docker-compose.yml

# Some people have reported problems with the balrogui API proxy not working correctly.
# This appears to be the same problem reported in https://github.com/docker/compose/issues/2172,
# and seems to only occur with certain (older) versions of docker-compose.
version: '2.1'
services:
  balrogadmin:
    build:
      context: .
      dockerfile: Dockerfile.dev
    depends_on:
      balrogdb:
        condition: service_healthy
    entrypoint:
      - bash
      - scripts/initdb_and_run.sh
    command: admin
    expose:
      - "7070"
    volumes:
      - .:/app
    links:
      - balrogdb
    environment:
      - DBURI=mysql://balrogadmin:balrogadmin@balrogdb/balrog
      - DB_HOST=balrogdb
      - CACHEDIR=.cache
      - SECRET_KEY=blahblah
      - PORT=7070
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
      - INSECURE_SESSION_COOKIE=1
      - LOCALDEV=1
      - FRONTEND_CONFIG=/app/ui/generated/js/config.js
      - AUTH0_CLIENT_ID=GlZhJQfx52b7MLQ19AjuTJHieiB4oh1j
      - AUTH0_REDIRECT_URI=https://localhost:8010/login
      - AUTH0_DOMAIN=balrog-localdev.auth0.com
      - AUTH0_AUDIENCE=balrog-localdev
      - AUTH0_RESPONSE_TYPE=token id_token
      - AUTH0_SCOPE=full-user-credentials openid profile email
      # By default, we disable writes to releases history for local development
      # and read existing history from the production bucket.
      # If you want to test release history writes, you need to set up your own
      # bucket, change these variables, and provide credentials in google.json.
      - RELEASES_HISTORY_BUCKET=balrog-prod-release-history-v1
      - NIGHTLY_HISTORY_BUCKET=balrog-prod-nightly-history-v1
      - GOOGLE_APPLICATION_CREDENTIALS=google.json
      - CORS_ORIGINS=*
      # Grab mail information from the local environment
      - SMTP_HOST
      - SMTP_PORT
      - SMTP_USERNAME
      - SMTP_PASSWORD
      - SMTP_TLS
      - NOTIFY_TO_ADDR
      - NOTIFY_FROM_ADDR
      - STAGING
      - LOCAL_ADMIN
    healthcheck:
        test: nc -z -v balrogadmin 7070
        interval: 5s
        timeout: 30s
        retries: 50


  balrogpub:
    build:
      context: .
      dockerfile: Dockerfile.dev
    depends_on:
      balrogdb:
        condition: service_healthy
    command: public
    ports:
      - "9010:9010"
    volumes:
      - .:/app
    links:
      - autograph
    environment:
      - DBURI=mysql://balrogadmin:balrogadmin@balrogdb/balrog
      - AUTOGRAPH_URL=http://autograph:8000
      - AUTOGRAPH_KEYID=normandy
      - AUTOGRAPH_USERNAME=alice
      - AUTOGRAPH_PASSWORD=fs5wgcer9qj819kfptdlp8gm227ewxnzvsuj9ztycsx08hfhzu
      - SECRET_KEY=blahblah
      - PORT=9010
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
    links:
      - balrogdb


  balrogagent:
    build: ./agent
    depends_on:
      nginx:
        condition: service_healthy
    volumes:
      - ./agent:/app
    links:
      - nginx
    logging:
      driver: none
    environment:
      - BALROG_API_ROOT=http://nginx:8011/api
      - BALROG_USERNAME=balrogagent
      - BALROG_PASSWORD=na
      - TELEMETRY_API_ROOT=abc
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
      - AUTH0_DOMAIN=balrog-localdev.auth0.com
      - AUTH0_AUDIENCE=balrog-localdev
      # Not a real secret. This machine-to-machine clientId is in its own
      # Auth0 account, and has access to nothing except the Balrog
      # local development API.
      - AUTH0_M2M_CLIENT_ID=41U6XJQdSa6CL8oGa6CXvO4aZWlnq5xg
      - AUTH0_M2M_CLIENT_SECRET=updk4Gi1f6ncXDCDBH5ZclbsbIUaZmqvEXYCQLCFI56RnWlnTQXCQe6-h9n86QTv


#  balrogreactui:
#    build: ./react-ui
#    depends_on:
#      balrogadmin:
#        condition: service_healthy
#    ports:
#      - "9000:9000"
#    environment:
#      - BALROG_ROOT_URL=https://localhost:8010
#      - HOST=0.0.0.0
#      - PORT=9000
#    volumes:
#      - ./react-ui:/app
#      - node_modules:/app/node_modules
#    entrypoint:
#      - /bin/bash
#      - --login
#      - -c
#      - yarn install && yarn start


  # This container exists solely to have something automatically rebuilding the UI
  # in the background during local development. Although it runs a web server, we
  # don't use it. Instead, the nginx one below is used as our entry point to more
  # closely mimic production, and support SSL.
  balrogui:
    image: node:0.10
    depends_on:
      balrogadmin:
        condition: service_healthy
    volumes:
      - ./ui:/app
      - .cache:/cache
    environment:
      - WEB_PORT=6060
      - HOST_PROXY=balrogadmin
      - HOST_PROXY_PORT=7070
    entrypoint:
      - /bin/bash
      - /app/docker-entrypoint.sh


  nginx:
    build:
      context: .
      dockerfile: Dockerfile.nginx
    ports:
      - "8010:8010"
      - "8011:8011"
    links:
      - balrogadmin
    volumes:
      - ./scripts/nginx.conf:/etc/nginx/conf.d/http_balrog.conf.template
      - ./scripts/server.crt:/etc/nginx/server.crt
      - ./scripts/server.key:/etc/nginx/server.key
      - ./scripts/dhparam.pem:/etc/nginx/dhparam.pem
    environment:
      - NGINX_PORT=8010
      - NGINX_BALROG_AGENT_PORT=8011
      - BALROG_ADMIN_ROOT=http://balrogadmin:7070
    command: /bin/bash -c "envsubst '$$NGINX_PORT $$NGINX_BALROG_AGENT_PORT $$BALROG_ADMIN_ROOT' < /etc/nginx/conf.d/http_balrog.conf.template > /etc/nginx/conf.d/http_balrog.conf && nginx -g 'daemon off;'"
    healthcheck:
        test: nc -z -v nginx 8010 && nc -z -v nginx 8011
        interval: 5s
        timeout: 30s
        retries: 50


  balrogdb:
    build:
      context: .
      dockerfile: Dockerfile.database
    expose:
      - "3306"
    environment:
      - MYSQL_DATABASE=balrog
      - MYSQL_USER=balrogadmin
      - MYSQL_PASSWORD=balrogadmin
      - MYSQL_ROOT_PASSWORD=admin
    volumes:
      - .cache/mysql:/var/lib/mysql
    logging:
      driver: none
    healthcheck:
        test: nc -z -v balrogdb 3306
        interval: 30s
        timeout: 30s
        retries: 10

  # TODO: provide our own config so that we can guarantee the keyid
  autograph:
    image: mozilla/autograph:latest
    expose:
      - "8000"
    ports:
      - "8000:8000"
    volumes:
      - autographtmp:/tmp/
    logging:
      driver: none
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/__heartbeat__"]
      interval: 60s
      timeout: 10s
      retries: 3

volumes:
  node_modules:
  autographtmp: