_started
      migrid:
        condition: service_started
    ports:
      # NOTE: expose the unique raw port(s) to host 
      - "80:80"
      - "443:443"
      - "444:444"
      - "445:445"
      - "446:446"
      - "447:447"
      - "448:448"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./nginx-proxy-development_gdp.conf:/etc/nginx/conf.d/migrid.conf
      - ./nginx-harden-https.conf:/etc/nginx/harden-https.conf
      - ./certs/MiG/*.gdp.test/server.crt:/etc/nginx/certs/www.gdp.test.crt
      - ./certs/MiG/*.gdp.test/server.crt:/etc/nginx/certs/cert.gdp.test.crt
      - ./certs/MiG/*.gdp.test/server.crt:/etc/nginx/certs/ext.gdp.test.crt
      - ./certs/MiG/*.gdp.test/server.crt:/etc/nginx/certs/oid.gdp.test.crt
      - ./certs/MiG/*.gdp.test/server.crt:/etc/nginx/certs/sid.gdp.test.crt
      - ./certs/MiG/*.gdp.test/server.key:/etc/nginx/certs/www.gdp.test.key
      - ./certs/MiG/*.gdp.test/server.key:/etc/nginx/certs/cert.gdp.test.key
      - ./certs/MiG/*.gdp.test/server.key:/etc/nginx/certs/ext.gdp.test.key
      - ./certs/MiG/*.gdp.test/server.key:/etc/nginx/certs/oid.gdp.test.key
      - ./certs/MiG/*.gdp.test/server.key:/etc/nginx/certs/sid.gdp.test.key
      - ./certs/dhparams.pem:/etc/nginx/dhparam/dhparam.pem

volumes:
  certs:
    # Volume for generated certificates (provided by migrid)
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/certs
      o: bind

  httpd:
    # Volume used for httpd config (provided by migrid)
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/httpd
      o: bind

  mig:
    # Volume used to contain the migrid code and conf (provided by migrid at svn/git)
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/mig
      o: bind

  state:
    # Volume used to contain the migrid state (provided by migrid)
    driver: local
    driver_opts:
      type: none
      device: ${DOCKER_MIGRID_ROOT}/state
      o: bind

  # NOTE: we don't bother setting up persistent data outside state here

  log:
    # Volume used to contain the mig state log folder shared by all containers
    driver: local
    driver_opts:
      type: none
      device: ${LOG_ROOT}/miglog
      o: bind

  migrid-syslog:
    # Volume used for exposing migrid container system log
    driver: local
    driver_opts:
      type: none
      device: ${LOG_ROOT}/migrid
      o: bind

  migrid-openid-syslog:
    # Volume used for exposing migrid openid container system log
    driver: local
    driver_opts:
      type: none
      device: ${LOG_ROOT}/migrid-openid
      o: bind

  migrid-sftp-syslog:
    # Volume used for exposing migrid sftp container system log
    driver: local
    driver_opts:
      type: none
      device: ${LOG_ROOT}/migrid-sftp
      o: bind

  migrid-webdavs-syslog:
    # Volume used for exposing migrid webdavs container system log
    driver: local
    driver_opts:
      type: none
      device: ${LOG_ROOT}/migrid-webdavs
      o: bind

  migrid-ftps-syslog:
    # Volume used for exposing migrid ftps container system log
    driver: local
    driver_opts:
      type: none
      device: ${LOG_ROOT}/migrid-ftps
      o: bind