docker-compose.deploy.yml

#
# This file is only used by the CI/CD pipeline to deploy images to the environment's VM.
#
# For any local dev work, see docker-compose.yml and *overrides.yml.
#

################################################################################

x-osm-rails-base:
  &osm-rails-base
  image: ${WS_DOCKER_REGISTRY}/workspaces-osm-rails:${WS_DOCKER_TAG}
  restart: always
  environment:
    RAILS_ENV: production
    SECRET_KEY_BASE: ${WS_OSM_SECRET_KEY_BASE}
    WS_OSM_HOST: ${WS_OSM_HOST}
    WS_OSM_DB_HOST: ${WS_OSM_DB_HOST}
    WS_OSM_DB_USER: ${WS_OSM_DB_USER}
    WS_OSM_DB_PASS: ${WS_OSM_DB_PASS}
    WS_OSM_DB_NAME: ${WS_OSM_DB_NAME}
    WS_MAIL_NAME: ${WS_MAIL_NAME}
    WS_MAIL_FROM: ${WS_MAIL_FROM}
    WS_MAIL_CONTACT: ${WS_MAIL_CONTACT}
    WS_MAIL_RETURN_PATH: ${WS_MAIL_RETURN_PATH}
    WS_SMTP_DOMAIN: ${WS_SMTP_DOMAIN}
    WS_SMTP_HOST: ${WS_SMTP_HOST}
    WS_SMTP_PORT: ${WS_SMTP_PORT}
    WS_SMTP_USER: ${WS_SMTP_USER}
    WS_SMTP_PASS: ${WS_SMTP_PASS}
    PIDFILE: /tmp/pids/server.pid
  volumes:
    - osm-rails-tmp:/app/tmp
    - osm-rails-storage:/app/storage
  tmpfs: /tmp/pids/
  stdin_open: true
  tty: true

################################################################################

services:
  # proxy
  reverse-proxy:
    image: traefik:v3.1
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /opt/traefik/acme.json:/letsencrypt/acme.json
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=0s
      - --entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0s
      - --entrypoints.websecure.transport.respondingTimeouts.idleTimeout=600s
      - --certificatesresolvers.myresolver.acme.tlschallenge=true
      - --certificatesresolvers.myresolver.acme.email=${WS_MAIL_ACME}
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    labels:
      - traefik.enable=true
      - traefik.http.middlewares.cors.headers.accesscontrolallowmethods=*
      - traefik.http.middlewares.cors.headers.accesscontrolallowheaders=*
      - traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist=*
      - traefik.http.middlewares.cors.headers.accesscontrolmaxage=100
      - traefik.http.middlewares.cors.headers.addvaryheader=true

  # workspaces FE
  frontend:
    image: ${WS_DOCKER_REGISTRY}/workspaces-frontend:${WS_DOCKER_TAG}
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.frontend.rule=Host(`${WS_FRONTEND_HOST}`)
      - traefik.http.services.frontend.loadbalancer.server.port=80
      - traefik.http.routers.frontend.entrypoints=websecure
      - traefik.http.routers.frontend.tls.certresolver=myresolver

  api:
    image: ${WS_DOCKER_REGISTRY}/workspaces-api:${WS_DOCKER_TAG}
    restart: always
    environment:
      PROJECT_NAME: ${WS_PLATFORM_NAME}
      CORS_ORIGINS: ${WS_API_CORS_ORIGINS}
      OSM_DATABASE_URL: ${WS_OSM_DB_URI}
      TASK_DATABASE_URL: ${WS_TASKS_DB_URI}
      TDEI_BACKEND_URL: ${WS_TDEI_BACKEND_URL}
      TDEI_OIDC_URL: ${WS_TDEI_OIDC_URL}
      TDEI_OIDC_REALM: ${WS_TDEI_OIDC_REALM}
      SENTRY_DSN: ${WS_API_SENTRY_DSN}
      LONGFORM_SCHEMA_URL: ${WS_LONG_FORM_QUEST_SCHEMA_URL}
      IMAGERY_SCHEMA_URL: ${WS_IMAGERY_SCHEMA_URL}
    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`${WS_NEW_API_HOST}`)
      - traefik.http.services.api.loadbalancer.server.port=8000
      - traefik.http.routers.api.entrypoints=websecure
      - traefik.http.routers.api.tls.certresolver=myresolver

  # Legacy tasking manager as workspaces API
  backend:
    # Workspaces backend currently lives in the TM. Emulate a separate server for now:
    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${WS_DOCKER_TAG}
    restart: always
    env_file: tasking-manager/tasking-manager.env
    environment:
      GUNICORN_CMD_ARGS: "--workers 5 --threads 5 --timeout 179"
      WS_LONGFORM_SCHEMA_URL: ${WS_LONG_FORM_QUEST_SCHEMA_URL}
      WS_IMAGERY_SCHEMA_URL: ${WS_IMAGERY_SCHEMA_URL}
    labels:
      - traefik.enable=true
      - traefik.http.routers.workspaces-backend.rule=Host(`${WS_API_HOST}`)
      - traefik.http.services.workspaces-backend.loadbalancer.server.port=5000

      - traefik.http.middlewares.redirect-to-https.replacepathregex.regex=^/api/v1/(.*)
      - traefik.http.middlewares.redirect-to-https.replacepathregex.replacement=/api/v1/$$1/

      - traefik.http.routers.workspaces-backend.middlewares=cors,redirect-to-https
      - traefik.http.routers.workspaces-backend.entrypoints=websecure
      - traefik.http.routers.workspaces-backend.tls.certresolver=myresolver

  # workspaces editors
  rapid:
    image: ${WS_DOCKER_REGISTRY}/workspaces-rapid:${WS_DOCKER_TAG}
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.rapid.rule=Host(`${WS_RAPID_HOST}`)
      - traefik.http.routers.rapid.middlewares=cors
      - traefik.http.services.rapid.loadbalancer.server.port=80
      - traefik.http.routers.rapid.entrypoints=websecure
      - traefik.http.routers.rapid.tls.certresolver=myresolver

  pathways-editor:
    image: ${WS_DOCKER_REGISTRY}/workspaces-pathways-editor:${WS_DOCKER_TAG}
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.pathways-editor.rule=Host(`${WS_PATHWAYS_EDITOR_HOST}`)
      - traefik.http.routers.pathways-editor.middlewares=cors
      - traefik.http.services.pathways-editor.loadbalancer.server.port=80
      - traefik.http.routers.pathways-editor.entrypoints=websecure
      - traefik.http.routers.pathways-editor.tls.certresolver=myresolver

  # workspaces APIs (OSM Rails and C-accelerated)
  osm-web:
    image: ${WS_DOCKER_REGISTRY}/workspaces-osm-web:${WS_DOCKER_TAG}
    restart: always
    depends_on:
      - osm-rails
      - osm-cgimap
    sysctls:
      net.core.somaxconn: 4096
    labels:
      - traefik.enable=true
      - traefik.http.routers.osm-web.rule=Host(`${WS_OSM_HOST}`)
      - traefik.http.services.osm-web.loadbalancer.server.port=80
      - traefik.http.routers.osm-web.entrypoints=websecure
      - traefik.http.routers.osm-web.tls.certresolver=myresolver

  osm-rails:
    <<: *osm-rails-base
    command: bundle exec rails s -p 3000 -b '0.0.0.0'

  osm-rails-worker:
    <<: *osm-rails-base
    command: bundle exec rake jobs:work

  osm-cgimap:
    image: ${WS_DOCKER_REGISTRY}/workspaces-osm-cgimap:${WS_DOCKER_TAG}
    restart: always
    sysctls:
      net.core.somaxconn: 4096
      net.ipv4.tcp_max_syn_backlog: 4096
    environment:
      CGIMAP_INSTANCES: ${WS_CGIMAP_INSTANCES}
      CGIMAP_HOST: ${WS_OSM_DB_HOST}
      CGIMAP_USERNAME: ${WS_OSM_DB_USER}
      CGIMAP_PASSWORD: ${WS_OSM_DB_PASS}
      CGIMAP_DBNAME: ${WS_OSM_DB_NAME}
      CGIMAP_MAX_CHANGESET_ELEMENTS: ${WS_OSM_MAX_CHANGESET_ELEMENTS}
      CGIMAP_MAX_PAYLOAD: ${WS_OSM_MAX_UPLOAD_BYTES}
      CGIMAP_MAP_NODES: ${WS_OSM_MAX_EXPORT_NODES}
      CGIMAP_MAP_AREA: ${WS_OSM_MAX_EXPORT_AREA}

  tasks-backend:
    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${WS_DOCKER_TAG}
    restart: always
    env_file: tasking-manager/tasking-manager.env
    environment:
      GUNICORN_CMD_ARGS: "--workers 5 --threads 5 --timeout 179"
    labels:
      - traefik.enable=true
      - traefik.http.routers.tasks-backend.rule=Host(`${WS_TASKS_HOST}`) && PathPrefix(`/api/`)
      - traefik.http.services.tasks-backend.loadbalancer.server.port=5000
      - traefik.http.routers.tasks-backend.entrypoints=websecure
      - traefik.http.routers.tasks-backend.tls.certresolver=myresolver

  # leaderboard FE/backend
  leaderboard-frontend:
    image: ${WS_DOCKER_REGISTRY}/workspaces-leaderboard-frontend:${WS_DOCKER_TAG}
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.leaderboard-frontend.rule=Host(`${LB_FRONTEND_HOST}`)
      - traefik.http.services.leaderboard-frontend.loadbalancer.server.port=80
      - traefik.http.routers.leaderboard-frontend.entrypoints=websecure
      - traefik.http.routers.leaderboard-frontend.tls.certresolver=myresolver

  leaderboard-backend:
    image: ${WS_DOCKER_REGISTRY}/workspaces-leaderboard-backend:${WS_DOCKER_TAG}
    restart: always
    environment:
      WS_OSM_HOST: ${WS_OSM_HOST}
      WS_OSM_DB_HOST: ${WS_OSM_DB_HOST}
      WS_OSM_DB_USER: ${WS_OSM_DB_USER}
      WS_OSM_DB_PASS: ${WS_OSM_DB_PASS}
      WS_OSM_DB_NAME: ${WS_OSM_DB_NAME}
    labels:
      - traefik.enable=true
      - traefik.http.routers.leaderboard-backend.rule=Host(`${LB_BACKEND_HOST}`)
      - traefik.http.services.leaderboard-backend.loadbalancer.server.port=5000
      - traefik.http.routers.leaderboard-backend.entrypoints=websecure
      - traefik.http.routers.leaderboard-backend.tls.certresolver=myresolver

volumes:
  osm-rails-tmp:
  osm-rails-storage: