docker-compose.yml

# Docker Compose file to start a full ESGF node.
#
# Required env variables:
#
# ESGF_CONFIG : points to the root ESGF configuration directory
#       example: export ESGF_CONFIG=/Users/cinquini/ESGF_CONFIG
# ESGF_HOSTNAME: HostName or IP address for apache httpd front-end server
#       example: export ESGF_HOSTNAME=my.esgf.node
#       example: export ESGF_HOSTNAME=`docker-machine ip`
# ESGF_VERSION: version of ESGF/Docker distribution
#       example: export ESGF_VERSION=1.0
# ESGF_DATA_DIR: root of ESGF data directories

version: '3.4'


services:
  # Build dependency only
  esgf-configure:
    image: "${ESGF_HUB}/esgf-configure:${ESGF_VERSION}"
    build: ./configure
    # Use an entrypoint that exits immediately with success
    entrypoint: ["true"]
    # Environment variables required for config files
    # This uses a YAML anchor so that these are easy to reference elsewhere
    environment: &config_env
      ESGF_HOSTNAME:
      ESGF_DATABASE_HOST: esgf-postgres

  # Build dependency only
  esgf-tomcat:
    image: "${ESGF_HUB}/esgf-tomcat:${ESGF_VERSION}"
    build: ./tomcat
    # Use an entrypoint that exits immediately with success
    entrypoint: ["true"]

  # Build dependency only
  esgf-django:
    image: "${ESGF_HUB}/esgf-django:${ESGF_VERSION}"
    build: ./django
    # Use an entrypoint that exits immediately with success
    entrypoint: ["true"]

  # The setup is included here so it can be used with docker-compose run
  # The command is modified to a simple quit with 0 exit status
  esgf-setup:
    image: "${ESGF_HUB}/esgf-setup:${ESGF_VERSION}"
    build: ./setup
    environment:
      ESGF_HOSTNAME:
    volumes:
      - "$ESGF_CONFIG:/esg"
    # Use a command that exits immediately with success
    command: ["true"]

  # The publisher is included here so it can be used with docker-compose run
  # The command is modified to a simple quit with 0 exit status
  esgf-publisher:
    image: "${ESGF_HUB}/esgf-publisher:${ESGF_VERSION}"
    build: ./publisher
    environment:
      <<: *config_env
      ESGF_DATABASE_PASSWORD_FILE: /esg/secrets/database-password
      ESGF_TDS_USERNAME: rootAdmin
      ESGF_TDS_PASSWORD_FILE: /esg/secrets/rootadmin-password
      ESGF_ROOTADMIN_PASSWORD_FILE: /esg/secrets/rootadmin-password
    volumes:
      - "$ESGF_DATA:/esg/data:ro"
      - "tds-content:/esg/content/thredds/esgcet"
      # Mount only the secrets we actually need
      - "$ESGF_CONFIG/secrets/database-password:/esg/secrets/database-password:ro"
      - "$ESGF_CONFIG/secrets/rootadmin-password:/esg/secrets/rootadmin-password:ro"
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    # Use a command that exits immediately with success, but don't change the entrypoint
    command: ["true"]

  esgf-proxy:
    image: "${ESGF_HUB}/esgf-proxy:${ESGF_VERSION}"
    build: ./proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "$ESGF_CONFIG/certificates/hostcert:/etc/nginx/ssl:ro"
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    environment:
      ESGF_HOSTNAME:
      ESGF_SOLR_UPSTREAM: http://esgf-solr:8983
      ESGF_INDEX_NODE_UPSTREAM: http://esgf-index-node:8080
      ESGF_TDS_UPSTREAM: http://esgf-tds:8080
      ESGF_COG_UPSTREAM: http://esgf-cog:8000
      ESGF_ORP_UPSTREAM: http://esgf-orp:8080
      ESGF_IDP_UPSTREAM: http://esgf-idp-node:8080
      ESGF_SLCS_UPSTREAM: http://esgf-slcs:8000
      ESGF_AUTH_UPSTREAM: http://esgf-auth:8000
    depends_on:
      - esgf-solr
      - esgf-index-node
      - esgf-tds
      - esgf-orp
      - esgf-idp-node
      - esgf-slcs
      - esgf-auth
      - esgf-cog

  # Zookeeper is not replicated (yet), but is used to store solr config
  esgf-zookeeper:
    image: "zookeeper:${ZOOKEEPER_VERSION}"
    restart: always
    expose:
      - "2181"
      - "2888"
      - "3888"
    volumes:
      - "zk-data:/data"
      - "zk-datalog:/datalog"
    healthcheck:
      test: ["CMD-SHELL", "echo ruok | nc 127.0.0.1 2181 | grep imok"]
      interval: 10s
      timeout: 5s
      retries: 3

  esgf-solr:
    image: "${ESGF_HUB}/esgf-solr:${ESGF_VERSION}"
    build: ./solr
    restart: always
    environment:
      SOLR_HOME: /esg/solr-home
      SOLR_HEAP: 1g
      ZOOKEEPER_HOST: esgf-zookeeper
    command:
      - "solr-foreground"
      - "-c"
      - "-p"
      - "8983"
      - "-z"
      - "esgf-zookeeper:2181"
      - "-s"
      - "/esg/solr-home"
    volumes:
      - "solr-home:/esg/solr-home"
    depends_on:
      - esgf-zookeeper

  esgf-postgres:
    image: "${ESGF_HUB}/esgf-postgres:${ESGF_VERSION}"
    build: ./postgres
    restart: always
    environment:
      DBSUPER_PASSWORD_FILE: /esg/secrets/database-password
      ESGCET_PASSWORD_FILE: /esg/secrets/database-publisher-password
      ESGF_ROOTADMIN_EMAIL: "CoG@${ESGF_HOSTNAME}"
      ESGF_ROOTADMIN_USERNAME: rootAdmin
      ESGF_ROOTADMIN_OPENID: https://${ESGF_HOSTNAME}/esgf-idp/openid/rootAdmin
      ESGF_ROOTADMIN_PASSWORD_FILE: /esg/secrets/rootadmin-password
    volumes:
      # Mount only the secrets we actually need
      - "$ESGF_CONFIG/secrets/database-password:/esg/secrets/database-password:ro"
      - "$ESGF_CONFIG/secrets/database-publisher-password:/esg/secrets/database-publisher-password:ro"
      - "$ESGF_CONFIG/secrets/rootadmin-password:/esg/secrets/rootadmin-password:ro"
      - "postgres-data:/var/lib/pgsql/data"

  esgf-orp:
    image: "${ESGF_HUB}/esgf-orp:${ESGF_VERSION}"
    build:
      context: ./orp
      args:
        ESGF_HUB: $ESGF_HUB
        ESGF_VERSION: $ESGF_VERSION
    restart: always
    environment:
      <<: *config_env
      ESGF_SAML_CERT_FILE: /esg/certificates/hostcert/hostcert.crt
      ESGF_SAML_KEY_FILE: /esg/certificates/hostcert/hostcert.key
    volumes:
      # Mount the host certificate and key for SAML signing
      - "$ESGF_CONFIG/certificates/hostcert:/esg/certificates/hostcert:ro"
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    depends_on:
      - esgf-configure
      - esgf-tomcat

  esgf-index-node:
    image: "${ESGF_HUB}/esgf-index-node:${ESGF_VERSION}"
    build:
      context: ./index-node
      args:
        ESGF_HUB: $ESGF_HUB
        ESGF_VERSION: $ESGF_VERSION
    restart: always
    environment:
      <<: *config_env
      ESGF_SOLR_HOSTNAME: esgf-solr:8983
    volumes:
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    depends_on:
      - esgf-configure
      - esgf-tomcat
      - esgf-solr
      - esgf-orp

  esgf-idp-node:
    image: "${ESGF_HUB}/esgf-idp-node:${ESGF_VERSION}"
    build:
      context: ./idp-node
      args:
        ESGF_HUB: $ESGF_HUB
        ESGF_VERSION: $ESGF_VERSION
    restart: always
    environment:
      <<: *config_env
    volumes:
      - "$ESGF_CONFIG/secrets/database-password:/esg/config/.esg_pg_pass:ro"
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    depends_on:
      - esgf-configure
      - esgf-tomcat
      - esgf-postgres

  esgf-tds:
    image: "${ESGF_HUB}/esgf-tds:${ESGF_VERSION}"
    build:
      context: ./tds
      args:
        ESGF_HUB: $ESGF_HUB
        ESGF_VERSION: $ESGF_VERSION
    environment:
      <<: *config_env
      ESGF_COOKIE_SECRET_KEY_FILE: /esg/secrets/shared-cookie-secret-key
      ESGF_TDS_ADMIN_PASSWORD_FILE: /esg/secrets/rootadmin-password
    volumes:
      - "tds-content:/esg/content/thredds/esgcet"
      - "$ESGF_DATA:/esg/data:ro"
      # Mount only the secrets we actually need
      - "$ESGF_CONFIG/secrets/shared-cookie-secret-key:/esg/secrets/shared-cookie-secret-key:ro"
      - "$ESGF_CONFIG/secrets/rootadmin-password:/esg/secrets/rootadmin-password:ro"
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    depends_on:
      - esgf-configure
      - esgf-tomcat
      - esgf-postgres

  esgf-cog:
    image: "${ESGF_HUB}/esgf-cog:${ESGF_VERSION}"
    build:
      context: ./cog
      args:
        ESGF_HUB: $ESGF_HUB
        ESGF_VERSION: $ESGF_VERSION
    restart: always
    environment:
      <<: *config_env
      ESGF_COG_TIME_ZONE: "Europe/London"
      ESGF_COG_SECRET_KEY_FILE: /esg/secrets/cog-secret-key
    volumes:
      - "$ESGF_CONFIG/secrets/database-password:/esg/config/.esg_pg_pass:ro"
      - "$ESGF_CONFIG/secrets/rootadmin-password:/esg/config/.esgf_pass:ro"
      - "$ESGF_CONFIG/secrets/cog-secret-key:/esg/secrets/cog-secret-key:ro"
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    depends_on:
      - esgf-configure
      - esgf-django
      - esgf-postgres

  esgf-auth-postgres:
    image: "postgres:${POSTGRES_VERSION}"
    restart: always
    environment:
      POSTGRES_USER: authuser
      POSTGRES_PASSWORD_FILE: /esg/secrets/auth-database-password
      POSTGRES_DB: auth
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8"
    volumes:
      - "$ESGF_CONFIG/secrets/auth-database-password:/esg/secrets/auth-database-password:ro"
      - "auth-postgres-data:/var/lib/postgresql/data"

  esgf-auth:
    image: "${ESGF_HUB}/esgf-auth:${ESGF_VERSION}"
    build:
      context: ./auth
      args:
        ESGF_HUB: $ESGF_HUB
        ESGF_VERSION: $ESGF_VERSION
    restart: always
    environment:
      <<: *config_env
      SCRIPT_NAME: /esgf-auth
      ESGF_AUTH_SECRET_KEY_FILE: /esg/secrets/auth-secret-key
      ESGF_COOKIE_SECRET_KEY_FILE: /esg/secrets/shared-cookie-secret-key
      # Database settings
      DJANGO_DATABASE_DEFAULT_ENGINE: django.db.backends.postgresql
      DJANGO_DATABASE_DEFAULT_NAME: auth
      DJANGO_DATABASE_DEFAULT_HOST: esgf-auth-postgres
      DJANGO_DATABASE_DEFAULT_PORT: "5432"
      DJANGO_DATABASE_DEFAULT_USER: authuser
      DJANGO_DATABASE_DEFAULT_PASSWORD_FILE: /esg/secrets/auth-database-password
    volumes:
      - "$ESGF_CONFIG/secrets/auth-secret-key:/esg/secrets/auth-secret-key:ro"
      - "$ESGF_CONFIG/secrets/shared-cookie-secret-key:/esg/secrets/shared-cookie-secret-key:ro"
      - "$ESGF_CONFIG/secrets/auth-database-password:/esg/secrets/auth-database-password:ro"
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    depends_on:
      - esgf-configure
      - esgf-django
      - esgf-auth-postgres

  esgf-slcs-postgres:
    image: "postgres:${POSTGRES_VERSION}"
    restart: always
    environment:
      POSTGRES_USER: slcsuser
      POSTGRES_PASSWORD_FILE: /esg/secrets/slcs-database-password
      POSTGRES_DB: slcs
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8"
    volumes:
      - "$ESGF_CONFIG/secrets/slcs-database-password:/esg/secrets/slcs-database-password:ro"
      - "slcs-postgres-data:/var/lib/postgresql/data"

  esgf-slcs:
    image: "${ESGF_HUB}/esgf-slcs:${ESGF_VERSION}"
    build:
      context: ./slcs
      args:
        ESGF_HUB: $ESGF_HUB
        ESGF_VERSION: $ESGF_VERSION
    restart: always
    environment:
      # Generic Django settings
      SCRIPT_NAME: /esgf-slcs
      DJANGO_ALLOWED_HOSTS: $ESGF_HOSTNAME
      DJANGO_SECRET_KEY_FILE: /esg/secrets/slcs-secret-key
      # SLCS database
      DJANGO_DATABASE_DEFAULT_ENGINE: django.db.backends.postgresql
      DJANGO_DATABASE_DEFAULT_NAME: slcs
      DJANGO_DATABASE_DEFAULT_HOST: esgf-slcs-postgres
      DJANGO_DATABASE_DEFAULT_PORT: "5432"
      DJANGO_DATABASE_DEFAULT_USER: slcsuser
      DJANGO_DATABASE_DEFAULT_PASSWORD_FILE: /esg/secrets/slcs-database-password
      # ESGF User database
      DJANGO_DATABASE_USERDB_ENGINE: django.db.backends.postgresql
      DJANGO_DATABASE_USERDB_NAME: esgcet
      DJANGO_DATABASE_USERDB_HOST: esgf-postgres
      DJANGO_DATABASE_USERDB_PORT: "5432"
      DJANGO_DATABASE_USERDB_USER: dbsuper
      DJANGO_DATABASE_USERDB_PASSWORD_FILE: /esg/secrets/database-password
      # Make the rootAdmin account a superuser
      DJANGO_CREATE_SUPERUSER: "1"
      DJANGO_SUPERUSER_USERNAME: "rootAdmin"
      DJANGO_SUPERUSER_EMAIL: "CoG@${ESGF_HOSTNAME}"
      # Other SLCS-specific settings
      ESGF_SLCS_URL: "https://${ESGF_HOSTNAME}/esgf-slcs"
      ESGF_SLCS_BASIC_AUTH_REALM: $ESGF_HOSTNAME
      ONLINECA_CERT_SUBJECT_TEMPLATE: /DC=esgf/CN=$$OPENID
      ONLINECA_CERT_FILEPATH: /esg/certificates/slcsca/ca.crt
      ONLINECA_KEY_FILEPATH: /esg/certificates/slcsca/ca.key
      ONLINECA_TRUSTROOTS_DIR: /esg/certificates/slcsca/trustroots
    volumes:
      - "$ESGF_CONFIG/secrets/slcs-secret-key:/esg/secrets/slcs-secret-key:ro"
      - "$ESGF_CONFIG/secrets/slcs-database-password:/esg/secrets/slcs-database-password:ro"
      - "$ESGF_CONFIG/secrets/database-password:/esg/secrets/database-password:ro"
      - "$ESGF_CONFIG/certificates/slcsca/ca.crt:/esg/certificates/slcsca/ca.crt:ro"
      - "$ESGF_CONFIG/certificates/slcsca/ca.key:/esg/certificates/slcsca/ca.key:ro"
      # Just mount an empty volume as the trustroots for now
      - "slcs-trustroots:/esg/certificates/slcsca/trustroots/:ro"
      # Make sure the trusted certificate bundle is available
      - "$ESGF_CONFIG/certificates/esg-trust-bundle.pem:/esg/certificates/esg-trust-bundle.pem:ro"
    depends_on:
      - esgf-django
      - esgf-postgres
      - esgf-slcs-postgres


# Use Docker volumes to store persistent data
volumes:
  zk-data:
  zk-datalog:
  solr-home:
  postgres-data:
  tds-content:
  slcs-postgres-data:
  slcs-trustroots:
  auth-postgres-data: