docker-stack.yml

version: '3.2'

services:
  traefik:
    image: traefik:v2.4
    ports:
      - "80:80"
      - "443:443"
    networks:
      - traefik-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik:/etc/traefik
      - ./traefik/acme:/acme
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"
    environment:
      - CF_DNS_API_TOKEN=$WT_CLOUDFLARE_TOKEN

  mongo:
    image: mongo:3.2
    networks:
      - mongo
    volumes:
      - mongo-data:/data/db
      - mongo-cfg:/data/configdb
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  girder:
    image: wholetale/girder:v1.2
    networks:
      - traefik-net
      - celery
      - mongo
    volumes:
      - ./volumes:/tmp/data
      - ./girder/girder.local.cfg:/girder/girder/conf/girder.local.cfg
      # - ./src/wholetale:/girder/plugins/wholetale
      # - ./src/wt_data_manager:/girder/plugins/wt_data_manager
      # - ./src/wt_home_dir:/girder/plugins/wt_home_dir
      # - ./src/wt_versioning:/girder/plugins/wt_versioning
      # - ./src/globus_handler:/girder/plugins/globus_handler
      # - ./src/virtual_resources:/girder/plugins/virtual_resources
      # - ./src/gwvolman:/gwvolman
      # - ./src/girderfs:/girderfs
      - /var/run/docker.sock:/var/run/docker.sock
      - /tmp:/tmp
    environment:
      - DOMAIN=$WT_DOMAIN
      - DASHBOARD_URL=https://dashboard.${WT_DOMAIN}
      - GOSU_USER=girder:girder:999
      - "GOSU_CHOWN=/tmp/data"
      - DATAONE_URL=https://cn-stage-2.test.dataone.org/cn
      - HOSTDIR=/
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.girder.rule=Host(`girder.${WT_DOMAIN}`)"
        - "traefik.http.routers.girder.entrypoints=websecure"
        - "traefik.http.routers.girder.tls=true"
        - "traefik.http.routers.girder.tls.certresolver=default"
        - "traefik.http.routers.girder.tls.domains[0].main=${WT_DOMAIN}"
        - "traefik.http.routers.girder.tls.domains[0].sans=*.${WT_DOMAIN}"
        - "traefik.http.services.girder.loadbalancer.server.port=8080"
        - "traefik.http.services.girder.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"
        - "traefik.http.middlewares.girder.forwardauth.address=http://girder:8080/api/v1/instance/authorize/"
        - "traefik.http.middlewares.girder.forwardauth.trustforwardheader=true"

  logger:
    image: wholetale/instance_logger:latest
    networks:
      - celery
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  redis:
    image: redis:4-stretch
    networks:
      - celery
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  dashboard:
    image: wholetale/ngx-dashboard:v1.2
    networks:
      - traefik-net
    environment:
      - GIRDER_API_URL=https://girder.${WT_DOMAIN}/api/v1
      - AUTH_PROVIDER=Globus
      - DATAONE_URL=https://cn.dataone.org/cn/v2
      - RTD_URL=https://wholetale.readthedocs.io/en/latest
      - DASHBOARD_DEV=true
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.dashboard.rule=Host(`dashboard.${WT_DOMAIN}`)"
        - "traefik.http.routers.dashboard.entrypoints=websecure"
        - "traefik.http.routers.dashboard.tls=true"
        - "traefik.http.services.dashboard.loadbalancer.server.port=80"
        - "traefik.http.services.dashboard.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"
    #volumes:
    #  - ./src/ngx-dashboard/dist/browser/:/usr/share/nginx/html/
  
  instance-errors:
    image: wholetale/custom-errors:latest
    networks:
      - traefik-net
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.instance-errors.rule=HostRegexp(`{host:tmp-.*}`)"
        - "traefik.http.routers.instance-errors.entrypoints=websecure"
        - "traefik.http.routers.instance-errors.tls=true"
        - "traefik.http.routers.instance-errors.priority=1"
        - "traefik.http.routers.instance-errors.middlewares=error-pages-middleware"
        - "traefik.http.middlewares.error-pages-middleware.errors.status=400-599"
        - "traefik.http.middlewares.error-pages-middleware.errors.service=instance-errors"
        - "traefik.http.middlewares.error-pages-middleware.errors.query=/{status}.html"
        - "traefik.http.services.instance-errors.loadbalancer.server.port=80"
        - "traefik.docker.network=wt_traefik-net"

  registry:
    image: registry:2.6
    networks:
      - traefik-net
    volumes:
      - ./registry:/var/lib/registry
      - ./registry/auth:/auth:ro
    environment:
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm"
      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/registry.password
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.registry.rule=Host(`registry.${WT_DOMAIN}`)"
        - "traefik.http.routers.registry.entrypoints=websecure"
        - "traefik.http.routers.registry.tls=true"
        - "traefik.http.services.registry.loadbalancer.server.port=5000"
        - "traefik.http.services.registry.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"

  images:
    image: registry:2.6
    networks:
      - traefik-net
    volumes:
      - ./registry:/var/lib/registry:ro
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.images.rule=Host(`images.${WT_DOMAIN}`)"
        - "traefik.http.routers.images.rule=Method(`GET`)"
        - "traefik.http.routers.images.entrypoints=websecure"
        - "traefik.http.routers.images.tls=true"
        - "traefik.http.services.images.loadbalancer.server.port=5000"
        - "traefik.http.services.images.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"

  instance_errors:
    image: wholetale/custom-errors:v1.1
    networks:
      - traefik-net
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.instance-errors.rule=HostRegexp(`{host:tmp-.*}`)"
        - "traefik.http.routers.instance-errors.entrypoints=websecure"
        - "traefik.http.routers.instance-errors.tls=true"
        - "traefik.http.routers.instance-errors.priority=1"
        - "traefik.http.routers.instance-errors.middlewares=error-pages-middleware"
        - "traefik.http.middlewares.error-pages-middleware.errors.status=400-599"
        - "traefik.http.middlewares.error-pages-middleware.errors.service=instance-errors"
        - "traefik.http.middlewares.error-pages-middleware.errors.query=/{status}.html"
        - "traefik.http.services.instance-errors.loadbalancer.server.port=80"
        - "traefik.docker.network=wt_traefik-net"

#  celery_worker:
#    image: wholetale/gwvolman
#    networks:
#      - celery
#    labels:
#      - "traefik.enable=false"
#    environment:
#      - GIRDER_API_URL=https://girder.${WT_DOMAIN}/api/v1
#      - HOSTDIR=/host
#      - DOMAIN=${WT_DOMAIN}
#      - TRAEFIK_NETWORK=wt_traefik-net
#      - TRAEFIK_ENTRYPOINT=https
#      - REGISTRY_USER=fido
#      - REGISTRY_URL=https://registry.${WT_DOMAIN}
#      - REGISTRY_PASS=secretpass
#    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock:ro
#      - /:/host
#      - /var/cache/davfs2:/var/cache/davfs2
#      - /run/mount.davfs:/run/mount.davfs
#    cap_add:
#      - SYS_ADMIN
#      - SYS_PTRACE
#    devices:
#      - /dev/fuse:/dev/fuse
#    command: -Q manager,celery,xa3bl9runqzk8dgbl5gc6nlnq --hostname=xa3bl9runqzk8dgbl5gc6nlnq


networks:
  traefik-net:
    driver: overlay
  mongo:
    driver: overlay
    attachable: true
  celery:
    driver: overlay
    attachable: true

volumes:
  mongo-data: {}
  mongo-cfg: {}