docker-compose.yml

version: "3.8"

networks:
  sass-starter-net:

volumes:
  postgres_data:
  mail_data:
  prometheus_data:
  grafana_data:
  clickhouse_data:
  geoip_data:
  yarn_unplugged:

x-service-defaults: &service-defaults
  restart: unless-stopped
  networks:
    - sass-starter-net

services:
  caddy:
    <<: *service-defaults
    image: caddy:2
    networks:
      sass-starter-net:
        aliases:
          - glitchtip.${DOMAIN_NAME:-localtest.me}
    environment:
      - DOMAIN_NAME=${DOMAIN_NAME:-localtest.me}
    ports:
      - "80:80"
      - "443:443"
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:8080
    volumes:
      # This will allow us to more easily access the autogenerated SSL certs.
      - ./tmp/caddy:/data/caddy
      - ./services/caddy/Caddyfile:/etc/caddy/Caddyfile

  # Used as a general purpose endpoint to "swallow" requests, for example we
  # point our glitchtip URL to this when we don't have an actual glitchtip
  # service running.
  echo:
    <<: *service-defaults
    image: jmalloc/echo-server
    environment:
      PORT: 80

  ###################################################################
  # Postgres
  ###################################################################

  postgres:
    <<: *service-defaults
    image: postgres:14
    # For postgis:
    # image: postgis/postgis:14-master
    # Uncomment to expost postgres directly
    # ports:
    #   - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d macadam -U macadam || exit 1"]
      timeout: 5s
      interval: 5s
      start_period: 30s
      retries: 10
    environment:
      POSTGRES_HOST_AUTH_METHOD: "trust"
      # If these are changed, be sure to update `services/postgres/init-db.sh`
      POSTGRES_USER: macadam
      POSTGRES_PASSWORD: macadam!
      POSTGRES_DB: macadam
    volumes:
      - ./services/postgres/docker-entrypoint-initdb.d/:/docker-entrypoint-initdb.d/
      - ./services/postgres/imports:/tmp/imports
      - postgres_data:/var/lib/postgresql

  pgweb:
    <<: *service-defaults
    image: sosedoff/pgweb
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGWEB_DATABASE_URL: postgres://macadam:macadam!@postgres:5432/macadam?sslmode=disable

  ###################################################################
  # Redis
  ###################################################################

  redis:
    <<: *service-defaults
    image: redis
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      timeout: 5s
      interval: 5s
      start_period: 10s
      retries: 10
    environment:
      ALLOW_EMPTY_PASSWORD: "true"

  ###################################################################
  # Kratos
  ###################################################################

  kratos: &kratos
    <<: *service-defaults
    image: oryd/kratos:v1.1
    command: serve -c /etc/config/kratos/kratos.yml --dev
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      kratos-migrate:
        condition: service_completed_successfully
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:4433/health/ready
      interval: 10s
      timeout: 10s
      start_period: 30s
      retries: 5
    environment:
      COURIER_SMTP_CONNECTION_URI: smtp://mail:1025/?disable_starttls=true
      DSN: postgres://kratos:kratos!@postgres:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
      SQA_OPT_OUT: "true"
      LOG_FORMAT: text
      LOG_LEVEL: info #debug # trace
      SESSION_COOKIE_NAME: macadam_session
      SECRETS_COOKIE: PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
      SERVE_PUBLIC_BASE_URL: https://${DOMAIN_NAME:-localtest.me}/kratos/public
      SELFSERVICE_DEFAULT_BROWSER_RETURN_URL: https://${DOMAIN_NAME:-localtest.me}
      SELFSERVICE_ALLOWED_RETURN_URLS: https://${DOMAIN_NAME:-localtest.me},http://${DOMAIN_NAME:-localtest.me}
      SELFSERVICE_FLOWS_ERROR_UI_URL: https://${DOMAIN_NAME:-localtest.me}/auth-error
      SELFSERVICE_FLOWS_SETTINGS_UI_URL: https://${DOMAIN_NAME:-localtest.me}/settings
      SELFSERVICE_FLOWS_RECOVERY_UI_URL: https://${DOMAIN_NAME:-localtest.me}/account/recover
      SELFSERVICE_FLOWS_VERIFICATION_UI_URL: https://${DOMAIN_NAME:-localtest.me}/account/verify
      SELFSERVICE_FLOWS_VERIFICATION_AFTER_DEFAULT_BROWSER_RETURN_URL: https://${DOMAIN_NAME:-localtest.me}
      SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL: https://${DOMAIN_NAME:-localtest.me}
      SELFSERVICE_FLOWS_LOGIN_UI_URL: https://${DOMAIN_NAME:-localtest.me}/login
      SELFSERVICE_FLOWS_REGISTRATION_UI_URL: https://${DOMAIN_NAME:-localtest.me}/signup
      SELFSERVICE_METHODS_WEBAUTHN_CONFIG_RP_ID: ${DOMAIN_NAME:-localtest.me}
    volumes:
      - ./services/kratos/config:/etc/config/kratos
      - ./services/kratos/templates:/conf/courier-templates

  kratos-migrate:
    <<: *kratos
    command: -c /etc/config/kratos/kratos.yml migrate sql -e --yes
    restart: on-failure
    healthcheck: {}
    depends_on:
      postgres:
        condition: service_healthy

  kratos-courier:
    <<: *kratos
    command: courier watch --expose-metrics-port 4434 -c /etc/config/kratos/kratos.yml
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:4434/metrics/prometheus
      interval: 10s
      timeout: 10s
      start_period: 20s
      retries: 5

  ###################################################################
  # Mail catcher
  ###################################################################

  mail:
    <<: *service-defaults
    build:
      context: https://github.com/maildev/maildev.git
    healthcheck:
      test: nc -v -z localhost 1025
      start_period: 20s
    environment:
      MAILDEV_MAIL_DIRECTORY: /home/node/test
    volumes:
      # mail_data has to be mounted in a directory that is owned by the
      # `node` user defined in the maildev Dockerfile, otherwise it won't have
      # write permission to the directory.
      - mail_data:/home/node/test

  ###################################################################
  # Macadam
  ###################################################################

  api-server: &api-server
    <<: *service-defaults
    image: node:20.11
    command: ["yarn", "workspace", "@macadam/api-server", "run", "start:dev"]
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:4000/api/health
      interval: 30s
      retries: 10
      start_period: 20s
      timeout: 10s
    working_dir: /var/macadam
    depends_on:
      yarn:
        condition: service_completed_successfully
      api-server-migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      DB_URL: postgresql://macadam:macadam!@postgres:5432/macadam
      KRATOS_DB_URL: postgresql://macadam:macadam!@postgres:5432/kratos
      KRATOS_ADMIN_URL: http://kratos:4434/
      KRATOS_PUBLIC_URL: http://kratos:4433/
      KRATOS_SESSION_COOKIE_NAME: macadam_session # Should match the `SESSION_COOKIE_NAME` value in kratos service.
      LOG_PRETTY: "true"
      NODE_ENV: development
      PORT: 4000
      REDIS_URL: redis://redis:6379/0
      # Key should match API_PROJECT_KEY in `seed_macadam.py` with dashes stripped
      SENTRY_DSN: http://31e5d0461ecc46ce9f32af55e9f4af88@glitchtip-web:8080/2
      # If we tunnel glitchtip requests, make sure they are mapped to the correct internal URL
      # This first value should match the `VITE_SENTRY_DSN` value for client-web, while the second should be the actual sentry server.
      # as it is accessible from the api-server
      SENTRY_TUNNELABLE_DSNS: "http://239d589a58d24675be8159b19718b22e@glitchtip-web:8080/1"
      SMTP_MAIL_TO: contact@macadam.com
      SMTP_URI: smtp://mail:1025/?disable_starttls=true
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317
    volumes:
      - .:/var/macadam
      - yarn_unplugged:/var/macadam/.yarn/unplugged/

  # Ensures dependencies are up-to-date/pulled before running api-server commands
  yarn:
    <<: *api-server
    command: ["yarn"]
    restart: on-failure
    healthcheck: {}
    depends_on: []

  # Runs database migrations
  api-server-migrate:
    <<: *api-server
    command: ["yarn", "workspace", "@macadam/api-server", "run", "migration:up"]
    restart: on-failure
    healthcheck: {}
    depends_on:
      yarn:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy

  # Builds the `api-client` package (and rebuilds on file changes)
  api-client-builder:
    <<: *service-defaults
    build:
      context: .
      dockerfile: ./packages/api-client/dev.Dockerfile
    healthcheck: {}
    depends_on:
      yarn:
        condition: service_completed_successfully
    volumes:
      - .:/var/macadam
      - yarn_unplugged:/var/macadam/.yarn/unplugged/

  client-web:
    <<: *service-defaults
    build:
      context: .
      dockerfile: ./packages/client-web/dev.Dockerfile
    command:
      [
        "yarn",
        "workspace",
        "@macadam/client-web",
        "run",
        "start",
        "--host",
        "0.0.0.0",
      ]
    depends_on:
      yarn:
        condition: service_completed_successfully
    #   api-client-builder:
    #     condition: service_healthy
    environment:
      # Key should match WEB_PROJECT_KEY in `seed_macadam.py` with dashes stripped
      VITE_SENTRY_DSN: "http://239d589a58d24675be8159b19718b22e@glitchtip-web:8080/1"
      VITE_SENTRY_TUNNEL: "/api/v1/monitor"
      VITE_PLAUSIBLE_HOST: https://plausible.${DOMAIN_NAME:-localtest.me}
    volumes:
      - .:/var/macadam
      - yarn_unplugged:/var/macadam/.yarn/unplugged/

  client-web-storybook:
    <<: *service-defaults
    profiles: ["storybook"]
    ports:
      - 6006:6006
    build:
      context: .
      dockerfile: ./packages/client-web/dev.Dockerfile
    command:
      ["yarn", "workspace", "@macadam/client-web", "run", "storybook:legacy"]
    depends_on:
      yarn:
        condition: service_completed_successfully
    volumes:
      - .:/var/macadam
      - yarn_unplugged:/var/macadam/.yarn/unplugged/

  expo-cli:
    <<: *service-defaults
    profiles: ["expo"]
    build:
      context: ./services/expo-cli
    tty: true
    working_dir: /var/macadam/packages/client-mobile
    volumes:
      - .:/var/macadam
      - yarn_unplugged:/var/macadam/.yarn/unplugged/

  ###################################################################
  # Telemetry (`--profile telemetry`)
  ###################################################################

  otel-collector:
    <<: *service-defaults
    # profiles: ["telemetry"]
    image: otel/opentelemetry-collector-contrib:0.95.0
    deploy:
      resources:
        limits:
          memory: 125M
    restart: unless-stopped
    volumes:
      - ./services/otel-collector/otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml

  jaeger:
    <<: *service-defaults
    profiles: ["telemetry"]
    image: jaegertracing/all-in-one:1
    command:
      - "--memory.max-traces=8000"
      - "--query.base-path=/jaeger/ui"
      - "--prometheus.server-url=http://prometheus"
      - "--prometheus.query.normalize-calls=true"
      - "--prometheus.query.normalize-duration=true"
    deploy:
      resources:
        limits:
          memory: 300M
    restart: unless-stopped
    environment:
      - METRICS_STORAGE_TYPE=prometheus

  prometheus:
    <<: *service-defaults
    profiles: ["telemetry"]
    image: prom/prometheus:v2
    volumes:
      - ./services/prometheus:/etc/prometheus/
      - prometheus_data:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--web.console.libraries=/etc/prometheus/console_libraries"
      - "--web.console.templates=/etc/prometheus/consoles"
      - "--storage.tsdb.retention.time=200h"
      - "--web.enable-lifecycle"
    labels:
      org.label-schema.group: "monitoring"

  grafana:
    <<: *service-defaults
    profiles: ["telemetry"]
    image: grafana/grafana:10.3.3
    depends_on:
      - prometheus
    volumes:
      - grafana_data:/var/lib/grafana
      - ./services/grafana/provisioning:/etc/grafana/provisioning
    environment:
      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin!}
      - GF_USERS_ALLOW_SIGN_UP=false
    labels:
      org.label-schema.group: "monitoring"

  # alertmanager:
  #   profiles: ["telemetry"]
  #   image: prom/alertmanager:v0.24.0
  #   volumes:
  #     - ./services/alertmanager:/etc/alertmanager
  #   command:
  #     - "--config.file=/etc/alertmanager/config.yml"
  #     - "--storage.path=/alertmanager"
  #   restart: unless-stopped
  #   # expose:
  #   #   - 9093
  #   labels:
  #     org.label-schema.group: "monitoring"

  # nodeexporter:
  #   profiles: ["telemetry"]
  #   image: prom/node-exporter:v1.0.1
  #   volumes:
  #     - /proc:/host/proc:ro
  #     - /sys:/host/sys:ro
  #     - /:/rootfs:ro
  #   command:
  #     - "--path.procfs=/host/proc"
  #     - "--path.rootfs=/rootfs"
  #     - "--path.sysfs=/host/sys"
  #     - "--collector.filesystem.ignored-mount-points=^/(sys|proc|dev|host|etc)($$|/)"
  #   restart: unless-stopped
  #   labels:
  #     org.label-schema.group: "monitoring"

  postgres-exporter:
    <<: *service-defaults
    profiles: ["telemetry"]
    image: wrouesnel/postgres_exporter:v0.8.0
    environment:
      DATA_SOURCE_NAME: postgres://macadam:macadam!@postgres:5432/macadam?sslmode=disable
    labels:
      org.label-schema.group: "monitoring"

  ###################################################################
  # Analytics (`--profile analytics`)
  ###################################################################

  clickhouse:
    <<: *service-defaults
    profiles: ["analytics"]
    # image: yandex/clickhouse-server:21.3
    # Use this image if running on ARM64 (i.e. Mac M1) until a multi-arch image
    # is available from yandex: https://github.com/ClickHouse/ClickHouse/issues/22222
    image: clickhouse/clickhouse-server:24.2
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:8123/ping
      interval: 60s
      retries: 5
      start_period: 20s
      timeout: 10s
    environment:
      CLICKHOUSE_DB: plausible
    volumes:
      - clickhouse_data:/var/lib/clickhouse
      - ./services/clickhouse/clickhouse-config.xml:/etc/clickhouse-server/config.d/logging.xml:ro
      - ./services/clickhouse/clickhouse-user-config.xml:/etc/clickhouse-server/users.d/logging.xml:ro
    ulimits:
      nofile:
        soft: 262144
        hard: 262144

  geoip:
    <<: *service-defaults
    profiles: ["analytics"]
    image: maxmindinc/geoipupdate
    healthcheck:
      test: stat /usr/share/GeoIP/GeoLite2-Country.mmdb
      start_period: 30s
    environment:
      GEOIPUPDATE_EDITION_IDS: GeoLite2-Country
      GEOIPUPDATE_FREQUENCY: 168 # update every 7 days
      GEOIPUPDATE_ACCOUNT_ID: ${GEOIPUPDATE_ACCOUNT_ID}
      GEOIPUPDATE_LICENSE_KEY: ${GEOIPUPDATE_LICENSE_KEY}
    volumes:
      - geoip_data:/usr/share/GeoIP

  plausible:
    <<: *service-defaults
    profiles: ["analytics"]
    image: plausible/analytics:v1
    command: sh -c "sleep 10 && /entrypoint.sh db migrate && /entrypoint.sh db init-admin && /entrypoint.sh run"
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:8000/api/health
      interval: 30s
      retries: 10
      start_period: 20s
      timeout: 10s
    depends_on:
      postgres:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
      mail:
        condition: service_started
      geoip:
        condition: service_healthy
    environment:
      ADMIN_USER_EMAIL: macadam@${DOMAIN_NAME:-localtest.me}
      ADMIN_USER_NAME: macadam
      ADMIN_USER_PWD: macadam!
      DISABLE_AUTH: "true"
      BASE_URL: https://plausible.${DOMAIN_NAME:-localtest.me}
      SECRET_KEY_BASE: USbJSimhObRflMa+UC8iku9Iqhpr1RtPeLaEl8uuJpI44X+zoha1L9Jeo/7dgKUMZtMTGnDTsgYfYxcQ40ZSAA==
      DATABASE_URL: postgresql://plausible:plausible!@postgres:5432/plausible
      CLICKHOUSE_DATABASE_URL: http://clickhouse:8123/plausible
      SMTP_HOST_ADDR: mail
      SMTP_HOST_PORT: 1025
      GEOLITE2_COUNTRY_DB: /geoip/GeoLite2-Country.mmdb
    volumes:
      - geoip_data:/geoip:ro

  # ###################################################################
  # # GlitchTip (`--profile error-tracking`)
  # ###################################################################

  # NOTE: On ARM64 you will be spammed with messages like:
  # "*** uWSGI listen queue of socket ":8000" (fd: 3) full !!! (26472960/64) ***"
  # I can't figure out how to fix this. Rebuilding the docker image fails on
  # ARM64 when installing symbolic (see: https://github.com/getsentry/symbolic/issues/76).
  # There seems to be no other adverse effects, though, so I've given up on this for now.
  glitchtip: &glitchtip
    <<: *service-defaults
    profiles: ["error-tracking"]
    image: glitchtip/glitchtip
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      glitchtip-migrate:
        condition: service_completed_successfully
    environment:
      DATABASE_URL: postgresql://glitchtip:glitchtip!@postgres:5432/glitchtip
      REDIS_URL: redis://redis:6379/1
      SECRET_KEY: change_me # best to run openssl rand -hex 32
      EMAIL_URL: smtp://mail:1025/?skip_ssl_verify=true # https://glitchtip.com/documentation/install#configuration
      DEFAULT_FROM_EMAIL: glitchtip@macadam.com
      APP_URL: https://glitchtip.${DOMAIN_NAME:-localtest.me}
      GLITCHTIP_DOMAIN: https://glitchtip.${DOMAIN_NAME:-localtest.me}
      SERVER_PORT: 80
      ENABLE_OPEN_USER_REGISTRATION: "true"
      CELERY_WORKER_CONCURRENCY: 2 # Set to 2 to prevent excessive memory usage. Change it or remove to set it to the number of cpu cores.
      I_PAID_FOR_GLITCHTIP: "false"

  glitchtip-migrate:
    <<: *glitchtip
    command: bash -c "./manage.py migrate && ./manage.py seed_macadam"
    restart: on-failure
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./docker-services/glitchtip/commands/seed_macadam.py:/code/glitchtip/management/commands/seed_macadam.py

  glitchtip-worker:
    <<: *glitchtip
    command: celery -A glitchtip worker -B -l INFO
    depends_on:
      postgres:
        condition: service_healthy
      glitchtip-migrate:
        condition: service_completed_successfully