docker-compose.yml

version: '2.2'
networks:
  nat:
    external: true
  internal:
    external: false
services:
  mosquitto:
    env_file: .env
    image: thinxcloud/mosquitto
    ports:
      - '1883:1883' # mqtt
      - '1884:1883' # mqtts
      - '8883:8883' # websocket
    restart: unless-stopped
    networks:
      - nat
      - internal
    volumes:
      - '/mnt/data/mosquitto/config:/etc/mosquitto/config:rw'
      - '/mnt/data/mosquitto/ssl:/mqtt/ssl:rw'
      - '/mnt/data/mosquitto/auth:/mqtt/auth:rw'
    labels:
      - traefik.backend.mosquitto.noexpose
  couchdb:
    env_file: .env
    image: 'couchdb:3.2.0'
    restart: unless-stopped
    healthcheck:
      test:
        - CMD-SHELL
        - 'curl -XGET http://localhost:5984'
      interval: 10s
      timeout: 50s
      retries: 5
    environment:
      - 'NODENAME=${NODENAME}'
      - 'COUCHDB_USER=${COUCHDB_USER}'
      - 'COUCHDB_PASSWORD=${COUCHDB_PASS}'
      - 'COUCHDB_ADMIN=${COUCHDB_USER}'
      - 'COUCHDB_PASS=${COUCHDB_PASS}'
      - 'COUCHDB_COOKIE=${COUCHDB_COOKIE}'
      - 'COUCHDB_SECRET=${COUCHDB_SECRET}'
    ports:
      - 5984
    networks:
      - nat
      - internal
    volumes:
      - "/mnt/data/couchdb/data:/opt/couchdb/data"
      - "./services/couchdb/etc:/opt/couchdb/etc"
    labels:
      - traefik.backend.couchdb.noexpose
  thinx-redis:
    env_file: .env
    networks:
      - internal
    build:
      context: ./services/redis
      args:
        - ALLOW_EMPTY_PASSWORD=no
        - 'REDIS_PASSWORD=${REDIS_PASSWORD}'
        - 'REDIS_DISABLE_COMMANDS=FLUSHDB,FLUSHALL'
    command:
      - redis-server
      - '--requirepass'
      - '${REDIS_PASSWORD}'
      - '--port'
      - '6379'
    environment:
      - ALLOW_EMPTY_PASSWORD=no
      - 'REDIS_PASSWORD=${REDIS_PASSWORD}'
      - 'REDIS_DISABLE_COMMANDS=FLUSHDB,FLUSHALL'
    restart: unless-stopped
    ports:
      - 6379
    volumes:
      - '/mnt/data/redis:/data'
    labels:
      - traefik.backend.thinx-redis
  transformer:
    env_file: .env
    user: transformer
    build:
      context: ./services/transformer
      args:
        - 'ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}'
        - 'ROLLBAR_ENVIRONMENT=${ROLLBAR_ENVIRONMENT}'
        - REVISION=1
    restart: unless-stopped
    environment:
      - 'ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}'
      - 'ROLLBAR_ENVIRONMENT=${ROLLBAR_ENVIRONMENT}'
      - REVISION=1
    networks:
      - internal
    ports:
      - 7474
    labels:
      - traefik.backend.transformer.noexpose

  worker:
    env_file: .env
    image: thinxcloud/worker:latest
    environment:
      - "ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}"
      - "ROLLBAR_ENVIRONMENT=${ROLLBAR_ENVIRONMENT}"
      - "THINX_SERVER=${THINX_SERVER}"
      - "WORKER_SECRET=${WORKER_SECRET}"
    networks:
      - internal
    labels:
      - traefik.backend.worker.noexpose
    volumes:
      - /mnt/data/repos:/mnt/data/repos
      - /mnt/data/deploy:/mnt/data/deploy
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker
      - /cache
      
  api:
    privileged: true
    shm_size: 2048M
    restart: unless-stopped
    depends_on:
      - transformer
      - thinx-redis
      - mosquitto
    networks:
      - nat
      - internal
    env_file: .env
    build:
      context: .
      dockerfile: ./Dockerfile
      args:
        - 'AQUA_SEC_TOKEN=${AQUA_SEC_TOKEN}'
        - 'ENVIRONMENT=${ENVIRONMENT}'
        - 'REVISION=${REVISION}'
        - 'ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}'
        - 'ROLLBAR_ENVIRONMENT=${ROLLBAR_ENVIRONMENT}'
        - 'THINX_HOSTNAME=${THINX_HOSTNAME}'
        - 'THINX_OWNER_EMAIL=${THINX_OWNER_EMAIL}'
        - 'WORKER_SECRET=${WORKER_SECRET}'
    environment:
      - 'AQUA_SEC_TOKEN=${AQUA_SEC_TOKEN}'
      - 'COUCHDB_PASS=${COUCHDB_PASS}'
      - 'COUCHDB_USER=${COUCHDB_USER}'
      - 'ENVIRONMENT=${ENVIRONMENT}'
      - 'ENTERPRISE=${ENTERPRISE}'
      - 'GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}'
      - 'GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}'
      - 'GITHUB_ACCESS_TOKEN=${GITHUB_ACCESS_TOKEN}'
      - 'GOOGLE_OAUTH_ID=${GOOGLE_OAUTH_ID}'
      - 'GOOGLE_OAUTH_SECRET=${GOOGLE_OAUTH_SECRET}'
      - 'REDIS_PASSWORD=${REDIS_PASSWORD}'
      - 'REVISION=${REVISION}'
      - 'ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}'
      - 'ROLLBAR_ENVIRONMENT=${ROLLBAR_ENVIRONMENT}'
      - 'SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN}'
      - 'SLACK_CLIENT_ID=${SLACK_CLIENT_ID}'
      - 'SLACK_CLIENT_SECRET=${SLACK_CLIENT_SECRET}'
      - 'SLACK_WEBHOOK=${SLACK_WEBHOOK}'
      - 'THINX_HOSTNAME=${THINX_HOSTNAME}'
      - 'THINX_OWNER_EMAIL=${THINX_OWNER_EMAIL}'
      - 'WORKER_SECRET=${WORKER_SECRET}'
    ports:
      - '7442:7442'
      - '7443:7443'
      - '4000' # worker socket
    volumes:
      - '/mnt/data/deploy:/mnt/data/deploy'
      - '/mnt/data/mosquitto:/mnt/data/mosquitto'
      - '/mnt/data/repos:/mnt/data/repos'
      - '/mnt/data/ssl:/mnt/data/ssl'
      - '/mnt/data/ssh_keys:/mnt/data/ssh_keys'
      - '/mnt/data/conf:/mnt/data/conf'
      - '/mnt/data/statistics:/mnt/data/statistics'
      - '/mnt/data/test-reports:/mnt/data/test-reports'
      - '/var/run/docker.sock:/var/run/docker.sock'
      - '/var/lib/docker'
      - '/cache'
    labels:
      - traefik.docker.network=nat
      - traefik.enable=true
      - traefik.port=7442
      - traefik.backend=thinx-api
      - 'traefik.frontend.rule=Host:${THINX_HOSTNAME}'

  console:
    depends_on:
      - api
    env_file:
      - .env
    build:
      context: ./services/console/src
      args:
        - 'LANDING_HOSTNAME=${LANDING_HOSTNAME}'
        - 'WEB_HOSTNAME=${WEB_HOSTNAME}'
        - 'API_HOSTNAME=${API_HOSTNAME}'
        - 'API_BASEURL=${API_BASEURL}'
        - 'ENTERPRISE=${ENTERPRISE}'
        - 'ENVIRONMENT=${ENVIRONMENT}'
        - 'GOOGLE_ANALYTICS_ID=${GOOGLE_ANALYTICS_ID}'
        - 'ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}'
        - 'CRISP_WEBSITE_ID=${CRISP_WEBSITE_ID}'
    networks:
      - nat
      - internal
#    logging:
#      driver: none
    ports:
      - '8000:80'
    restart: unless-stopped # may be required for updating SSL certs
    environment:
      - 'LANDING_HOSTNAME=${LANDING_HOSTNAME}'
      - 'WEB_HOSTNAME=${WEB_HOSTNAME}'
      - 'API_HOSTNAME=${API_HOSTNAME}'
      - 'API_BASEURL=${API_BASEURL}'
      - 'ENTERPRISE=${ENTERPRISE}'
      - 'ENVIRONMENT=${ENVIRONMENT}'
      - 'GOOGLE_ANALYTICS_ID=${GOOGLE_ANALYTICS_ID}'
      - 'ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}'
      - 'CRISP_WEBSITE_ID=${CRISP_WEBSITE_ID}'
    labels:
      - traefik.enable=true
      - traefik.port=80
      - traefik.backend=console
      - 'traefik.frontend.rule=Host:${WEB_HOSTNAME}'
      - 'traefik.frontend.entryPoints=http,https'
      - traefik.frontend.headers.SSLRedirect=false
      - traefik.frontend.headers.SSLForceHost=true
      - 'traefik.frontend.headers.SSLHost=${WEB_HOSTNAME}'
#      - traefik.frontend.headers.forceSTSHeader=true
#      - traefik.frontend.headers.STSSeconds=315360000
#      - traefik.frontend.headers.STSIncludeSubdomains=true
#      - traefik.frontend.headers.STSPreload=true

  # currently for development only(!) mind the volume path
  influxdb:
    image: influxdb:1.8
    ports:
      - '8086:8086'
    networks:
      - internal
    volumes:
      - '/mnt/gluster/thinx/influx:/var/lib/influxdb'
      #- './influx:/var/lib/influxdb'
    environment:
      - INFLUXDB_DB=db0
      - INFLUXDB_ADMIN_USER=${INFLUXDB_USERNAME}
      - INFLUXDB_ADMIN_PASSWORD=${INFLUXDB_PASSWORD}

  chronograf:
    image: chronograf:1.9
    ports:
      - '8888:8888'
    networks:
      - internal
      #- traefik-public
    volumes:
      - '/mnt/gluster/thinx/chronograf:/var/lib/chronograf'
      #- './chronograf:/var/lib/chronograf'
    depends_on:
      - influxdb
    environment:
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME=${INFLUXDB_USERNAME}
      - INFLUXDB_PASSWORD=${INFLUXDB_PASSWORD}