mirror of https://github.com/samply/bridgehead.git
100 lines
3.8 KiB
YAML
100 lines
3.8 KiB
YAML
version: "3.7"
|
|
|
|
services:
|
|
dnpm-mysql:
|
|
image: mysql:9
|
|
healthcheck:
|
|
test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ]
|
|
interval: 3s
|
|
timeout: 5s
|
|
retries: 5
|
|
environment:
|
|
MYSQL_ROOT_HOST: "%"
|
|
MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD}
|
|
volumes:
|
|
- /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql
|
|
|
|
dnpm-authup:
|
|
image: authup/authup:latest
|
|
container_name: bridgehead-dnpm-authup
|
|
volumes:
|
|
- /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
|
|
depends_on:
|
|
dnpm-mysql:
|
|
condition: service_healthy
|
|
command: server/core start
|
|
environment:
|
|
- PUBLIC_URL=https://${HOST}/auth/
|
|
- AUTHORIZE_REDIRECT_URL=https://${HOST}
|
|
- ROBOT_ADMIN_ENABLED=true
|
|
- ROBOT_ADMIN_SECRET=${DNPM_AUTHUP_SECRET}
|
|
- ROBOT_ADMIN_SECRET_RESET=true
|
|
- DB_TYPE=mysql
|
|
- DB_HOST=dnpm-mysql
|
|
- DB_USERNAME=root
|
|
- DB_PASSWORD=${DNPM_MYSQL_ROOT_PASSWORD}
|
|
- DB_DATABASE=auth
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.middlewares.authup-strip.stripprefix.prefixes=/auth"
|
|
- "traefik.http.routers.dnpm-auth.middlewares=authup-strip"
|
|
- "traefik.http.routers.dnpm-auth.rule=PathPrefix(`/auth`)"
|
|
- "traefik.http.services.dnpm-auth.loadbalancer.server.port=3000"
|
|
- "traefik.http.routers.dnpm-auth.tls=true"
|
|
|
|
dnpm-portal:
|
|
image: ghcr.io/dnpm-dip/portal:latest
|
|
container_name: bridgehead-dnpm-portal
|
|
environment:
|
|
- NUXT_API_URL=http://dnpm-backend:9000/
|
|
- NUXT_PUBLIC_API_URL=https://${HOST}/api/
|
|
- NUXT_AUTHUP_URL=http://dnpm-authup:3000/
|
|
- NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)"
|
|
- "traefik.http.services.dnpm-frontend.loadbalancer.server.port=3000"
|
|
- "traefik.http.routers.dnpm-frontend.tls=true"
|
|
|
|
dnpm-backend:
|
|
container_name: bridgehead-dnpm-backend
|
|
image: ghcr.io/dnpm-dip/backend:latest
|
|
environment:
|
|
- LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
|
|
- RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
|
|
- MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
|
|
- HATEOAS_HOST=https://${HOST}
|
|
- CONNECTOR_TYPE=broker
|
|
- AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
|
|
volumes:
|
|
- /etc/bridgehead/dnpm/config:/dnpm_config
|
|
- /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
|
|
depends_on:
|
|
dnpm-authup:
|
|
condition: service_healthy
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000"
|
|
# expose everything
|
|
- "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)"
|
|
- "traefik.http.routers.dnpm-backend.tls=true"
|
|
- "traefik.http.routers.dnpm-backend.service=dnpm-backend"
|
|
# except ETL
|
|
- "traefik.http.routers.dnpm-backend-etl.rule=PathRegexp(`^/api(/.*)?etl(/.*)?$`)"
|
|
- "traefik.http.routers.dnpm-backend-etl.tls=true"
|
|
- "traefik.http.routers.dnpm-backend-etl.service=dnpm-backend"
|
|
# this needs an ETL processor with support for basic auth
|
|
- "traefik.http.routers.dnpm-backend-etl.middlewares=auth"
|
|
# except peer-to-peer
|
|
- "traefik.http.routers.dnpm-backend-peer.rule=PathRegexp(`^/api(/.*)?/peer2peer(/.*)?$`)"
|
|
- "traefik.http.routers.dnpm-backend-peer.tls=true"
|
|
- "traefik.http.routers.dnpm-backend-peer.service=dnpm-backend"
|
|
- "traefik.http.routers.dnpm-backend-peer.middlewares=dnpm-backend-peer"
|
|
# this effectively denies all requests
|
|
# this is okay, because requests from peers don't go through Traefik
|
|
- "traefik.http.middlewares.dnpm-backend-peer.ipWhiteList.sourceRange=0.0.0.0/32"
|
|
|
|
landing:
|
|
labels:
|
|
- "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"
|