docker-compose.yml

# This document uses the open "Docker Compose V2" file specification.
# More info: https://www.compose-spec.io and https://github.com/compose-spec/compose-spec/blob/master/spec.md
# Please note this is different from the "Compose file version 2" specification. Which is for Docker Compose V1.
# Hence no `version` is specified in this file.

services:
  webserver:
    image: ${DOCKER_IMAGE_WEBSERVER:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/webserver:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/webserver.Dockerfile
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_WEBSERVER_INTERNAL
      public-internet: {}

    ports:
      - $WEBSERVER_PORT
      - $WEBSERVER_PORT_TLS

    environment:
      - INTERNETNL_DOMAINNAME
      - IPV6_TEST_ADDR
      - MONITORING_AUTH_RAW
      - AUTH_ALL_URLS
      - ALLOW_LIST
      # required for authentication.sh to restrict access when debug is on
      - DEBUG
      - IPV4_IP_APP_INTERNAL
      - IPV4_IP_GRAFANA_INTERNAL
      - IPV4_IP_PROMETHEUS_INTERNAL
      - ENABLE_BATCH
      - LETSENCRYPT_STAGING
      - LETSENCRYPT_EMAIL
      - CERTBOT_SERVER
      - CERTBOT_EAB_KID
      - CERTBOT_EAB_HMAC_KEY
      - REDIRECT_DOMAINS
      - NGINX_PROXY_CACHE
      - INTERNETNL_BRANDING

    # webserver does not depend on any of the other services directly. So it can
    # be started and kept running independently from the other services to
    # provide stale cache or a maintenance page.
    depends_on: {}

    volumes:
      # persist certbot configuration between restarts
      - certbot-config:/etc/letsencrypt
      - htpasswd-files:/etc/nginx/htpasswd/external
      - nginx-logs-exporter:/var/log/nginx/prometheus-nginxlog-exporter/

    healthcheck:
      test: ["CMD", "service", "nginx", "status"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10

  app:
    image: ${DOCKER_IMAGE_APP:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/internet.nl:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/Dockerfile
      target: app
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_APP_INTERNAL
      public-internet: {}
    # configure internal Unbound service for resolving as Docker internal DNS server can be unreliable
    dns: $IPV4_IP_RESOLVER_INTERNAL_PERMISSIVE
    # also disable search domains and force default resolv settings
    dns_search: [.]
    dns_opt: ["ndots:0", "timeout:5", "attempts:2"]
    entrypoint: uwsgi
    command: >
      --module=internetnl.wsgi:application
      --http=0.0.0.0:8080
      --master
      --processes=4
      --stats 127.0.0.1:1717 --stats-http
    depends_on:
      db-migrate:
        # wait for DB migration to be completed
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      postgres:
        condition: service_healthy
      unbound:
        condition: service_healthy
        required: false
      resolver-validating:
        condition: service_healthy
      resolver-permissive:
        condition: service_healthy
    # set hostname for Sentry
    hostname: app
    environment:
      - INTERNET_NL_CHECK_SUPPORT_IPV6
      - INTERNET_NL_CHECK_SUPPORT_DNSSEC
      - INTERNET_NL_CHECK_SUPPORT_MAIL
      - INTERNET_NL_CHECK_SUPPORT_TLS
      - INTERNET_NL_CHECK_SUPPORT_APPSECPRIV
      - INTERNET_NL_CHECK_SUPPORT_RPKI
      - PUBLIC_SUFFIX_LIST_URL
      - ENABLE_BATCH
      - ENABLE_HOF
      - RABBIT_HOST=$IPV4_IP_RABBITMQ_INTERNAL:15672
      - SECRET_KEY
      - GENERATE_SECRET_KEY
      - DB_HOST=$IPV4_IP_POSTGRES_INTERNAL
      - DB_NAME=internetnl_db1
      - DB_USER=internetnl
      - DB_PASSWORD=password
      - CELERY_BROKER_URL=amqp://guest:guest@$IPV4_IP_RABBITMQ_INTERNAL:5672//
      - CELERY_RESULT_BACKEND=redis://$IPV4_IP_REDIS_INTERNAL:6379/0
      - CACHE_LOCATION=redis://$IPV4_IP_REDIS_INTERNAL:6379/0
      - ROUTINATOR_URL
      - DJANGO_IS_PROXIED=True
      - STATSD_HOST=$IPV4_IP_STATSD_INTERNAL
      - ALLOWED_HOSTS
      - DEBUG
      - DEBUG_LOG
      - DEBUG_LOG_UNBOUND
      - INTEGRATION_TESTS
      - INTERNETNL_LOG_LEVEL
      - INTERNETNL_CACHE_TTL
      - CONN_TEST_DOMAIN
      - SMTP_EHLO_DOMAIN
      - IPV6_TEST_ADDR
      - CSP_DEFAULT_SRC
      - IPV4_IP_RESOLVER_INTERNAL_VALIDATING
      - IPV4_IP_RESOLVER_INTERNAL_PERMISSIVE
      - SENTRY_DSN
      - SENTRY_ENVIRONMENT
      - SENTRY_SERVER_NAME
      - MATOMO_URL
      - MATOMO_SITEID
      - MATOMO_SUBDOMAIN_TRACKING
      - MANUAL_HOF_PAGES
      - CLIENT_RATE_LIMIT
      - INTERNETNL_BRANDING
      - INTERNETNL_DOMAINNAME
      - USER_AGENT_URL
    healthcheck:
      test: ["CMD", "nc", "-z", "127.0.0.1", "8080"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10

    volumes:
      - batch_results:/app/batch_results
      - manual-hof:/app/manual-hall-of-fame/

  db-migrate:
    image: ${DOCKER_IMAGE_APP:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/internet.nl:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/Dockerfile
      target: app
    networks:
      - internal
    command: migrate
    # this container runs to completion and exits with 0
    restart: on-failure
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - RABBIT_HOST=$IPV4_IP_RABBITMQ_INTERNAL:15672
      - SECRET_KEY
      - GENERATE_SECRET_KEY
      - DB_HOST=$IPV4_IP_POSTGRES_INTERNAL
      - DB_NAME=internetnl_db1
      - DB_USER=internetnl
      - DB_PASSWORD=password
      # disable redis cache as it is not used in db migrations
      - CACHE_LOCATION=
      # disable batch checks
      - ENABLE_BATCH=False
      - ENABLE_HOF=False
      - DEBUG
      - DEBUG_LOG
      - DEBUG_LOG_UNBOUND
      - INTERNETNL_LOG_LEVEL
      - INTERNETNL_CACHE_TTL
      - WORKER_CONCURRENCY

  worker: &worker
    image: ${DOCKER_IMAGE_APP:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/internet.nl:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/Dockerfile
      target: app
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: $WORKER_MEMORY_LIMIT
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      - internal
      - public-internet
    # configure internal Unbound service for resolving as Docker internal DNS server can be unreliable
    dns: $IPV4_IP_RESOLVER_INTERNAL_PERMISSIVE
    # also disable search domains and force default resolv settings
    dns_search: [.]
    dns_opt: ["ndots:0", "timeout:5", "attempts:2"]

    # run as root because permission need to be set on batch_results directory, drop privileges in entrypoint.sh
    user: root
    entrypoint: /entrypoint-worker.sh
    command: celery --app internetnl worker --without-gossip --pool=eventlet --time-limit=300 --concurrency=$WORKER_CONCURRENCY
      --queues default,celery,db_worker,ipv6_worker,mail_worker,web_worker,resolv_worker,dnssec_worker,rpki_worker,batch_main,batch_callback,batch_scheduler,batch_slow

    depends_on:
      db-migrate:
        # wait for DB migration to be completed
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      postgres:
        condition: service_healthy
      routinator:
        # TODO: convert to service_healthy when healthcheck is added to routinator
        condition: service_started
      unbound:
        condition: service_healthy
        required: false
      resolver-validating:
        condition: service_healthy
      resolver-permissive:
        condition: service_healthy
    # set hostname for Sentry
    hostname: worker
    environment:
      - INTERNET_NL_CHECK_SUPPORT_IPV6
      - INTERNET_NL_CHECK_SUPPORT_DNSSEC
      - INTERNET_NL_CHECK_SUPPORT_MAIL
      - INTERNET_NL_CHECK_SUPPORT_TLS
      - INTERNET_NL_CHECK_SUPPORT_APPSECPRIV
      - INTERNET_NL_CHECK_SUPPORT_RPKI
      - PUBLIC_SUFFIX_LIST_URL
      - ENABLE_BATCH
      - ENABLE_HOF
      - RABBIT_HOST=$IPV4_IP_RABBITMQ_INTERNAL:15672
      - SECRET_KEY
      - GENERATE_SECRET_KEY
      - DB_HOST=$IPV4_IP_POSTGRES_INTERNAL
      - DB_NAME=internetnl_db1
      - DB_USER=internetnl
      - DB_PASSWORD=password
      - CELERY_BROKER_URL=amqp://guest:guest@$IPV4_IP_RABBITMQ_INTERNAL:5672//
      - CELERY_RESULT_BACKEND=redis://$IPV4_IP_REDIS_INTERNAL:6379/0
      - CACHE_LOCATION=redis://$IPV4_IP_REDIS_INTERNAL:6379/0
      - DJANGO_SETTINGS_MODULE=internetnl.settings
      - STATSD_HOST=$IPV4_IP_STATSD_INTERNAL
      - DEBUG
      - DEBUG_LOG
      - DEBUG_LOG_UNBOUND
      - INTEGRATION_TESTS
      - INTERNETNL_LOG_LEVEL
      - INTERNETNL_CACHE_TTL
      - ROUTINATOR_URL
      - CONN_TEST_DOMAIN
      - SMTP_EHLO_DOMAIN
      - INTERNETNL_BRANDING
      - INTERNETNL_DOMAINNAME
      - USER_AGENT_URL
      - IPV4_IP_RESOLVER_INTERNAL_VALIDATING
      - IPV4_IP_RESOLVER_INTERNAL_PERMISSIVE
      - SENTRY_DSN
      - SENTRY_ENVIRONMENT
      - SENTRY_SERVER_NAME
      # even though eventlet is used and childs are not really threads or processes, this settings reduces
      # issues with high memory usage, probably because some objects are freed?
      - CELERYD_MAX_TASKS_PER_CHILD=100

    volumes:
      - batch_results:/app/batch_results

    healthcheck:
      test: ["CMD", "/bin/sh", "-c", "celery --app=internetnl inspect ping --destination=celery@$(hostname)"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10

  # worker for queue with potential memory leak
  worker-nassl:
    # copy all attributes from 'worker' service and overwrite specific settings below
    <<: *worker

    command: celery --app internetnl worker --without-gossip --pool=eventlet --time-limit=300 --concurrency=$WORKER_CONCURRENCY
      --queues nassl_worker

  # cron daemon with access to Docker socket to restart worker-nassl periodically to solve memory issues
  restart-nassl-worker:
    image: alpinelinux/docker-cli:latest
    command: crond -f -d7
    configs:
      - source: restart_nassl_worker_cron
        target: /etc/periodic/hourly/restart_nassl_worker
        mode: 0755
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    network_mode: "none"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  # worker for slow and long running tasks that could require a lot of memory (eg: hof update)
  worker-slow:
    # copy all attributes from 'worker' service and overwrite specific settings below
    <<: *worker
    deploy:
      resources:
        limits:
          memory: $WORKER_SLOW_MEMORY_LIMIT

    command: celery --app internetnl worker --without-gossip --pool=eventlet --time-limit=600 --concurrency=$WORKER_CONCURRENCY
      --queues slow_db_worker
    # set hostname for Sentry
    hostname: worker-slow

  beat:
    image: ${DOCKER_IMAGE_APP:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/internet.nl:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/Dockerfile
      target: app
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      - internal
      - public-internet
    entrypoint: celery
    command: --app internetnl beat
    depends_on:
      db-migrate:
        # wait for DB migration to be completed
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      postgres:
        condition: service_healthy
      routinator:
        # TODO: convert to service_healthy when healthcheck is added to routinator
        condition: service_started
    environment:
      - INTERNET_NL_CHECK_SUPPORT_IPV6
      - INTERNET_NL_CHECK_SUPPORT_DNSSEC
      - INTERNET_NL_CHECK_SUPPORT_MAIL
      - INTERNET_NL_CHECK_SUPPORT_TLS
      - INTERNET_NL_CHECK_SUPPORT_APPSECPRIV
      - INTERNET_NL_CHECK_SUPPORT_RPKI
      - ENABLE_BATCH
      - ENABLE_HOF
      - RABBIT_HOST=$IPV4_IP_RABBITMQ_INTERNAL:15672
      - SECRET_KEY
      - GENERATE_SECRET_KEY
      - DB_HOST=$IPV4_IP_POSTGRES_INTERNAL
      - DB_NAME=internetnl_db1
      - DB_USER=internetnl
      - DB_PASSWORD=password
      - CELERY_BROKER_URL=amqp://guest:guest@$IPV4_IP_RABBITMQ_INTERNAL:5672//
      - CELERY_RESULT_BACKEND=redis://$IPV4_IP_REDIS_INTERNAL:6379/0
      - CACHE_LOCATION=redis://$IPV4_IP_REDIS_INTERNAL:6379/0
      - DJANGO_SETTINGS_MODULE=internetnl.settings
      - STATSD_HOST=$IPV4_IP_STATSD_INTERNAL
      - DEBUG
      - DEBUG_LOG
      - DEBUG_LOG_UNBOUND
      - INTEGRATION_TESTS
      - INTERNETNL_LOG_LEVEL
      - INTERNETNL_CACHE_TTL
      - ROUTINATOR_URL
      - CONN_TEST_DOMAIN
      - SMTP_EHLO_DOMAIN
      - BATCH_SCHEDULER_INTERVAL
      - IPV4_IP_RESOLVER_INTERNAL_VALIDATING
      - IPV4_IP_RESOLVER_INTERNAL_PERMISSIVE
      - SENTRY_DSN
      - SENTRY_ENVIRONMENT
      - SENTRY_SERVER_NAME
    healthcheck:
      test: ["CMD", "pgrep", "celery"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10

  redis:
    image: ${DOCKER_IMAGE_REDIS:-redis:7.0-alpine}
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_REDIS_INTERNAL
    healthcheck:
      test: ["CMD", "redis-cli","ping"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10
    volumes:
      - redis:/data

  rabbitmq:
    image: ${DOCKER_IMAGE_RABBITMQ:-rabbitmq:3.12-management-alpine}
    configs:
      - source: rabbitmq_config
        target: /etc/rabbitmq/rabbitmq.conf
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    user: rabbitmq
    networks:
      internal:
        ipv4_address: $IPV4_IP_RABBITMQ_INTERNAL
    ports:
      # expose admin GUI to localhost
      - $RABBITMQ_GUI
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "--quiet", "check_running"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      # rabbitmq can initially take a long time to start
      start_period: 5m
      retries: 10
    volumes:
      - rabbitmq:/var/lib/rabbitmq

  postgres:
    image: ${DOCKER_IMAGE_POSTGRES:-postgres:15.5-alpine}
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_POSTGRES_INTERNAL
    environment:
      - POSTGRES_USER
      - POSTGRES_PASSWORD
      - POSTGRES_DB
    healthcheck:
      test: pg_isready -U $POSTGRES_USER -d $POSTGRES_DB
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10
    volumes:
      - postgres:/var/lib/postgresql/data

  routinator:
    image: ${DOCKER_IMAGE_ROUTINATOR:-nlnetlabs/routinator:v0.12.1}
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_ROUTINATOR_INTERNAL
      public-internet: {}
    volumes:
      - routinator:/home/routinator/.rpki-cache/

    healthcheck:
      # verify routinator webserver is responsive
      test: wget -q -O/dev/null http://127.0.0.1:9556/
      # TODO: should verify the API endpoint status, but because it takes a long time to start
      # needs refactoring like splitting up the api and sync parts
      # test: wget -q -O/dev/null http://127.0.0.1:9556/api/v1/status
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      # routinator has to rsync a lot of data initally which can take a long time
      start_period: 30m
      retries: 10

  # unbound DNS server used for connection test
  unbound:
    image: ${DOCKER_IMAGE_UNBOUND:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/unbound:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/Dockerfile
      target: unbound
    depends_on:
      redis:
        condition: service_healthy

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_UNBOUND_INTERNAL
      public-internet: {}
    ports:
      - $UNBOUND_PORT_TCP
      - $UNBOUND_PORT_UDP
      - $UNBOUND_PORT_IPV6_TCP
      - $UNBOUND_PORT_IPV6_UDP

    environment:
      - DEBUG_LOG_UNBOUND
      - IPV4_IP_PUBLIC
      - IPV6_IP_PUBLIC
      - CONN_TEST_DOMAIN

    volumes:
      # stores DNSSEC key information and signed zone files
      - unbound-zones:/opt/unbound/etc/unbound/zones/

    healthcheck:
      test: ["CMD", "unbound-control", "status"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10
    profiles:
      - default

  # unbound resolver used for all DNS queries by app, worker, etc that needs to ignore DNSSEC errors and pass them on to the client
  resolver-permissive:
    image: ${DOCKER_IMAGE_UNBOUND:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/unbound:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/Dockerfile
      target: unbound

    entrypoint: /entrypoint-resolver.sh
    command: ["resolver-permissive.conf"]

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_RESOLVER_INTERNAL_PERMISSIVE
      public-internet: {}

    environment:
      - DEBUG_LOG_UNBOUND
      - INTERNETNL_CACHE_TTL

    healthcheck:
      test: ["CMD", "unbound-control", "-c", "/opt/unbound/etc/unbound/resolver-permissive.conf", "status"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10

  # unbound resolver used for ldns-dane that require DNSSEC validation
  resolver-validating:
    image: ${DOCKER_IMAGE_UNBOUND:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/unbound:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/Dockerfile
      target: unbound

    entrypoint: /entrypoint-resolver.sh
    command: ["resolver-validating.conf"]

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_RESOLVER_INTERNAL_VALIDATING
      public-internet: {}

    environment:
      - DEBUG_LOG_UNBOUND
      - INTERNETNL_CACHE_TTL

    healthcheck:
      test: ["CMD", "unbound-control", "-c", "/opt/unbound/etc/unbound/resolver-validating.conf", "status"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10

  cron:
    image: ${DOCKER_IMAGE_CRON:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/cron:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/cron.Dockerfile
    environment:
      - HOSTERS_HOF_URL
      - DB_HOST=$IPV4_IP_POSTGRES_INTERNAL
      - DB_NAME=internetnl_db1
      - DB_USER=internetnl
      - DB_PASSWORD=password
      - CRON_DAILY_POSTGRESQL_BACKUP
      - CRON_WEEKLY_POSTGRESQL_BACKUP
      - IPV4_IP_APP_INTERNAL
      - INTERNETNL_DOMAINNAME
      - INTERNETNL_CACHE_TTL

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal: {}
      public-internet: {}

    # configure internal Unbound service for resolving as Docker internal DNS server can be unreliable
    dns: $IPV4_IP_RESOLVER_INTERNAL_PERMISSIVE
    # also disable search domains and force default resolv settings
    dns_search: [.]
    dns_opt: ["ndots:0", "timeout:5", "attempts:2"]

    volumes:
      - manual-hof:/app/manual-hall-of-fame/
      - postgres-backups:/var/lib/postgresql/backups
      - nginx-logs-exporter:/var/log/nginx/prometheus-nginxlog-exporter/
      - prometheus-textfile-directory:/prometheus-textfile-directory

    healthcheck:
      test: ["CMD", "pgrep", "crond"]
      interval: $HEALTHCHECK_INTERVAL
      # TODO: waiting for: https://github.com/docker/compose/issues/10830
      # start_interval: 5s
      start_period: 1m
      retries: 10

  grafana:
    image: ${DOCKER_IMAGE_GRAFANA:-${DOCKER_REGISTRY:-ghcr.io/internetstandards}/grafana:${RELEASE:-latest}}
    build:
      context: ..
      dockerfile: docker/grafana.Dockerfile

    environment:
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_NAME=Main Org.
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
      - GF_AUTH_BASIC_ENABLED=false
      - GF_AUTH_DISABLE_LOGIN_FORM=true
      - GF_AUTH_DISABLE_SIGNOUT_MENU=true
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/etc/dashboards/home.json
      - GF_SERVER_ROOT_URL=http://localhost:8080/grafana/
      - GF_SERVER_SERVE_FROM_SUB_PATH=true
      # disable grafana from trying to reach out and filling logging with failed DNS queries
      - GF_ANALYTICS_CHECK_FOR_UPDATES=false
      - GF_ANALYTICS_REPORTING_ENABLED=false
      - GF_ANALYTICS_CHECK_FOR_PLUGIN_UPDATES=false
      # disables live functionality which is not used, because it uses websockets which don't play well with authentication
      - GF_LIVE_MAX_CONNECTIONS=0
      - INTERNETNL_DOMAINNAME

    volumes:
      - grafana-data:/var/lib/grafana

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_GRAFANA_INTERNAL

  prometheus:
    image: ${DOCKER_IMAGE_PROMETHEUS:-prom/prometheus:v2.44.0}

    command:
      - --config.file=/prometheus.yaml
      - --web.external-url=/prometheus/
      - --storage.tsdb.retention=5y
      - --web.enable-admin-api

    configs:
      - source: prometheus_config
        target: /prometheus.yaml

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_PROMETHEUS_INTERNAL

    volumes:
      - prometheus-data:/prometheus

  postgresql-exporter:
    image: ${DOCKER_IMAGE_POSTGRESQL_EXPORTER:-prometheuscommunity/postgres-exporter:v0.12.0}

    environment:
      - DATA_SOURCE_NAME=postgresql://$POSTGRES_USER:$POSTGRES_PASSWORD@$IPV4_IP_POSTGRES_INTERNAL:5432/$POSTGRES_DB?sslmode=disable

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      - internal

  redis-exporter:
    image: oliver006/redis_exporter:v1.50.0

    environment:
      - REDIS_ADDR=redis://$IPV4_IP_REDIS_INTERNAL:6379

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      - internal

  statsd-exporter:
    image: ${DOCKER_IMAGE_STATSD_EXPORTER:-prom/statsd-exporter:v0.23.1}

    command:
      - --statsd.listen-udp=:8125
      - --statsd.listen-tcp=:8125

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      internal:
        ipv4_address: $IPV4_IP_STATSD_INTERNAL
        aliases:
          - statsd

  celery-exporter:
    image: aequitas/celery-exporter:0.9.1
    command:
      - --broker-url=amqp://guest:guest@$IPV4_IP_RABBITMQ_INTERNAL:5672/
      - --accept-content=json,pickle
      # retry connecting to broker on failure
      - --retry-interval=10
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      - internal
    depends_on:
      rabbitmq:
        condition: service_healthy

  # https://github.com/prometheus/node_exporter#docker
  node-exporter:
    image: quay.io/prometheus/node-exporter:v1.6.1
    command:
      - --path.rootfs=/host
      - --collector.systemd
      # disable metrics about the exporter itself
      - --web.disable-exporter-metrics
      # ignore docker container interfaces
      - --collector.netdev.device-exclude=veth
      # ignore docker container interfaces
      - --collector.netclass.ignored-devices=veth
      - --collector.textfile
      - --collector.textfile.directory=/prometheus-textfile-directory
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    pid: host
    networks:
      - internal
    volumes:
      - /:/host:ro
      - /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket
      - prometheus-textfile-directory:/prometheus-textfile-directory

  docker_stats_exporter:
    # https://github.com/jan4843/docker_stats_exporter
    image: aequitas/docker-stats-exporter:0.1.0
    environment:
      LABEL_state: '{{.Container.State}}'
      LABEL_compose_project: '{{index .Container.Labels "com.docker.compose.project"}}'
    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      - internal
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  nginx_logs_exporter:
    image: ghcr.io/martin-helmich/prometheus-nginxlog-exporter/exporter:v1
    command:
      - -config-file=/config.hcl
    configs:
      - source: nginx_logs_exporter_config
        target: /config.hcl

    restart: unless-stopped
    logging:
      driver: $LOGGING_DRIVER
      options:
        tag: '{{.Name}}'
    networks:
      - internal
    volumes:
      - nginx-logs-exporter:/var/log/nginx/prometheus-nginxlog-exporter/

volumes:
  postgres: {}
  postgres-backups: {}
  redis: {}
  rabbitmq: {}
  routinator: {}
  batch_results: {}
  certbot-config: {}
  htpasswd-files: {}
  unbound-zones: {}
  # permanent storage for Prometheus metrics
  prometheus-data: {}
  # prometheus metric textfile shared volume
  prometheus-textfile-directory: {}
  # permanent storage for Grafana custom dashboards
  grafana-data: {}
  # shares hosters HoF file between cron and app
  manual-hof: {}
  # shares nginx log files with log exporter
  nginx-logs-exporter: {}

configs:
  nginx_logs_exporter_config:
    content: |
      namespace "nginx" {
        format = "$$remote_addr $$host $$remote_user [$$time_local] $$proxy_host \"$$request\" $$status $$body_bytes_sent \"$$http_referer\" \"$$http_user_agent\" \"$$http_x_forwarded_for\""

        source = {
          files = ["/var/log/nginx/prometheus-nginxlog-exporter/access.log"]
        }

        relabel "proxy_host" { from = "proxy_host" }
        relabel "remote_user" { from = "remote_user" }
      }
  rabbitmq_config:
    content: |
      # RabbitMQ requires messages to be acked in 30 minutes or else it will mark  a client as stale. This conflicts
      # with Celery tasks that have a countdown or eta set beyond 30 minutes as they are not acked before this time.
      # Setting this timeout to 1 year here to work around this issue. Related error and info:
      # amqp.exceptions.PreconditionFailed: (0, 0): (406) PRECONDITION_FAILED - consumer ack timed out on channel 1
      # https://github.com/celery/celery/issues/6760
      consumer_timeout = 31622400000
  prometheus_config:
    content: |
      global:
        scrape_interval: 10s
        scrape_timeout: 5s
      scrape_configs:
        - &scrape_config
          scheme: http
          metrics_path: /metrics
          metric_relabel_configs:
            # drop exporter internal metrics
            - source_labels: [ "__name__" ]
              regex: '(go|python|process)_.+'
              action: drop
          job_name: postgresql_exporter
          static_configs: [{targets: ["postgresql-exporter:9187"]}]
        - <<: *scrape_config
          job_name: redis_exporter
          static_configs: [{targets: ["redis-exporter:9121"]}]
        - <<: *scrape_config
          job_name: rabbitmq_exporter
          static_configs: [{targets: ["rabbitmq:15692"]}]
        - <<: *scrape_config
          job_name: statsd_exporter
          static_configs: [{targets: ["statsd-exporter:9102"]}]
        - <<: *scrape_config
          job_name: celery_exporter
          static_configs: [{targets: ["celery-exporter:9808"]}]
        - <<: *scrape_config
          job_name: node_exporter
          static_configs: [{targets: ["node-exporter:9100"]}]
        - <<: *scrape_config
          job_name: docker_stats_exporter
          static_configs: [{targets: ["docker_stats_exporter:9338"]}]
        - <<: *scrape_config
          job_name: nginx_logs_exporter
          static_configs: [{targets: ["nginx_logs_exporter:4040"]}]

  restart_nassl_worker_cron:
    content: |
      #!/bin/sh
      set -e
      # find nassl worker and restart the container
      docker restart $(docker ps --filter label=com.docker.compose.service=worker-nassl --quiet)

networks:
  # disable default network
  default:
    driver: none
  internal:
    internal: true
    driver: bridge
    # no IPv6 required
    enable_ipv6: false
    ipam:
      driver: default
      config:
      - subnet: $IPV4_SUBNET_INTERNAL

  # allows connected services to access public internet
  public-internet:
    # required to enable IPv6 on Docker Desktop runtime
    enable_ipv6: true
    driver: bridge
    driver_opts:
      # required to enable IPv6 on Colima Docker runtime
      com.docker.network.enable_ipv6: "true"
      # network for internal communication between services
      com.docker.network.bridge.enable_icc: "true"
    ipam:
      driver: default
      config:
      - subnet: $IPV6_SUBNET_PUBLIC
        gateway: $IPV6_GATEWAY_PUBLIC
      - subnet: $IPV4_SUBNET_PUBLIC