docker-stack.yml

version: '3.2'

services:
  traefik:
    image: traefik:v2.4
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    networks:
      - traefik-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik:/etc/traefik
      - ./traefik/acme:/acme
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"
    environment:
      - GODADDY_API_KEY=$WT_GODADDY_API_KEY
      - GODADDY_API_SECRET=$WT_GODADDY_API_SECRET

  mongo:
    image: mongo:3.6
    networks:
      - mongo
    volumes:
      - mongo-data:/data/db
      - mongo-cfg:/data/configdb
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  girder:
    image: wholetale/girder:latest
    networks:
      - traefik-net
      - celery
      - mongo
    volumes:
      - ./volumes:/tmp/data
      - ./girder/girder.local.cfg:/girder/girder/conf/girder.local.cfg
      - ./src/wholetale:/girder/plugins/wholetale
      - ./src/wt_data_manager:/girder/plugins/wt_data_manager
      - ./src/wt_home_dir:/girder/plugins/wt_home_dir
      - ./src/wt_versioning:/girder/plugins/wt_versioning
      - ./src/globus_handler:/girder/plugins/globus_handler
      - ./src/virtual_resources:/girder/plugins/virtual_resources
      - ./src/gwvolman:/gwvolman
      - ./src/girderfs:/girderfs
      - /var/run/docker.sock:/var/run/docker.sock
      - /tmp:/tmp
    environment:
      - DOMAIN=${domain}
      - DASHBOARD_URL=https://dashboard.${domain}
      - GOSU_USER=girder:girder:${docker_group}
      - GOSU_CHOWN=/tmp/data
      - DATAONE_URL=https://cn-stage-2.test.dataone.org/cn
      - HOSTDIR=/
    extra_hosts:
      - "images.${domain}:host-gateway"
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.girder.rule=Host(`girder.${domain}`)"
        - "traefik.http.routers.girder.entrypoints=websecure"
        - "traefik.http.routers.girder.tls=true"
        - "traefik.http.routers.girder.tls.certresolver=default"
        - "traefik.http.routers.girder.tls.domains[0].main=${domain}"
        - "traefik.http.routers.girder.tls.domains[0].sans=*.${domain}"
        - "traefik.http.services.girder.loadbalancer.server.port=8080"
        - "traefik.http.services.girder.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"
        - "traefik.http.middlewares.girder.forwardauth.address=http://girder:8080/api/v1/user/authorize/"
        - "traefik.http.middlewares.girder.forwardauth.trustforwardheader=true"

  logger:
    image: wholetale/instance_logger:latest
    networks:
      - celery
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  redis:
    image: redis:7-bullseye
    networks:
      - celery
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  dashboard:
    image: wholetale/ngx-dashboard:latest
    networks:
      - traefik-net
    environment:
      - GIRDER_API_URL=https://girder.${domain}/api/v1
      - AUTH_PROVIDER=Globus
      - DATAONE_URL=https://cn.dataone.org/cn/v2
      - RTD_URL=https://wholetale.readthedocs.io/en/latest
      - DASHBOARD_DEV=true
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.dashboard.rule=Host(`dashboard.${domain}`)"
        - "traefik.http.routers.dashboard.entrypoints=websecure"
        - "traefik.http.routers.dashboard.tls=true"
        - "traefik.http.services.dashboard.loadbalancer.server.port=80"
        - "traefik.http.services.dashboard.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"
    volumes:
      - ./src/ngx-dashboard/dist/browser/:/usr/share/nginx/html/

  instance-errors:
    image: wholetale/custom-errors:latest
    networks:
      - traefik-net
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.instance-errors.rule=HostRegexp(`{host:tmp-.*}`)"
        - "traefik.http.routers.instance-errors.entrypoints=websecure"
        - "traefik.http.routers.instance-errors.tls=true"
        - "traefik.http.routers.instance-errors.priority=1"
        - "traefik.http.routers.instance-errors.middlewares=error-pages-middleware"
        - "traefik.http.middlewares.error-pages-middleware.errors.status=400-599"
        - "traefik.http.middlewares.error-pages-middleware.errors.service=instance-errors"
        - "traefik.http.middlewares.error-pages-middleware.errors.query=/{status}.html"
        - "traefik.http.services.instance-errors.loadbalancer.server.port=80"
        - "traefik.docker.network=wt_traefik-net"

  registry:
    image: registry:2.8
    networks:
      - traefik-net
    volumes:
      - ./registry:/var/lib/registry
      - ./registry/auth:/auth:ro
    environment:
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm"
      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/registry.password
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.registry.rule=Host(`registry.${domain}`)"
        - "traefik.http.routers.registry.entrypoints=websecure"
        - "traefik.http.routers.registry.tls=true"
        - "traefik.http.services.registry.loadbalancer.server.port=5000"
        - "traefik.http.services.registry.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"

  images:
    image: registry:2.8
    networks:
      - traefik-net
    volumes:
      - ./registry:/var/lib/registry:ro
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.images.rule=Host(`images.${domain}`)"
        - "traefik.http.routers.images.rule=Method(`GET`)"
        - "traefik.http.routers.images.entrypoints=websecure"
        - "traefik.http.routers.images.tls=true"
        - "traefik.http.services.images.loadbalancer.server.port=5000"
        - "traefik.http.services.images.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"

  celery_worker:
    image: wholetale/gwvolman
    networks:
      - celery
    labels:
      - "traefik.enable=false"
    environment:
      - GOSU_USER=wtuser:1000:${docker_group}
      - DOMAIN=${domain}
      - DEV=true
      - REPO2DOCKER_VERSION=${r2d_version}
      - GIRDERFS_IMAGE=${girderfs_image}
      - TRAEFIK_NETWORK=wt_traefik-net
      - TRAEFIK_ENTRYPOINT=websecure
      - REGISTRY_USER=${registry_user}
      - REGISTRY_URL=https://registry.${domain}
      - REGISTRY_PASS=${registry_pass}
      - WT_LICENSE_PATH=${PWD}/volumes/licenses
      - WT_VOLUMES_PATH=${PWD}/volumes
      - MATLAB_FILE_INSTALLATION_KEY=${matlab_file_installation_key}
      - SWARM_NODE_ID={{.Node.ID}}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./volumes/tmp:/tmp
      - ./src/gwvolman:/gwvolman
      - ./src/girderfs:/girderfs
      - type: bind
        source: ${PWD}/volumes
        target: ${PWD}/volumes
        bind:
          propagation: rshared
    deploy:
      mode: global
      labels:
        - "traefik.enable=true"
    command: -c 3

networks:
  traefik-net:
    driver: overlay
  mongo:
    driver: overlay
  celery:
    driver: overlay
    attachable: true

volumes:
  mongo-data: {}
  mongo-cfg: {}