docker-compose.yml

version: "3.8"

services:
  reverse_proxy:
    image: traefik:v2.3
    command:
      - "--providers.docker=true"
      - "--providers.docker.swarmMode=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=clair_frontend"
      - "--accesslog=true"
      - "--entryPoints.web.address=:80"
    depends_on:
      - static_frontend
      - managair_server
      - ingestair
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - frontend
    ports:
      - target: 80
        published: 80

  static_frontend:
    image: clairberlin/website:36
    networks:
      - frontend
    deploy:
      labels:
        - traefik.enable=true
        - traefik.docker.network=clair_frontend
        - traefik.http.routers.clair-frontend.rule=Host(`${CLAIR_DOMAIN}`)
        - traefik.http.routers.clair-frontend.priority=10
        - traefik.http.services.clair-frontend.loadbalancer.server.port=80

  static_frontend_como:
    image: clairberlin/como-website:37
    networks:
      - frontend
    deploy:
      labels:
        - traefik.enable=true
        - traefik.docker.network=clair_frontend
        - traefik.http.routers.como-frontend.rule=Host(`${COMO_DOMAIN}`)
        - traefik.http.routers.como-frontend.priority=10
        - traefik.http.services.como-frontend.loadbalancer.server.port=80

  managair_server:
    image: clairberlin/managair:2.0.0b
    command: python manage.py runserver 0.0.0.0:8888
    depends_on:
      - db
      - redis
    networks:
      - frontend
      - backend
    environment:
      - SECRET_KEY_FILE=/run/secrets/managair_secret_key
      - SENTRY
      - SENTRY_URL_FILE=/run/secrets/sentry_url
      - DEBUG
      - DJANGO_LOG_LEVEL
      - DJANGO_DB_LOG_LEVEL
      - LOG_LEVEL
      - SQL_DATABASE
      - SQL_USER
      - SQL_PASSWORD_FILE=/run/secrets/sql_password
      - SQL_ENGINE=django.db.backends.postgresql
      - SQL_HOST=db
      - SQL_PORT=5432
      - DATABASE=postgresql
      - DB_MIGRATE=${MANAGAIR_DB_MIGRATE-false}
      - COLLECT_STATIC_FILES=${MANAGAIR_COLLECT_STATIC_FILES-false}
      - NODE_FIDELITY=1
      - DJANGO_ALLOWED_HOSTS=${CLAIR_DOMAIN} ${COMO_DOMAIN} localhost 127.0.0.1 [::1]
      - EMAIL_HOST
      - EMAIL_PORT
      - EMAIL_HOST_USER
      - EMAIL_HOST_PASSWORD_FILE=/run/secrets/smtp_password-v3
      - EMAIL_USE_TLS
      - DEFAULT_FROM_EMAIL
      - SP_SUPABASE_URL="" # For the ingestair instance only
      - SP_LOGIN_ENDPOINT="" # For the ingestair instance only
      - SP_SENSOR_ENDPOINT="" # For the ingestair instance only
      - SP_RECORDS_ENDPOINT="" # For the ingestair instance only
      - SP_API_KEY="" # For the ingestair instance only
      - SP_AUTH_TOKEN="" # For the ingestair instance only
      - SP_LOGIN_EMAIL="" # For the ingestair instance only
      - SP_LOGIN_PWD="" # For the ingestair instance only
    secrets:
      - managair_secret_key
      - sql_password
      - smtp_password-v3
      - sentry_url
    deploy:
      labels:
        - traefik.enable=true
        - traefik.docker.network=clair_frontend
        - traefik.http.routers.managair-server.rule=PathPrefix(`/api`, `/static`, `/admin`, `/accounts`)
        - traefik.http.routers.managair-server.priority=30
        - traefik.http.services.managair-server.loadbalancer.server.port=8888

  ingestair:
    # For now, we use the same managair application that also provides the
    # external endpoints. This simplifies sharing of DB models.
    image: clairberlin/managair:1.2.0mp
    command: python manage.py runserver 0.0.0.0:8888
    networks:
      - frontend
      - backend
    depends_on:
      - db
    environment:
      - SECRET_KEY_FILE=/run/secrets/ingestair_secret_key
      - DEBUG
      - DEBUG_TOOLBAR
      - DJANGO_LOG_LEVEL
      - DJANGO_DB_LOG_LEVEL
      - LOG_LEVEL
      - SENTRY=0 # Reserve sentry for managair.
      - SQL_DATABASE
      - SQL_USER
      - SQL_PASSWORD_FILE=/run/secrets/sql_password
      - SQL_ENGINE=django.db.backends.postgresql
      - SQL_HOST=db
      - SQL_PORT=5432
      - DATABASE=postgresql
      - DB_MIGRATE=${INGESTAIR_DB_MIGRATE-false}
      - NODE_FIDELITY=0
      - DJANGO_ALLOWED_HOSTS=ingestair localhost 127.0.0.1 [::1]
      - EMAIL_HOST_PASSWORD="" # Ingestair does not need to send emails.
      - IOTDP_INTEGRATION
      - SP_SUPABASE_URL
      - SP_LOGIN_ENDPOINT
      - SP_SENSOR_ENDPOINT
      - SP_RECORDS_ENDPOINT
      - SP_API_KEY_FILE=/run/secrets/stadtpuls_api_key
      - SP_AUTH_TOKEN_FILE=/run/secrets/stadtpuls_auth_token
      - SP_LOGIN_EMAIL
      - SP_LOGIN_PWD_FILE=/run/secrets/stadtpuls_login_pwd
    secrets:
      - ingestair_secret_key
      - sql_password
      - stadtpuls_api_key
      - stadtpuls_auth_token
      - stadtpuls_login_pwd

  clairchen_forwarder_v3:
    image: clairberlin/clairttn:7mp
    depends_on:
      - ingestair
    networks:
      - frontend
      - backend
    secrets:
      - clairchen_v3_api_key
    environment:
      - CLAIR_MODE=clairchen-forward
      - CLAIR_TTN_APP_ID=clairchen-test
      - CLAIR_TTN_ACCESS_KEY_FILE=/run/secrets/clairchen_v3_api_key
      - CLAIR_API_ROOT=http://ingestair:8888/ingest/v1/
      - CLAIR_TTN_STACK=ttn-v3

  ers_forwarder_v3:
    image: clairberlin/clairttn:7mp
    depends_on:
      - ingestair
    networks:
      - frontend
      - backend
    secrets:
      - ers_v3_api_key
    environment:
      - CLAIR_MODE=ers-forward
      - CLAIR_TTN_APP_ID=elsys-ers-co2
      - CLAIR_TTN_ACCESS_KEY_FILE=/run/secrets/ers_v3_api_key
      - CLAIR_API_ROOT=http://ingestair:8888/ingest/v1/
      - CLAIR_TTN_STACK=ttn-v3

  db:
    image: postgres:13.1
    environment:
      - POSTGRES_DB=${SQL_DATABASE}
      - POSTGRES_USER=${SQL_USER}
      - POSTGRES_PASSWORD=${SQL_PASSWORD}
    networks:
      - backend
    volumes:
      - type: volume
        source: managair-data
        target: /var/lib/postgresql/data

  redis:
    image: redis:6.0.9
    networks:
      - backend

secrets:
  # The access key for the clairchen-test TTN-V3 application.
  clairchen_v3_api_key:
    file: secrets/clairchen-test-ttnv3-apikey.txt

  # The access key for the elsys-ers-co2 TTN-V3 application.
  ers_v3_api_key:
    file: secrets/elsys-ers-co2-ttnv3-apikey.txt

  # The django secret keys, used to sign tokens (among other uses).
  managair_secret_key:
    file: secrets/managair-secret-key.txt
  ingestair_secret_key:
    file: secrets/ingestair-secret-key.txt

  # The password to connect to the PostgreSQL database.
  sql_password:
    file: secrets/sql-password.txt

  # The password to connecto to the SMTP mail server.
  smtp_password-v3:
    file: secrets/smtp-password.txt

  # The secret URL to report errors to Sentry.io.
  sentry_url:
    file: secrets/sentry-url.txt

  # Secrets for Stadpuls integration. Must match the endpoints
  # configured via the environment (staging or prod)
  stadtpuls_api_key:
    file: secrets/stadtpuls-api-key.txt

  stadtpuls_login_pwd:
    file: secrets/stadtpuls-login-pwd.txt

  stadtpuls_auth_token:
    file: secrets/stadtpuls-auth-token.txt

volumes:
  managair-data:
    external: true

networks:
  frontend:
    driver: overlay
    internal: false
    name: clair_frontend
    # For Traefik to refer to this network, we must give it an additional
    # name, because the regular network name ("frontend") will be prefixed by
    # docker swarm with the stack name ("mystack_frontend").
    # See: https://github.com/traefik/traefik/issues/2806#issuecomment-363251746
  backend:
    driver: overlay
    internal: true
    name: clair_backend