docker-compose_ssl.yaml

version: '3'
services:
  traefik:
    image: traefik:cantal
    environment:
      - TRAEFIK_PROVIDERS_DOCKER=true
      - TRAEFIK_PROVIDERS_REDIS_ENDPOINTS=redis:6379
      - TRAEFIK_PROVIDERS_REDIS_ROOTKEY=traefik
      - TRAEFIK_PROVIDERS_REDIS_PASSWORD=${REDIS_PASSWORD}
      - TRAEFIK_API_DASHBOARD=true
      - TRAEFIK_PING_MANUALROUTING=true
      - TRAEFIK_LOG_FORMAT=common
      - TRAEFIK_LOG_LEVEL=DEBUG
    networks:
      - pylon
    ports:
      - 80:80
      - 443:443
    volumes:
      - ${CARRIER_PATH}/config/traefik/traefik.toml:/etc/traefik/traefik.toml
      - ${CARRIER_PATH}/config/traefik/ssl.toml:/etc/traefik/ssl.toml
      - ${CARRIER_PATH}/config/traefik/config:/config
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - redis

  redis:
    image: redis:alpine
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
    ports:
      - 6379:6379
    volumes:
      - ${CARRIER_PATH}/redis:/data
    networks:
      - pylon
    container_name: carrier-redis

  rabbitmq:
    image: rabbitmq:3.7-management
    environment:
      - RABBITMQ_DEFAULT_USER=${RABBITMQ_USER}
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD}
      - RABBITMQ_DEFAULT_VHOST=carrier
    networks:
      - pylon
    ports:
      - 15672:15672
      - 5672:5672
#    labels:
#      - 'traefik.enable=true'
#      - 'traefik.http.routers.rabbitmq.rule=Host(`$APP_DOMAIN`) && PathPrefix(`/rabbitmq`)'
#      - 'traefik.http.routers.rabbitmq.middlewares=strip-rabbitmq'
#      - 'traefik.http.middlewares.strip-rabbitmq.stripprefix.prefixes=/rabbitmq'
#      - 'traefik.http.services.rabbitmq.loadbalancer.server.port=15672'
#      - 'traefik.http.routers.rabbitmq.tls=true'
#      - 'traefik.http.routers.rabbitmq.tls.certresolver=le'
#      - 'carrier=rabbitmq'
    volumes:
      - ${CARRIER_PATH}/rabbitmq:/var/lib/rabbitmq
    depends_on:
      - redis
    container_name: carrier-rabbit

  postgres:
    image: postgres:15.1
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    ports:
      - 5432:5432
    container_name: carrier-postgres
    volumes:
      - ${CARRIER_PATH}/postgre:/var/lib/postgresql/data
      - ./config/extras/postgre_schemas.sh:/docker-entrypoint-initdb.d/postgre_schemas.sh
    environment:
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_SCHEMAS=${DB_POSTGRES_SCHEMAS}
      - POSTGRES_INITDB_ARGS=${POSTGRES_INITDB_ARGS}
    networks:
      - pylon

  mongo:
    image: mongo
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    ports:
      - 27017:27017
    container_name: carrier-mongo
    volumes:
      - ${CARRIER_PATH}/mongo:/data/db
    environment:
      - MONGO_INITDB_DATABASE=${MONGO_DB}
      - MONGO_INITDB_ROOT_USERNAME=${MONGO_USER}
      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD}
    networks:
      - pylon

  vault:
    image: vault:1.4.2
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    environment:
      - 'VAULT_LOCAL_CONFIG={"disable_mlock":true,"listener":{"tcp":{"address":"0.0.0.0:8200","tls_disable": 1}},"storage":{"postgresql":{"connection_url":"postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:${POSTGRES_PORT}/${POSTGRES_DB}?sslmode=disable"}},"ui":false}'
    command: vault server -config=/vault/config/local.json
    ports:
    - 8200:8200
    networks:
      - pylon
    depends_on:
      - postgres
    container_name: carrier-vault

  minio:
    image: minio/minio:latest
    command: server /data
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    ports:
      - 9000:9000
    environment:
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY}
      - MINIO_API_SELECT_PARQUET=on
    volumes:
      - ${CARRIER_PATH}/minio:/data
    networks:
      - pylon
    container_name: carrier-minio

  influx:
    image: influxdb:1.8
    restart: unless-stopped
    environment:
      - INFLUXDB_META_DIR=$INFLUXDB_META_DIR
      - INFLUXDB_DATA_DIR=$INFLUXDB_DATA_DIR
      - INFLUXDB_DATA_WAL_DIR=$INFLUXDB_DATA_WAL_DIR
      - INFLUXDB_HTTP_ENABLED=$INFLUXDB_HTTP_ENABLED
      - INFLUXDB_DATA_MAX_SERIES_PER_DATABASE=$INFLUXDB_DATA_MAX_SERIES_PER_DATABASE
    volumes:
      - ${CARRIER_PATH}/influx:/var/lib/influxdb
    ports:
      - 8086:8086
    labels:
      - 'traefik.enable=false'
    networks:
      - pylon
    container_name: carrier-influx

  interceptor:
#    platform: linux/amd64
    image: getcarrier/interceptor:latest
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    depends_on:
      - rabbitmq
    restart: unless-stopped
    container_name: carrier-interceptor
    environment:
      - RAM_QUOTA=$RAM_QUOTA
      - CPU_QUOTA=$CPU_QUOTA
      - CPU_CORES=$INTERPECTOR_TASKS
      - RABBIT_HOST=carrier-rabbit
      - RABBIT_PASSWORD=$RABBITMQ_PASSWORD
      - RABBIT_USER=$RABBITMQ_USER
      - LOKI_HOST=$APP_HOST
    networks:
      - pylon
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  interceptor_internal:
#    platform: linux/amd64
    image: getcarrier/interceptor:latest
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    depends_on:
      - rabbitmq
    restart: unless-stopped
    container_name: carrier-interceptor_internal
    environment:
      - CPU_CORES=$INTERPECTOR_TASKS_INTERNAL
      - RABBIT_HOST=carrier-rabbit
      - RABBIT_PASSWORD=$RABBITMQ_PASSWORD
      - RABBIT_USER=$RABBITMQ_USER
      - LOKI_HOST=$APP_HOST
      - QUEUE_NAME=$INTERNAL_QUEUE
    networks:
      - pylon
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock


  keycloak:
    image: jboss/keycloak:9.0.0
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    container_name: carrier-keycloak
    depends_on:
      - postgres
      - traefik
    volumes:
      - ./config/keycloak/carrier.json:$KEYCLOAK_IMPORT
      - ./config/keycloak/admin.json:/opt/jboss/keycloak/standalone/configuration/keycloak-add-user.json:ro
      - ./config/keycloak/disablessl.sh:/tmp/disablessl.sh
      - ./config/keycloak/themes/src/main/resources/theme:/opt/jboss/keycloak/themes
    environment:
      - DB_VENDOR=$DATABASE_VENDOR
      - DB_ADDR=postgres
      - DB_DATABASE=$POSTGRES_DB
      - DB_SCHEMA=$KEYCLOAK_DB_SCHEMA
      - DB_USER=$POSTGRES_USER
      - DB_PASSWORD=$POSTGRES_PASSWORD
      - KEYCLOAK_IMPORT=$KEYCLOAK_IMPORT
      - PROXY_ADDRESS_FORWARDING=$PROXY_ADDRESS_FORWARDING
    networks:
      - pylon
    ports:
      - 8081:8080
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.keycloak.rule=Host(`$APP_DOMAIN`) && PathPrefix(`/auth`)'
      - 'traefik.http.routers.keycloak.tls=true'
      - 'traefik.http.routers.keycloak.tls.certresolver=le'
      - 'traefik.http.services.keycloak.loadbalancer.server.port=8080'
      - 'carrier=keycloak'

  loki:
    image: grafana/loki:2.3.0
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    networks:
      - pylon
    ports:
      - "3100:3100"
    command: -config.file=/etc/loki/local-config.yaml -table-manager.retention-period=$RETENTION_PERIOD -table-manager.retention-deletes-enabled=$RETENTION_DELETES_ENABLE
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.loki.rule=Host(`$APP_DOMAIN`) && PathPrefix(`/loki`)'
      - 'traefik.http.services.loki.loadbalancer.server.port=3100'
      - 'traefik.http.routers.loki.tls=true'
      - 'traefik.http.routers.loki.tls.certresolver=le'
      - 'carrier=loki'
    container_name: carrier-loki

  grafana:
    image: grafana/grafana:latest
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    depends_on:
      - influx
    volumes:
      - ${CARRIER_PATH}/grafana:/var/lib/grafana
    environment:
      - GF_PANELS_DISABLE_SANITIZE_HTML=$GF_PANELS_DISABLE_SANITIZE_HTML
      - GF_AUTH_PROXY_ENABLED=$GF_AUTH_PROXY_ENABLED
      - GF_SECURITY_ADMIN_PASSWORD=$GF_SECURITY_ADMIN_PASSWORD
      - GF_INSTALL_PLUGINS=$GF_INSTALL_PLUGINS
      - GF_SERVER_ROOT_URL=$GF_SERVER_ROOT_URL
      - GF_SERVER_SERVE_FROM_SUB_PATH=$GF_SERVER_SERVE_FROM_SUB_PATH
      - GF_SECURITY_ADMIN_USER=$GF_SECURITY_ADMIN_USER
      - GF_SECURITY_DISABLE_GRAVATAR=$GF_SECURITY_DISABLE_GRAVATAR
      - GF_SECURITY_ALLOW_EMBEDDING=$GF_SECURITY_ALLOW_EMBEDDING
      - GF_AUTH_DISABLE_LOGIN_FORM=$GF_AUTH_DISABLE_LOGIN_FORM
      - GF_AUTH_SIGNOUT_REDIRECT_URL=$APP_HOST/forward-auth/oidc/logout
      - GF_AUTH_PROXY_HEADER_NAME=$GF_AUTH_PROXY_HEADER_NAME
      - GF_AUTH_PROXY_HEADER_PROPERTY=$GF_AUTH_PROXY_HEADER_PROPERTY
      - GF_AUTH_PROXY_HEADERS=$GF_AUTH_PROXY_HEADERS
      - GF_AUTH_PROXY_AUTO_SIGN_UP=$GF_AUTH_PROXY_AUTO_SIGN_UP
    networks:
      - pylon
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.grafana.rule=Host(`$APP_DOMAIN`) && PathPrefix(`/grafana`)'
      - 'traefik.http.services.grafana.loadbalancer.server.port=3000'
      - 'traefik.http.routers.grafana.tls=true'
      - 'traefik.http.routers.grafana.tls.certresolver=le'
      - 'traefik.http.middlewares.grafana-auth.forwardauth.address=http://pylon_auth:8080/forward-auth/auth?target=header&scope=grafana'
      - 'traefik.http.middlewares.grafana-auth.forwardauth.authResponseHeaders=X-WEBAUTH-USER,X-WEBAUTH-NAME,X-WEBAUTH-EMAIL'
      - 'traefik.http.routers.grafana.middlewares=grafana-auth@docker'
      - 'carrier=grafana'
    user: root
    container_name: carrier-grafana

  pylon:
    image: getcarrier/pylon:latest
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    container_name: carrier-pylon
    user: ${UID}
    depends_on:
      - postgres
      - traefik
      - loki
      - minio
      - redis
      - vault
      - rabbitmq
      - keycloak
      - mongo
    volumes:
      - .:/data
    env_file:
      - .env
    networks:
      - pylon
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.pylon.rule=Host(`$APP_DOMAIN`) && PathPrefix(`/`)'
      - 'traefik.http.services.pylon.loadbalancer.server.port=8080'
      - 'traefik.http.routers.pylon.tls=true'
      - 'traefik.http.routers.pylon.tls.certresolver=le'
      - 'traefik.http.middlewares.pylon-auth.forwardauth.address=http://pylon_auth:8080/forward-auth/auth?target=rpc'
      - 'traefik.http.middlewares.pylon-auth.forwardauth.authResponseHeaders=X-Auth-Type,X-Auth-ID,X-Auth-Reference'
      - 'traefik.http.routers.pylon.middlewares=pylon-auth@docker'
      - 'carrier=pylon'

  pylon_auth:
    image: getcarrier/pylon:latest
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    container_name: carrier-pylon-auth
    user: ${UID}
    depends_on:
      - postgres
      - traefik
      - loki
      - minio
      - redis
      - vault
      - rabbitmq
      - keycloak
    volumes:
      - .:/data
    env_file:
      - .env
    environment:
      - CORE_CONFIG_SEED=file:/data/config/pylon_auth.yml
    networks:
      - pylon
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.pylon-auth.rule=Host(`$APP_DOMAIN`) && PathPrefix(`/forward-auth`)'
      - 'traefik.http.routers.pylon-auth.tls=true'
      - 'traefik.http.routers.pylon-auth.tls.certresolver=le'
      - 'traefik.http.services.pylon-auth.loadbalancer.server.port=8080'
      - 'carrier=pylon-auth'

  pylon_worker:
    image: getcarrier/pylon:latest
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped
    container_name: carrier-pylon-worker
    user: ${UID}
    depends_on:
      - traefik
      - loki
      - minio
      - redis
      - vault
      - rabbitmq
      - mongo
    volumes:
      - .:/data
    env_file:
      - .env
    environment:
      - CORE_CONFIG_SEED=file:/data/config/pylon_worker.yml
    networks:
      - pylon
    labels:
      - 'traefik.enable=false'

networks:
  pylon: