docker-compose.yml

version: '3.5'

services:
  server:
    build: server/
    ports:
      - '${SERVER_PORT}:${SERVER_PORT}'
      - '${CLUSTER_MANAGER_PORT}:${CLUSTER_MANAGER_PORT}'
      - '${CLUSTER_NODE_PORT}:${CLUSTER_NODE_PORT}'
      - '${CLUSTER_NODE_PORT}:${CLUSTER_NODE_PORT}/udp'
      - '${CLUSTER_NETWORK_PORT}:${CLUSTER_NETWORK_PORT}/udp'
      - '${TASK_QUEUE_PORT}:${TASK_QUEUE_PORT}'
    environment:
      - SERVER_PORT
      - API_DOMAIN
      - API_HOSTNAME
      - API_PORT
      - CLUSTER_HOSTNAME
      - CLUSTER_MANAGER_PORT
      - CLUSTER_NODE_PORT
      - CLUSTER_NETWORK_PORT
      - REGISTRY_DOMAIN
      - REGISTRY_HOSTNAME
      - REGISTRY_PORT
      - CONSOLE_DOMAIN
      - CONSOLE_HOSTNAME
      - CONSOLE_PORT
      - STORAGE_DOMAIN
      - STORAGE_HOSTNAME
      - STORAGE_PORT
      - TASK_QUEUE_HOSTNAME
      - TASK_QUEUE_PORT
    networks:
      - renderable
    depends_on:
      - api
    restart: unless-stopped
  api:
    build: api/
    expose:
      - '${API_PORT}'
    environment:
      - API_DOMAIN
      - API_VERSION
      - API_PRODUCTION
      - API_WORKERS
      - API_WEBSOCKET_TIMEOUT
      - API_WEBSOCKET_HEARTBEAT_PERIOD
      - API_MAXIMUM_TASK_RETRIES
      - API_PORT
      - CLUSTER_DOMAIN_IP
      - CLUSTER_HOSTNAME
      - CLUSTER_PORT
      - CLUSTER_MANAGER_PORT
      - CLUSTER_CERTIFICATE_PATH=/etc/ssl/certs/cluster/
      - REGISTRY_DOMAIN
      - DATABASE_HOSTNAME
      - DATABASE_PORT
      - STORAGE_DOMAIN
      - STORAGE_HOSTNAME
      - STORAGE_PORT
      - CONTAINER_QUEUE_HOSTNAME
      - CONTAINER_QUEUE_PORT
      - TASK_QUEUE_DOMAIN
      - TASK_QUEUE_HOSTNAME
      - TASK_QUEUE_PORT
      - RESOURCE_QUEUE_HOSTNAME
      - RESOURCE_QUEUE_PORT
      - STATE_QUEUE_HOSTNAME
      - STATE_QUEUE_PORT
    secrets:
      - api_access_key
      - registry_username
      - registry_password
      - database_username
      - database_password
      - storage_access_key
      - storage_secret_key
      - container_queue_username
      - container_queue_password
      - task_queue_username
      - task_queue_password
      - resource_queue_username
      - resource_queue_password
      - state_queue_username
      - state_queue_password
    volumes:
      - cluster_certificate:/etc/ssl/certs/cluster/
    networks:
      renderable:
        aliases:
          - ${API_HOSTNAME}
    depends_on:
      - cluster
      - database
      - storage
      - container_queue
      - task_queue
      - resource_queue
      - state_queue
    restart: unless-stopped
  autoscaler:
    build: autoscaler/
    environment:
      - CLUSTER_CLEANUP_PERIOD
      - CLUSTER_COOLDOWN_PERIOD
      - CLUSTER_HOSTNAME
      - CLUSTER_PORT
      - CLUSTER_CERTIFICATE_PATH=/etc/ssl/certs/cluster/
      - CONTAINER_QUEUE_HOSTNAME
      - CONTAINER_QUEUE_PORT
    secrets:
      - container_queue_username
      - container_queue_password
    volumes:
      - cluster_certificate:/etc/ssl/certs/cluster/
    networks:
      - renderable
    depends_on:
      - cluster
      - container_queue
    restart: unless-stopped
  compressor:
    build: compressor/
    environment:
      - API_PRODUCTION
      - DATABASE_HOSTNAME
      - DATABASE_PORT
      - STORAGE_DOMAIN
      - STORAGE_HOSTNAME
      - STORAGE_PORT
      - RESOURCE_QUEUE_HOSTNAME
      - RESOURCE_QUEUE_PORT
      - STATE_QUEUE_HOSTNAME
      - STATE_QUEUE_PORT
    secrets:
      - database_username
      - database_password
      - storage_access_key
      - storage_secret_key
      - resource_queue_username
      - resource_queue_password
      - state_queue_username
      - state_queue_password
    networks:
      - renderable
    depends_on:
      - database
      - storage
      - resource_queue
      - state_queue
    restart: unless-stopped
  cluster:
    image: docker:19.03.12-dind
    hostname: ${CLUSTER_HOSTNAME}
    expose:
      - '${CLUSTER_PORT}'
      - '${CLUSTER_MANAGER_PORT}'
      - '${CLUSTER_NODE_PORT}'
      - '${CLUSTER_NODE_PORT}/udp'
      - '${CLUSTER_NETWORK_PORT}/udp'
    privileged: true
    volumes:
      - cluster:/var/lib/docker/
      - cluster_certificate:/certs/client/
    networks:
      renderable:
        aliases:
          - ${CLUSTER_HOSTNAME}
    command: '--insecure-registry=${CLUSTER_INSECURE_REGISTRY}'
    depends_on:
      - registry
    restart: unless-stopped
  registry:
    image: registry:2.7
    expose:
      - '${REGISTRY_PORT}'
    environment:
      - REGISTRY_HTTP_ADDR=:${REGISTRY_PORT}
      - REGISTRY_HTTP_SECRET_FILE=/run/secrets/registry_secret_key
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM='Renderable Registry'
      - REGISTRY_AUTH_HTPASSWD_PATH=/run/secrets/registry_encrypted_password
      - REGISTRY_STORAGE_CACHE_BLOBDESCRIPTOR=redis
      - REGISTRY_REDIS_ADDR=${CACHE_HOSTNAME}:${CACHE_PORT}
