docker-compose.yml

services:
  www:
    build:
      context: www
      args:
      - DESECSTACK_API_SEPA_CREDITOR_ID=${DESECSTACK_API_SEPA_CREDITOR_ID}
      - DESECSTACK_API_SEPA_CREDITOR_NAME=${DESECSTACK_API_SEPA_CREDITOR_NAME}
      - DESECSTACK_DOMAIN=${DESECSTACK_DOMAIN}
      - DESECSTACK_NS=${DESECSTACK_NS}
    image: desec/dedyn-www:latest
    init: true
    cap_add:
    - NET_ADMIN
    ports:
    - "80:80"
    - "443:443"
    volumes:
    - ${DESECSTACK_WWW_CERTS}:/etc/ssl/private:ro
    - ./www/html:/var/www/html:ro
    environment:
    - DESECSTACK_DOMAIN
    - DESECSTACK_IPV4_REAR_PREFIX16
    - DESECSTACK_WWW_CERTS
    - DESECSTACK_PROMETHEUS_PASSWORD
    depends_on:
    - api
    - prometheus
    mac_address: 06:42:ac:10:00:80
    networks:
      front:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.0.128
        ipv6_address: ${DESECSTACK_IPV6_ADDRESS}
      rearwww:
      rearreplication:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.7.4
      rearmonitoring_www:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.8.3
    logging:
      driver: "syslog"
      options:
        tag: "desec/www"
    restart: unless-stopped

  www_monitor:
    image: nginx/nginx-prometheus-exporter:0.9.0
    init: true
    depends_on:
    - www
    networks:
    - rearmonitoring_www
    command: -nginx.scrape-uri http://www:8080/stub_status
    logging:
      driver: "syslog"
      options:
        tag: "desec/www_monitor"
    restart: unless-stopped

  dbapi:
    build: dbapi
    image: desec/dedyn-dbapi:latest
    init: true
    user: postgres:postgres
    shm_size: 256M
    volumes:
    - dbapi_postgres:/var/lib/postgresql/data
    - ./dbapi/pg_hba.conf:/usr/local/src/pg_hba.conf:ro
    environment:
    - POSTGRES_DB=desec
    - POSTGRES_HOST_AUTH_METHOD=reject
    - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
    - POSTGRES_NON_ROOT_USER=desec
    - POSTGRES_NON_ROOT_USER_PASSWORD=${DESECSTACK_DBAPI_PASSWORD_desec}
    networks:
    - rearapi_dbapi
    command: ["postgres", "-c", "hba_file=/usr/local/src/pg_hba.conf"]
    logging:
      driver: "syslog"
      options:
        tag: "desec/dbapi"
    restart: unless-stopped

  dblord:
    build: dblord
    image: desec/dedyn-dblord:latest
    init: true
    user: mysql:mysql
    volumes:
    - dblord_mysql:/var/lib/mysql
    environment:
    - DESECSTACK_IPV4_REAR_PREFIX16
    - DESECSTACK_DBLORD_PASSWORD_pdns
    networks:
    - rearlord
    logging:
      driver: "syslog"
      options:
        tag: "desec/dblord"
    restart: unless-stopped

  dbmaster:
    build: dbmaster
    image: desec/dedyn-dbmaster:latest
    init: true
    user: postgres:postgres
    shm_size: 256M
    volumes:
    - dbmaster_postgres:/var/lib/postgresql/data
    - ./dbmaster/pg_hba.conf:/usr/local/src/pg_hba.conf:ro
    environment:
    - POSTGRES_DB=pdns
    - POSTGRES_HOST_AUTH_METHOD=reject
    - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
    - POSTGRES_NON_ROOT_USER=pdns
    - POSTGRES_NON_ROOT_USER_PASSWORD=${DESECSTACK_DBMASTER_PASSWORD_pdns}
    networks:
    - rearmaster
    command: ["postgres", "-c", "hba_file=/usr/local/src/pg_hba.conf"]
    logging:
      driver: "syslog"
      options:
        tag: "desec/dbmaster"
    restart: unless-stopped

  api:
    build: api
    image: desec/dedyn-api:latest
    init: true
    depends_on:
    - dbapi
    - nslord
    - nsmaster
    - celery-email
    - memcached
    tmpfs:
    - /var/local/django_metrics:size=500m
    environment:
    - DESECSTACK_DOMAIN
    - DESECSTACK_NS
    - DESECSTACK_API_ADMIN
    - DESECSTACK_API_SEPA_CREDITOR_ID
    - DESECSTACK_API_SEPA_CREDITOR_NAME
    - DESECSTACK_API_EMAIL_HOST
    - DESECSTACK_API_EMAIL_HOST_USER
    - DESECSTACK_API_EMAIL_HOST_PASSWORD
    - DESECSTACK_API_EMAIL_PORT
    - DESECSTACK_API_SECRETKEY
    - DESECSTACK_API_PSL_RESOLVER
    - DESECSTACK_API_PCH_API
    - DESECSTACK_API_PCH_API_TOKEN
    - DESECSTACK_API_AUTHACTION_VALIDITY
    - DESECSTACK_API_REGISTER_LPS
    - DESECSTACK_API_LIMIT_USER_DOMAIN_COUNT_DEFAULT
    - DESECSTACK_DBAPI_PASSWORD_desec
    - DESECSTACK_IPV4_REAR_PREFIX16
    - DESECSTACK_IPV6_SUBNET
    - DESECSTACK_NSLORD_APIKEY
    - DESECSTACK_NSLORD_DEFAULT_TTL
    - DESECSTACK_NSMASTER_APIKEY
    - DESECSTACK_MINIMUM_TTL_DEFAULT
    - DESECSTACK_WATCHDOG_SECONDARIES
    networks:
      rearapi_celery:
      rearapi_dbapi:
      rearapi_ns:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.1.10
      rearwww:
      rearmonitoring_api:
    logging:
      driver: "syslog"
      options:
        tag: "desec/api"
    restart: unless-stopped

  nslord:
    build: nslord
    image: desec/dedyn-nslord:latest
    init: true
    environment:
    - DESECSTACK_IPV4_REAR_PREFIX16
    - DESECSTACK_DBLORD_PASSWORD_pdns
    - DESECSTACK_NSLORD_APIKEY
    - DESECSTACK_NSLORD_CARBONSERVER
    - DESECSTACK_NSLORD_CARBONOURNAME
    - DESECSTACK_NSLORD_CACHE_TTL=20
    - DESECSTACK_NSLORD_DEFAULT_TTL
    depends_on:
    - dblord
    networks:
      rearapi_ns:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.1.11
      rearlord:
    logging:
      driver: "syslog"
      options:
        tag: "desec/nslord"
    restart: unless-stopped

  nsmaster:
    build: nsmaster
    image: desec/dedyn-nsmaster:latest
    init: true
    cap_add:
    - NET_ADMIN
    ports:
    - "${DESECSTACK_PORT_XFR}:53"
    environment:
    - DESECSTACK_IPV4_REAR_PREFIX16
    - DESECSTACK_DBMASTER_PASSWORD_pdns
    - DESECSTACK_NSMASTER_ALSO_NOTIFY
    - DESECSTACK_NSMASTER_APIKEY
    - DESECSTACK_NSMASTER_CARBONSERVER
    - DESECSTACK_NSMASTER_CARBONOURNAME
    - DESECSTACK_NSMASTER_TSIGKEY
    depends_on:
    - dbmaster
    networks:
      rearapi_ns:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.1.12
      rearmaster:
      rearreplication:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.7.3
    logging:
      driver: "syslog"
      options:
        tag: "desec/nsmaster"
    restart: unless-stopped

  rabbitmq:
    image: rabbitmq:3.8-alpine
    init: true
    user: rabbitmq:rabbitmq
    volumes:
    - rabbitmq_data:/var/lib/rabbitmq
    networks:
    - rearapi_celery
    hostname: rabbitmq
    logging:
      driver: "syslog"
      options:
        tag: "desec/rabbitmq"
    restart: unless-stopped

  celery-email:
    build: api
    image: desec/dedyn-api:latest
    init: true
    command: celery -A api worker -Q email_slow_lane,email_fast_lane,email_immediate_lane -c 8 -n email -l info --uid nobody --gid nogroup
    depends_on:
    - dbapi
    - nslord
    - rabbitmq
    environment:
    - DESECSTACK_DOMAIN
    - DESECSTACK_NS
    - DESECSTACK_API_ADMIN
    - DESECSTACK_API_SEPA_CREDITOR_ID
    - DESECSTACK_API_SEPA_CREDITOR_NAME
    - DESECSTACK_API_EMAIL_HOST
    - DESECSTACK_API_EMAIL_HOST_USER
    - DESECSTACK_API_EMAIL_HOST_PASSWORD
    - DESECSTACK_API_EMAIL_PORT
    - DESECSTACK_API_SECRETKEY
    - DESECSTACK_API_PSL_RESOLVER
    - DESECSTACK_DBAPI_PASSWORD_desec
    - DESECSTACK_IPV4_REAR_PREFIX16
    - DESECSTACK_IPV6_SUBNET
    - DESECSTACK_NSLORD_APIKEY
    - DESECSTACK_NSLORD_DEFAULT_TTL
    - DESECSTACK_NSMASTER_APIKEY
    - DESECSTACK_MINIMUM_TTL_DEFAULT
    - DJANGO_SETTINGS_MODULE=api.settings
    networks:
    - rearapi_celery
    - rearapi_dbapi
    logging:
      driver: "syslog"
      options:
        tag: "desec/celery-email"
    restart: unless-stopped

  memcached:
    image: memcached:1.6-alpine
    init: true
    user: memcache:memcache
    networks:
    - rearapi_celery
    command: ["memcached", "-I", "2m"]
    logging:
      driver: "syslog"
      options:
        tag: "desec/memcached"
    restart: unless-stopped

  openvpn-server:
    build: openvpn-server
    image: desec/openvpn-server:latest
    init: true
    cap_add:
    - NET_ADMIN
    ports:
    - "1194:1194/udp"
    volumes:
    - ./openvpn-server/secrets:/etc/openvpn/secrets:ro
    - openvpn-server_logs:/var/log/openvpn
    networks:
      rearreplication:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.7.2
    logging:
      driver: "syslog"
      options:
        tag: "desec/openvpn-server"
    restart: unless-stopped

  openvpn-server_monitor:
    image: kumina/openvpn-exporter:v0.2.2
    init: true
    depends_on:
    - openvpn-server
    volumes:
    - openvpn-server_logs:/var/log/openvpn:ro
    networks:
    - rearmonitoring_openvpn-server
    command: -openvpn.status_paths /var/log/openvpn/openvpn-status.log
    logging:
      driver: "syslog"
      options:
        tag: "desec/openvpn-server_monitor"
    restart: unless-stopped

  prometheus:
    image: prom/prometheus:latest
    init: true
    volumes:
    - ./prometheus/conf:/etc/prometheus:ro
    - prometheus:/prometheus
    networks:
      rearmonitoring_www:
        ipv4_address: ${DESECSTACK_IPV4_REAR_PREFIX16}.8.2
      rearmonitoring_api:
      rearmonitoring_openvpn-server:
    extra_hosts:
    - prometheus.localhost:${DESECSTACK_IPV4_REAR_PREFIX16}.8.2
    command: [
      # Defaults follow
      "--config.file=/etc/prometheus/prometheus.yml",
      "--storage.tsdb.path=/prometheus",
      "--web.console.libraries=/usr/share/prometheus/console_libraries",
      "--web.console.templates=/usr/share/prometheus/consoles",
      # Local parameters follow
      "--storage.tsdb.retention.time=1y",
      "--web.listen-address=${DESECSTACK_IPV4_REAR_PREFIX16}.8.2:9090",
      "--web.external-url=https://desec.${DESECSTACK_DOMAIN}/prometheus",
      "--web.route-prefix=/",
    ]
    logging:
      driver: "syslog"
      options:
        tag: "desec/prometheus"
    restart: unless-stopped

volumes:
  dbapi_postgres:
  dblord_mysql:
  dbmaster_postgres:
  openvpn-server_logs:
  prometheus:
  rabbitmq_data:

networks:
  # Note that it is required that the front network ranks lower (in lexical order)
  # than the other networks. See https://github.com/docker/docker/issues/27101
  front:
    enable_ipv6: true
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.0.0/24
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.0.1
      - subnet: ${DESECSTACK_IPV6_SUBNET}
  # Make sure these come after the front network (lexical order). This is why we
  # call it rear, not back. See https://github.com/docker/docker/issues/27101
  rearapi_celery:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.6.0/24
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.6.1
  rearapi_dbapi:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.5.0/24
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.5.1
  rearapi_ns:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.1.0/24
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.1.1
  rearwww:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.2.0/24
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.2.1
  rearlord:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.3.0/24
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.3.1
  rearmaster:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.4.0/24
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.4.1
  rearreplication:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.7.0/24
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.7.1
  # Monitoring
  rearmonitoring_www:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.8.0/29
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.8.1
  rearmonitoring_api:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.8.8/29
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.8.9
  rearmonitoring_openvpn-server:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: ${DESECSTACK_IPV4_REAR_PREFIX16}.8.16/29
        gateway: ${DESECSTACK_IPV4_REAR_PREFIX16}.8.17