docker-compose.development-deploy.yml

version: '3.3'

services:
  notification:
    environment:
      - LANGUAGES=en,fr
      - SENTRY_DSN=${SENTRY_DSN}
      - QA_ENV=true
      - NODE_ENV=production

  countryconfig:
    image: ${DOCKERHUB_ACCOUNT}/${DOCKERHUB_REPO}:${COUNTRY_CONFIG_VERSION}
    restart: unless-stopped
    secrets:
      - jwt-public-key.{{ts}}
    environment:
      - NODE_ENV=production
      - QA_ENV=true
      - FHIR_URL=http://hearth:3447/fhir
      - AUTH_URL=http://auth:4040
      - APPLICATION_CONFIG_URL=http://config:2021
      - OPENHIM_URL=http://openhim-core:5001/fhir
      - CONFIRM_REGISTRATION_URL=http://openhim-core:5001/confirm/registration
      - CHECK_INVALID_TOKEN=true
      - MONGO_URL=mongodb://mongo1/user-mgnt?replicaSet=rs0
      - SENTRY_DSN=${SENTRY_DSN}
      - SENDER_EMAIL_ADDRESS=${SENDER_EMAIL_ADDRESS}
      - ALERT_EMAIL=${ALERT_EMAIL}
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_USERNAME=${SMTP_USERNAME}
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - SMTP_SECURE=${SMTP_SECURE}
    deploy:
      replicas: 1
    networks:
      - overlay_net

  client:
    environment:
      - DECLARED_DECLARATION_SEARCH_QUERY_COUNT=100

  gateway:
    environment:
      - LANGUAGES=en,fr
      - SENTRY_DSN=${SENTRY_DSN}
      - COUNTRY=IND
      - QA_ENV=true
      - NODE_ENV=production
      - NATIONAL_ID_OIDP_BASE_URL=${NATIONAL_ID_OIDP_BASE_URL}
      - NATIONAL_ID_OIDP_REST_URL=${NATIONAL_ID_OIDP_REST_URL}
      - NATIONAL_ID_OIDP_CLIENT_PRIVATE_KEY=${NATIONAL_ID_OIDP_CLIENT_PRIVATE_KEY}
      - NATIONAL_ID_OIDP_JWT_AUD_CLAIM=${NATIONAL_ID_OIDP_JWT_AUD_CLAIM}

  workflow:
    environment:
      - LANGUAGES=en,fr
      - SENTRY_DSN=${SENTRY_DSN}
      - QA_ENV=true
      - NODE_ENV=production

  search:
    environment:
      - SENTRY_DSN=${SENTRY_DSN}
      - QA_ENV=true
      - NODE_ENV=production

  metrics:
    environment:
      - SENTRY_DSN=${SENTRY_DSN}
      - QA_ENV=true
      - NODE_ENV=production

  auth:
    environment:
      - SENTRY_DSN=${SENTRY_DSN}
      - QA_ENV=true
      - NODE_ENV=production

  user-mgnt:
    environment:
      - SENTRY_DSN=${SENTRY_DSN}
      - QA_ENV=true
      - NODE_ENV=production
      - NATIONAL_ID_OIDP_BASE_URL=${NATIONAL_ID_OIDP_BASE_URL}
      - NATIONAL_ID_OIDP_CLIENT_ID=${NATIONAL_ID_OIDP_CLIENT_ID}
      - NATIONAL_ID_OIDP_ESSENTIAL_CLAIMS=${NATIONAL_ID_OIDP_ESSENTIAL_CLAIMS}

  webhooks:
    environment:
      - SENTRY_DSN=${SENTRY_DSN}
      - QA_ENV=true
      - NODE_ENV=production

  config:
    environment:
      - SENTRY_DSN=${SENTRY_DSN}
      - QA_ENV=true
      - NODE_ENV=production

  documents:
    environment:
      - QA_ENV=true
      - NODE_ENV=production

  scheduler:
    environment:
      - QA_ENV=true
      - NODE_ENV=production

  mosiptokenseeder:
    image: mosipdev/mosip-token-seeder:develop
    ports:
      - '8085:8080'
    deploy:
      replicas: 1
    networks:
      - overlay_net
    volumes:
      - /data/secrets/mosip:/seeder/certs
    restart: unless-stopped
    environment:
      - TOKENSEEDER_MOSIP_AUTH__PARTNER_APIKEY=${TOKENSEEDER_MOSIP_AUTH__PARTNER_APIKEY}
      - TOKENSEEDER_MOSIP_AUTH__PARTNER_MISP_LK=${TOKENSEEDER_MOSIP_AUTH__PARTNER_MISP_LK}
      - TOKENSEEDER_MOSIP_AUTH__PARTNER_ID=${TOKENSEEDER_MOSIP_AUTH__PARTNER_ID}
      - TOKENSEEDER_MOSIP_AUTH_SERVER__IDA_AUTH_DOMAIN_URI=${TOKENSEEDER_MOSIP_AUTH__IDA_AUTH_DOMAIN_URI}
      - TOKENSEEDER_MOSIP_AUTH_SERVER__IDA_AUTH_URL=${TOKENSEEDER_MOSIP_AUTH__IDA_AUTH_URL}
      - TOKENSEEDER_CRYPTO_SIGNATURE__SIGN_P12_FILE_PASSWORD=${TOKENSEEDER_CRYPTO_SIGNATURE__SIGN_P12_FILE_PASSWORD}
      - TOKENSEEDER_AUTHTOKEN__MANDATORY_VALIDATION_AUTH_FIELDS="name,gender,dob"
      - TOKENSEEDER_CRYPTO_ENCRYPT__ENCRYPT_CERT_PATH=/seeder/certs/ida.partner.crt
      - TOKENSEEDER_CRYPTO_SIGNATURE__SIGN_P12_FILE_PATH=/seeder/certs/keystore.p12
      - TOKENSEEDER_ROOT__SYNC_OPERATION_MODE=true

  mosip-mediator:
    image: opencrvs/mosip-api:6cb99d7
    ports:
      - '4545:4545'
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.http.routers.mosip-mediator.rule=Host(`mosip-mediator.{{hostname}}`)'
        - 'traefik.http.services.mosip-mediator.loadbalancer.server.port=4545'
        - 'traefik.http.routers.mosip-mediator.tls=true'
        - 'traefik.http.routers.mosip-mediator.tls.certresolver=certResolver'
        - 'traefik.http.routers.mosip-mediator.entrypoints=web,websecure'
        - 'traefik.docker.network=opencrvs_overlay_net'
        - 'traefik.http.middlewares.mosip-mediator.headers.customresponseheaders.Pragma=no-cache'
        - 'traefik.http.middlewares.mosip-mediator.headers.customresponseheaders.Cache-control=no-store'
        - 'traefik.http.middlewares.mosip-mediator.headers.customresponseheaders.X-Robots-Tag=none'
        - 'traefik.http.middlewares.mosip-mediator.headers.stsseconds=31536000'
        - 'traefik.http.middlewares.mosip-mediator.headers.stsincludesubdomains=true'
        - 'traefik.http.middlewares.mosip-mediator.headers.stspreload=true'
      replicas: 1
    networks:
      - overlay_net
    volumes:
      - /data/secrets/mosip:/certs/mnt
    environment:
      - AUTH_URL=http://auth:4040
      - WEBHOOK_URL=http://webhooks:2525/webhooks
      - OPENHIM_MEDIATOR_URL=http://countryconfig:3040/mosip-openhim-mediator
      - CALLBACK_URL=http://mosip-mediator:4545/webhooks
      - CLIENT_ID=${MOSIP_MEDIATOR_CLIENT_ID}
      - CLIENT_SECRET=${MOSIP_MEDIATOR_CLIENT_SECRET}
      - SHA_SECRET=${MOSIP_MEDIATOR_SHA_SECRET}
      - MOSIP_AUTH_CLIENT_ID=${MOSIP_MEDIATOR_AUTH_CLIENT_ID}
      - MOSIP_AUTH_CLIENT_SECRET=${MOSIP_MEDIATOR_AUTH_CLIENT_SECRET}
      - MOSIP_AUTH_URL=${MOSIP_MEDIATOR_AUTH_URL}
      - MOSIP_AUTH_USER=${MOSIP_MEDIATOR_AUTH_USER}
      - MOSIP_AUTH_PASS=${MOSIP_MEDIATOR_AUTH_PASS}
      - MOSIP_BIRTH_PROXY_CALLBACK_URL=${MOSIP_MEDIATOR_BIRTH_PROXY_CALLBACK_URL}
      - MOSIP_DEATH_PROXY_CALLBACK_URL=${MOSIP_MEDIATOR_DEATH_PROXY_CALLBACK_URL}
      - MOSIP_GENERATE_AID_URL=${MOSIP_MEDIATOR_GENERATE_AID_URL}


  traefik:
    command:
      # Use HTTP-01 challenge as the web server is publicly available
      # https://doc.traefik.io/traefik/https/acme/#httpchallenge
      # For DNS-01 challenge and manual certificates, check staging and production configurations
      - --certificatesresolvers.certResolver.acme.email=riku@opencrvs.org
      - --certificatesresolvers.certResolver.acme.storage=acme.json
      - --certificatesresolvers.certResolver.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
      - --certificatesresolvers.certResolver.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.certResolver.acme.httpchallenge=true

      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --providers.docker
      - --providers.docker.swarmMode=true
      - --api.dashboard=true
      - --api.insecure=true
      - --log.level=WARNING
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --serverstransport.insecureskipverify=true
      - --entrypoints.websecure.address=:443
      - --accesslog=true
      - --accesslog.format=json
      - --ping=true