      - REGISTRY_REDIS_PASSWORD_FILE=/run/secrets/cache_password
    secrets:
      - registry_encrypted_password
      - registry_secret_key
      - cache_password
    volumes:
      - registry:/var/lib/registry/
    networks:
      renderable:
        aliases:
          - ${REGISTRY_HOSTNAME}
    command: '/bin/sh -c \
      "REGISTRY_HTTP_SECRET=\"$$(cat $$REGISTRY_HTTP_SECRET_FILE)\"
      REGISTRY_REDIS_PASSWORD=\"$$(cat $$REGISTRY_REDIS_PASSWORD_FILE)\"
      registry serve /etc/docker/registry/config.yml"'
    depends_on:
      - cache
    restart: unless-stopped
  console:
    image: portainer/portainer:1.24.1-alpine
    expose:
      - '${CONSOLE_PORT}'
    environment:
      - PORTAINER_PASSWORD_FILE=/run/secrets/console_encrypted_password
    secrets:
      - console_encrypted_password
    volumes:
      - console:/data/
      - cluster_certificate:/certs/
    networks:
      renderable:
        aliases:
          - ${CONSOLE_HOSTNAME}
    entrypoint: ''
    command: '/bin/sh -c \
      "./portainer -H tcp://${CLUSTER_HOSTNAME}:${CLUSTER_PORT} --tlsverify --admin-password \"$$(cat $$PORTAINER_PASSWORD_FILE)\""'
    depends_on:
      - cluster
    restart: unless-stopped
  cache:
    image: redis:6.0.5
    expose:
      - '${CACHE_PORT}'
    environment:
      - REDIS_PASSWORD_FILE=/run/secrets/cache_password
    secrets:
      - cache_password
    volumes:
      - cache:/data/
    networks:
      renderable:
        aliases:
          - ${CACHE_HOSTNAME}
    command: '/bin/bash -c \
      "redis-server --port ${CACHE_PORT} --requirepass \"$$(cat $$REDIS_PASSWORD_FILE)\""'
    restart: unless-stopped
  database:
    image: mongo:4.2.6
    expose:
      - '${DATABASE_PORT}'
    environment:
      - MONGO_INITDB_DATABASE=db
      - MONGO_INITDB_ROOT_USERNAME_FILE=/run/secrets/database_username
      - MONGO_INITDB_ROOT_PASSWORD_FILE=/run/secrets/database_password
    secrets:
      - database_username
      - database_password
    volumes:
      - database:/data/db/
    networks:
      renderable:
        aliases:
          - ${DATABASE_HOSTNAME}
    command: 'mongod --port ${DATABASE_PORT}'
    restart: unless-stopped
  storage:
    image: minio/minio:RELEASE.2020-05-16T01-33-21Z
    expose:
      - '${STORAGE_PORT}'
    environment:
      - MINIO_ACCESS_KEY_FILE=storage_access_key
      - MINIO_SECRET_KEY_FILE=storage_secret_key
      - MINIO_BROWSER=on
    secrets:
      - storage_access_key
      - storage_secret_key
    volumes:
      - storage:/data/
    networks:
      renderable:
        aliases:
          - ${STORAGE_HOSTNAME}
    command: 'minio server --address :${STORAGE_PORT} /data/'
    restart: unless-stopped
  container_queue:
    image: rabbitmq:3.8-management
    expose:
      - '${CONTAINER_QUEUE_PORT}'
    environment:
      - RABBITMQ_NODE_PORT=${CONTAINER_QUEUE_PORT}
      - RABBITMQ_DEFAULT_USER_FILE=/run/secrets/container_queue_username
      - RABBITMQ_DEFAULT_PASS_FILE=/run/secrets/container_queue_password
    secrets:
      - container_queue_username
      - container_queue_password
    volumes:
      - container_queue:/data/
    networks:
      renderable:
        aliases:
          - ${CONTAINER_QUEUE_HOSTNAME}
    restart: unless-stopped
  task_queue:
    image: rabbitmq:3.8-management
    expose:
      - '${TASK_QUEUE_PORT}'
    environment:
      - RABBITMQ_NODE_PORT=${TASK_QUEUE_PORT}
      - RABBITMQ_DEFAULT_USER_FILE=/run/secrets/task_queue_username
      - RABBITMQ_DEFAULT_PASS_FILE=/run/secrets/task_queue_password
    secrets:
      - task_queue_username
      - task_queue_password
    volumes:
      - task_queue:/data/
    networks:
      renderable:
        aliases:
          - ${TASK_QUEUE_HOSTNAME}
    restart: unless-stopped
  resource_queue:
    image: rabbitmq:3.8-management
    expose:
      - '${RESOURCE_QUEUE_PORT}'
    environment:
      - RABBITMQ_NODE_PORT=${RESOURCE_QUEUE_PORT}
      - RABBITMQ_DEFAULT_USER_FILE=/run/secrets/resource_queue_username
      - RABBITMQ_DEFAULT_PASS_FILE=/run/secrets/resource_queue_password
    secrets:
      - resource_queue_username
      - resource_queue_password
    volumes:
      - resource_queue:/data/
    networks:
      renderable:
        aliases:
          - ${RESOURCE_QUEUE_HOSTNAME}
    restart: unless-stopped
  state_queue:
    image: rabbitmq:3.8-management
    expose:
      - '${STATE_QUEUE_PORT}'
    environment:
      - RABBITMQ_NODE_PORT=${STATE_QUEUE_PORT}
      - RABBITMQ_DEFAULT_USER_FILE=/run/secrets/state_queue_username
      - RABBITMQ_DEFAULT_PASS_FILE=/run/secrets/state_queue_password
    secrets:
      - state_queue_username
      - state_queue_password
    volumes:
      - state_queue:/data/
    networks:
      renderable:
        aliases:
          - ${STATE_QUEUE_HOSTNAME}
    restart: unless-stopped

secrets:
  api_access_key:
    file: secrets/api_access_key
  registry_username:
    file: secrets/registry_username
  registry_password:
    file: secrets/registry_password
  registry_encrypted_password:
    file: secrets/registry_encrypted_password
  registry_secret_key:
    file: secrets/registry_secret_key
  console_encrypted_password:
    file: secrets/console_encrypted_password
  cache_password:
    file: secrets/cache_password
  database_username:
    file: secrets/database_username
  database_password:
    file: secrets/database_password
  storage_access_key:
    file: secrets/storage_access_key
  storage_secret_key:
    file: secrets/storage_secret_key
  container_queue_username:
    file: secrets/container_queue_username
  container_queue_password:
    file: secrets/container_queue_password
  task_queue_username:
    file: secrets/task_queue_username
  task_queue_password:
    file: secrets/task_queue_password
  resource_queue_username:
    file: secrets/resource_queue_username
  resource_queue_password:
    file: secrets/resource_queue_password
  state_queue_username:
    file: secrets/state_queue_username
  state_queue_password:
    file: secrets/state_queue_password

volumes:
  cluster:
  cluster_certificate:
  registry:
  console:
  cache:
  database:
  storage:
  container_queue:
  task_queue:
  resource_queue:
  state_queue:

networks:
  renderable: