docker-swarm.yml

# environment must be first imported using:
# $ export $(cat .env)
# until .env file is supported (if ever)

version: '3.7'

networks:
  traefik-public:
    external: true
  internal:
    driver: overlay
    attachable: true

services:
  mosquitto:
    env_file: .env
    image: thinxcloud/mosquitto
    ports:
      - '1883:1883' # mqtt
      - '1884:1883' # mqtts
      - '8883:8883' # websocket
    restart: unless-stopped
    networks:
      - nat
      - internal
    volumes:
      - '/mnt/data/mosquitto/config:/etc/mosquitto/config:rw'
      - '/mnt/data/mosquitto/config:/mqtt/config:ro'
      - '/mnt/data/mosquitto/ssl:/mqtt/ssl:ro'
      - '/mnt/data/mosquitto/data:/mqtt/data:rw'
      - '/mnt/data/mosquitto/log:/mqtt/log:rw'
      - '/mnt/data/mosquitto/auth:/mqtt/auth:rw'

    deploy:
      resources:
        reservations:
          cpus: '0.2'
          memory: 64M
        limits:
          cpus: '0.5'
          memory: 128M
      labels:
        - traefik.enable=true
        - traefik.backend=mosquitto
        - traefik.frontend.entryPoints=mqtt,mqtts
        - traefik.docker.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.services.mosquitto.loadbalancer.server.port=1883
        - "swarmpit.service.deployment.autoredeploy=true"

  couchdb:
    env_file: .env
    image: 'couchdb:3.1.0'
    healthcheck:
      test:
        - CMD-SHELL
        - 'curl -XGET http://localhost:5984'
      interval: 10s
      timeout: 50s
      retries: 5
    environment:
      - "NODENAME=${NODENAME}"
      - "COUCHDB_ADMIN=${COUCHDB_USER}"
      - "COUCHDB_USER=${COUCHDB_USER}"
      - "COUCHDB_PASS=${COUCHDB_PASS}"
      - "COUCHDB_PASSWORD=${COUCHDB_PASS}"
      - "COUCHDB_COOKIE=${COUCHDB_COOKIE}"
      - "COUCHDB_SECRET=${COUCHDB_SECRET}"
    ports:
      - 5984:5984 # not in production!
    networks:
      - traefik-public # not in production!
#      - internal # for production

    volumes:
    
      - type: bind
        source: /mnt/data/couchdb
        target: /opt/couchdb/data

      - type: bind
        source: /mnt/data
        target: /opt/couchdb/etc

      # probably deprecated
      - type: bind
        source: /mnt/data/couchdb
        target: /var/lib/couchdb

    deploy:
      resources:
        reservations:
          cpus: '1.0'
          memory: 512M
        limits:
          cpus: '1.0'
          memory: 1024M
      labels:
        - "swarmpit.service.deployment.autoredeploy=true"


  thinx-redis:
    env_file: .env
    networks:
      - internal
    image: thinxcloud/redis
    command:
      - redis-server
      - '--requirepass'
      - '${REDIS_PASSWORD}'
      - '--port'
      - '6379'
    environment:
      - "ALLOW_EMPTY_PASSWORD=no"
      - "REDIS_PASSWORD=${REDIS_PASSWORD}"
      - "REDIS_DISABLE_COMMANDS=FLUSHDB,FLUSHALL"
    ports:
      - 6379
    volumes:
      - '/mnt/data/thinx/eu/redis:/data'
    deploy:
      resources:
        reservations:
          cpus: '0.5'
          memory: 32M
        limits:
          cpus: '1.0'
          memory: 512M
      labels:
        - "swarmpit.service.deployment.autoredeploy=true"

  transformer:
    env_file: .env
    user: transformer
    image: thinxcloud/transformer
    environment:
      - "ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}"
      - "ROLLBAR_ENVIRONMENT=${ROLLBAR_ENVIRONMENT}"
      - "REVISION=2"
    networks:
      - internal
    ports:
      - 7474
    labels:
      - traefik.backend.transformer.noexpose
    deploy:
      resources:
        reservations:
          cpus: '0.2'
          memory: 256M
        limits:
          cpus: '1.0'
          memory: 256M
      labels:
        - "swarmpit.service.deployment.autoredeploy=true"

  worker:
    env_file: .env
    image: thinxcloud/worker:latest
    environment:
      - "ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}"
      - "ROLLBAR_ENVIRONMENT=${ROLLBAR_ENVIRONMENT}"
      - "THINX_SERVER=http://api:4000"
      - "WORKER_SECRET=${WORKER_SECRET}"
      - "THINX_HOSTNAME=${THINX_HOSTNAME}"
    networks:
      - internal
    ports:
      - 4000
    labels:
      - traefik.backend.worker.noexpose
    volumes:
      - /mnt/data/repos:/mnt/data/repos
      - /mnt/data/deploy:/mnt/data/deploy
      
    deploy:
      resources:
        reservations:
          cpus: '0.2'
          memory: 256M
        limits:
          cpus: '1.0'
          memory: 256M
      labels:
        - "swarmpit.service.deployment.autoredeploy=true"
      
  api:
    depends_on:
      - transformer
      - thinx-redis
      - mosquitto
    networks:
      - traefik-public
      - internal
    env_file: .env
    image: registry.thinx.cloud:5000/thinx/api
    environment:
      - "ENVIRONMENT=${ENVIRONMENT}"
      - "COUCHDB_USER=${COUCHDB_USER}"
      - "COUCHDB_PASS=${COUCHDB_PASS}"
      - "WORKER_SECRET=${WORKER_SECRET}"
      - "GOOGLE_OAUTH_ID=${GOOGLE_OAUTH_ID}"
      - "GOOGLE_OAUTH_SECRET=${GOOGLE_OAUTH_SECRET}"
      - "GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}"
      - "GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}"
      - 'MAILGUN_API_KEY=${MAILGUN_API_KEY}'
      - 'SLACK_WEBHOOK=${SLACK_WEBHOOK}'
    ports:
      - '7442:7442'
      - '7443:7443'
      - '4000'
    volumes:
      - '/mnt/data/thinx/eu/statistics:/opt/thinx/thinx-device-api/statistics'
      - '/mnt/data/thinx/eu/deploy:/mnt/data/deploy'
      - '/mnt/data/thinx/eu/mosquitto:/mnt/data/mosquitto'
      - '/mnt/data/thinx/eu/repos:/mnt/data/repos'
      - '/mnt/data/thinx/eu/ssl:/mnt/data/ssl'
      - '/mnt/data/thinx/eu/ssh_keys:/mnt/data/ssh_keys'
      - '/mnt/data/thinx/eu/conf:/mnt/data/conf'
      - '/mnt/data/thinx/eu/statistics:/mnt/data/statistics'
      - '/mnt/data/thinx/eu/test-reports:/mnt/data/test-reports'
      - '/var/run/docker.sock:/var/run/docker.sock'
      - '/var/lib/docker'
      - '/cache'
    deploy:
      resources:
        reservations:
          cpus: '0.5'
          memory: 1024M
        limits:
          cpus: '1.0'
          memory: 2048M
      labels:
        - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https" # 7444 websocket
        - "traefik.http.services.thinx-api.loadbalancer.server.port=7442"
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.constraint-label=traefik-public"

        - "traefik.http.routers.thinx-api-http.rule=Host(`${THINX_HOSTNAME}`)"
        - "traefik.http.routers.thinx-api-http.entrypoints=http,thxp"
        - "traefik.http.routers.thinx-api-http.middlewares=https-redirect"

        - "traefik.http.routers.thinx-api-https.rule=Host(`${THINX_HOSTNAME}`)"
        - "traefik.http.routers.thinx-api-https.entrypoints=https,thxps"
        - "traefik.http.routers.thinx-api-https.tls=true"
        - "traefik.http.routers.thinx-api-https.tls.certresolver=le"

        - "swarmpit.service.deployment.autoredeploy=true"

  console:
    depends_on:
      - api
    env_file: .env
    image: registry.thinx.cloud:5000/thinx/console
    networks:
      - traefik-public
#      - internal # why?
    ports:
      - 7440:80
#    logging:
#      driver: none
    environment:
      - "LANDING_HOSTNAME=${LANDING_HOSTNAME}"
      - "WEB_HOSTNAME=${WEB_HOSTNAME}"
      - "API_HOSTNAME=${API_HOSTNAME}"
      - "API_BASEURL=${API_BASEURL}"
      - "ENTERPRISE=${ENTERPRISE}"
      - "ENVIRONMENT=${ENVIRONMENT}"
      - "GOOGLE_ANALYTICS_ID=${GOOGLE_ANALYTICS_ID}"
      - "ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN}"
      - "CRISP_WEBSITE_ID=${CRISP_WEBSITE_ID}"
    deploy:
      resources:
        reservations:
          cpus: '0.5'
          memory: 32M
        limits:
          cpus: '1.0'
          memory: 256M
      labels:
        # should be 7440, but the 80 port of container is exposed anyway in swarm mode
        - "traefik.http.services.thinx-console.loadbalancer.server.port=80"
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.constraint-label=traefik-public"

        - "traefik.http.routers.thinx-console-http.rule=Host(`${WEB_HOSTNAME}`)"
        - "traefik.http.routers.thinx-console-http.entrypoints=http"
        - "traefik.http.routers.thinx-console-http.middlewares=https-redirect"

        - "traefik.http.routers.thinx-console-https.rule=Host(`${WEB_HOSTNAME}`)"
        - "traefik.http.routers.thinx-console-https.entrypoints=https"
        - "traefik.http.routers.thinx-console-https.tls=true"
        - "traefik.http.routers.thinx-console-https.tls.certresolver=le"

        - "swarmpit.service.deployment.autoredeploy=true"