docker-compose.yml

version: "3.7"

services:
  catalog:
    user: $userID:$groupID
    image: matatika/catalog:28177
    ports:
      - "8080:8080"
      - "8443:8443"
    deploy:
      resources:
        reservations:
          memory: 1g
        limits:
          memory: 3g
    tty: true
    env_file: config/.env
    environment:
      # ==== CATALOG ====
      - ACTIVE_PROFILES=default,distribution
      - "JAVA_OPTS=-XX:MaxDirectMemorySize=1G -XX:MaxMetaspaceSize=240234K -XX:ReservedCodeCacheSize=240M -Xss1M -Xms512m -Xmx1040584K"
      - SPRING_H2_CONSOLE_ENABLED=false
      - PERSISTENCE_CATALOG_URL=jdbc:postgresql://db:5432/warehouse
      - PERSISTENCE_CATALOG_USER=warehouse
      - PERSISTENCE_CATALOG_PASS=warehouse
      - PERSISTENCE_CATALOG_DRIVER_CLASS_NAME=org.postgresql.Driver
      - ELASTICSEARCH_HOST=search
      # Define OAUTH2_GOOGLE_CLIENT_ID and OAUTH2_GOOGLE_CLIENT_SECRET to enable Google OAuth plugin settings (see config/.env)
      # - OAUTH2_GOOGLE_CLIENT_ID=
      # - OAUTH2_GOOGLE_CLIENT_SECRET=
      # Define OPENAI_API_KEY to enable OpenAI question answering (see config/.env)
      # - OPENAI_API_KEY=
      - MATATIKA_WORKSPACES_HOME=/workspaces
      - MATATIKA_PLUGINS_HOME=/plugins,/plugins-staging,file:/local-plugins
      # HTTPS config - generate a keystore in config/certs
      # - SERVER_PORT=8443
      # - SERVER_SSL_ENABLED=true
      # - SERVER_SSL_KEY_STORE=/certs/keystore.p12
      # - SERVER_SSL_KEY_STORE_PASSWORD=password
      # - SERVER_SSL_KEY_STORE_TYPE=pkcs12
      # - SERVER_SSL_KEY_ALIAS=springboot
      # - SERVER_SSL_KEY_PASSWORD=  # leave commented out for no password

      # ==== APP ====
      - REACT_APP_ENV=distribution
      #- APP_SERVER_URI=
      #- APP_IDENTITY_CLIENT_ID=
      # Define APP_OAUTH_GOOGLE_CLIENT_ID to enable Google OAuth plugin settings
      # - APP_OAUTH_GOOGLE_CLIENT_ID=
    depends_on:
      search-setup:
        condition: service_completed_successfully
      search:
        condition: service_healthy
      db:
        condition: service_healthy
    healthcheck:
      test: curl -fs http://localhost:8080/actuator/health | grep '^\{"status":"UP"' > /dev/null
      interval: 10s
      timeout: 10s
      start_period: 120s
      retries: 5
    volumes:
      - certs:/certs
      - workspaces:/workspaces
      - plugins:/local-plugins

  search:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.3
    environment:
      - ES_HOME=/usr/share/elasticsearch
      - ELASTIC_PASSWORD=${MATATIKA_ES_ELASTIC_PASSWORD:-ChangeMe}
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - node.name=search
      - discovery.seed_hosts=
      - cluster.initial_master_nodes=search
      - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/certs/search/search.key
      - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/certs/search/search.crt
      - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/certs/ca/ca.crt
      - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/certs/search/search.key
      - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/certs/search/search.crt
      - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/certs/ca/ca.crt
    volumes:
      - ./orchestrate/matatika/elastic-search/config/elasticsearch-docker.yml:/usr/share/elasticsearch/config/elasticsearch.yml
      - es-certs:/usr/share/elasticsearch/config/certs
      - es-data:/usr/share/elasticsearch/data
    expose:
      - "9200"
    ports:
      - "9200:9200"
    healthcheck:
      test: curl -fs -u elastic:"$$ELASTIC_PASSWORD" --cacert config/certs/ca/ca.crt https://localhost:9200 > /dev/null
      interval: 10s
      timeout: 10s
      start_period: 60s
      retries: 5
    depends_on:
      search-createcerts:
        condition: service_completed_successfully

  # Short lived container that sets up elastic search
  search-setup:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.3
    environment:
      - ES_HOME=/usr/share/elasticsearch
      - ES_PATH_CONF=/usr/share/elasticsearch/config
      - MATATIKA_ES_BASE_URI=https://search:9200
      - MATATIKA_ES_ELASTIC_PASSWORD=${MATATIKA_ES_ELASTIC_PASSWORD:-ChangeMe}
    command: >
      bash -c '
        ls -al /usr/share/elasticsearch/config/certs
        . config/setup.sh
      '
    user: "0"
    working_dir: /usr/share/elasticsearch
    volumes:
      - ./orchestrate/matatika/elastic-search/config:/usr/share/elasticsearch/config/
      - es-certs:/usr/share/elasticsearch/config/certs
    depends_on:
      search:
        condition: service_healthy

  # Short lived container that creates the certificates
  search-createcerts:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.3
    environment:
      - ES_HOME=/usr/share/elasticsearch
    command: >
      bash -c '
        #!/bin/bash
        rm -fR /certs/*
        elasticsearch-certutil cert \
          --silent \
          --pem \
          --in config/instances.yml \
          -out /certs/bundle.zip;
        unzip /certs/bundle.zip -d /certs;
        # create CA for clients to verify certificates
        chown -R 1000:0 /certs
      '
    user: "0"
    working_dir: /usr/share/elasticsearch
    volumes:
      - ./orchestrate/matatika/elastic-search/config/instances-dev.yml:/usr/share/elasticsearch/config/instances.yml
      - es-certs:/certs

  db:
    image: postgres:11
    volumes:
      - matatika-catalog_postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: warehouse
      POSTGRES_PASSWORD: warehouse
      POSTGRES_USER: warehouse
    expose:
      - "5432"
    ports:
      - "5432:5432"
    healthcheck:
      test: pg_isready -U warehouse
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  matatika-catalog_postgres:
  es-data:
    driver: local
  es-certs:
  certs:
    driver: local
    driver_opts:
      type: none
      device: ${PWD}/config/certs
      o: bind
  workspaces:
    driver: local
    driver_opts:
      type: none
      device: ${PWD}/workspaces
      o: bind
  plugins:
    driver: local
    driver_opts:
      type: none
      device: ${PWD}/plugins
      o: bind

networks:
  default:
    name: matatika