docker-compose.yml

services:
  web:
    container_name: trusted-web-main
    build:
      context: .
      dockerfile: dockerFiles/api_docker
    env_file:
      - .env
    working_dir: /app
    depends_on:
      - elasticsearch
      - mongo
    volumes:
      - ./backend/orion:/app/orion:cached
      - ./backend/routes:/app/routes:cached
      - ./backend/static:/app/static:cached
      - ./client/build:/client_build:delegated
    expose:
      - "8070"
    networks:
      - backend
      - shared_bridge
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8070"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    command: >
      sh -c "python3 /app/cronjobs.py & exec gunicorn -w 1 -k uvicorn.workers.UvicornWorker main:app --bind 0.0.0.0:8070"

  nginx:
    container_name: trusted-web-nginx
    image: fholzer/nginx-brotli:latest
    ports:
      - "8080:8080"
      - "443:443"
    depends_on:
      - web
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./backend/static:/app/static:cached
      - /var/www/certbot:/var/www/certbot
      - /etc/letsencrypt:/etc/letsencrypt:ro
    networks:
      backend:
        ipv4_address: 172.20.1.13
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080 || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
    environment:
      - ENABLE_BROTLI=1

  traefik:
    image: traefik:v2.10
    container_name: trusted-web-traefik
    ports:
      - "9090:9090"
      - "9443:9443"
    command:
      - "--entrypoints.web.address=:9090"
      - "--entrypoints.websecure.address=:9443"
      - "--providers.file.directory=/etc/traefik"
      - "--providers.docker=true"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./dockerFiles/traefik:/etc/traefik
    restart: unless-stopped
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "exit 0"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  dozzle:
    container_name: trusted-web-dozzle
    image: amir20/dozzle:latest
    networks:
      - backend
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dozzle.rule=Host(`dozzle.localhost`)"
      - "traefik.http.services.dozzle.loadbalancer.server.port=8080"
      - "traefik.http.routers.dozzle.middlewares=auth@file"
    restart: unless-stopped

  elasticsearch:
    container_name: trusted-web-elastic
    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.5
    environment:
      - discovery.type=single-node
      - network.host=0.0.0.0
      - http.port=9400
      - ELASTIC_USERNAME=${ELASTIC_ROOT_USERNAME}
      - ELASTIC_PASSWORD=${ELASTIC_ROOT_PASSWORD}
      - xpack.security.enabled=false
      - xpack.security.transport.ssl.enabled=false
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
      - indices.memory.index_buffer_size=5%
      - node.store.allow_mmap=false
    env_file:
      - .env
    ports:
      - "9400:9400"
    volumes:
      - elastic:/usr/share/elasticsearch/data
    healthcheck:
      test: curl -f http://localhost:9400/_cluster/health || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    networks:
      backend:
        ipv4_address: 172.20.1.11
    deploy:
      resources:
        limits:
          memory: 1G

  redis_server:
    container_name: trusted-web-redis
    image: redis:7.4.0
    logging:
      driver: none
    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}"]
    restart: always
    env_file:
      - .env
    volumes:
      - redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      backend:
        ipv4_address: 172.20.1.12
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M

  mongo:
    image: mongo:latest
    container_name: trustly-web-mongodb
    restart: always
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USERNAME}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD}
    ports:
      - "27020:27017"
    volumes:
      - mongo:/data/db
    command: >
      bash -c "
      mongod --bind_ip_all --fork --logpath /var/log/mongodb.log &&
      sleep 10 &&
      mongosh --eval '
        db = db.getSiblingDB(\"admin\");
        if (db.getUser(\"${MONGO_ROOT_USERNAME}\") === null) {
          db.createUser({
            user: \"${MONGO_ROOT_USERNAME}\",
            pwd: \"${MONGO_ROOT_PASSWORD}\",
            roles: [{ role: \"userAdminAnyDatabase\", db: \"admin\" }, { role: \"readWriteAnyDatabase\", db: \"admin\" }]
          });
        }
      ' &&
      mongod --shutdown &&
      sleep 5 &&
      mongod --auth --bind_ip_all --fork --logpath /var/log/mongodb.log &&
      tail -f /var/log/mongodb.log
      "
    networks:
      backend:
        ipv4_address: 172.20.1.14
    healthcheck:
      test: ["CMD-SHELL", "timeout 5 bash -c '</dev/tcp/localhost/27017' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M

networks:
  shared_bridge:
    external: true
  backend:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.20.1.0/24

volumes:
  redis:
  mongo:
  elastic:
  static_volume:
  media_volume: