/
docker-compose.prod.yml
135 lines (123 loc) · 4.47 KB
/
docker-compose.prod.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
version: '3.8'
# --- Base config -------------------------------------------------------------
x-default-opts:
&default-opts
logging:
options:
max-size: '1m'
max-file: '3'
# --- Base Django config ------------------------------------------------------
x-django-config:
&django-config
image: ghcr.io/uccser/cs-field-guide:${CS_FIELD_GUIDE_IMAGE_TAG}
environment:
POSTGRES_HOST: postgres
POSTGRES_PORT: "5432"
DEPLOYMENT_ENVIRONMENT_FILE: /cs-field-guide_deployment_environment
DJANGO_SECRET_KEY_FILE: /run/secrets/cs-field-guide_django_secret_key
POSTGRES_DB_FILE: /run/secrets/cs-field-guide_postgres_db
POSTGRES_USER_FILE: /run/secrets/cs-field-guide_postgres_user
POSTGRES_PASSWORD_FILE: /run/secrets/cs-field-guide_postgres_password
configs:
- cs-field-guide_deployment_environment
secrets:
- cs-field-guide_django_secret_key
- cs-field-guide_postgres_db
- cs-field-guide_postgres_user
- cs-field-guide_postgres_password
# -----------------------------------------------------------------------------
services:
django:
<<: *default-opts
<<: *django-config
deploy:
replicas: 2
placement:
constraints:
- node.role==worker
- node.labels.role==apps
restart_policy:
condition: on-failure
labels:
- "traefik.enable=true"
- "traefik.docker.network=uccser-public"
- "traefik.http.services.cs-field-guide-django.loadbalancer.server.port=8000"
- "traefik.http.routers.cs-field-guide-django.service=cs-field-guide-django"
- "traefik.http.routers.cs-field-guide-django.rule=${CS_FIELD_GUIDE_ROUTER_RULE}"
- "traefik.http.routers.cs-field-guide-django.entryPoints=web"
# Redirect non-www to www, only triggers in production swarm.
- "traefik.http.middlewares.cs-field-guide-redirect-non-www.redirectregex.regex=^https://csfieldguide\\.org(.*)"
- "traefik.http.middlewares.cs-field-guide-redirect-non-www.redirectregex.replacement=https://www.csfieldguide.org$${1}"
- "traefik.http.middlewares.cs-field-guide-redirect-non-www.redirectregex.permanent=true"
networks:
- uccser-public
- backend
task-update-data:
<<: *default-opts
<<: *django-config
command: python ./manage.py update_data
deploy:
replicas: 0
placement:
constraints:
- node.role==worker
- node.labels.role==apps
restart_policy:
condition: none
healthcheck:
disable: true
networks:
- backend
postgres:
<<: *default-opts
image: postgres:13.8
# TODO: Write test script that reads secret files
# to get correct username
# healthcheck:
# test: ["CMD-SHELL", "pg_isready -U postgres"]
# start_period: 10s
# interval: 10s
# timeout: 5s
# retries: 3
deploy:
replicas: 1
placement:
constraints:
- node.role==worker
- node.labels.role==data
restart_policy:
condition: on-failure
environment:
POSTGRES_DB_FILE: /run/secrets/cs-field-guide_postgres_db
POSTGRES_USER_FILE: /run/secrets/cs-field-guide_postgres_user
POSTGRES_PASSWORD_FILE: /run/secrets/cs-field-guide_postgres_password
secrets:
- cs-field-guide_postgres_db
- cs-field-guide_postgres_user
- cs-field-guide_postgres_password
networks:
- backend
volumes:
- postgres-data:/var/lib/postgresql/data:Z
- postgres-data-backups:/backups:z
configs:
cs-field-guide_deployment_environment:
external: true
secrets:
cs-field-guide_django_secret_key:
external: true
cs-field-guide_postgres_db:
external: true
cs-field-guide_postgres_user:
external: true
cs-field-guide_postgres_password:
external: true
networks:
uccser-public:
external: true
backend:
driver: overlay
attachable: true
volumes:
postgres-data: {}
postgres-data-backups: {}