docker-compose.yml

version: '3.9'

volumes:
  simple:
  packages:
  sponsorlogos:
  policies:
  vault:
  caches:

services:
  vault:
    # NOTE: intentionally an older version, for consistency with cabotage
    image: vault:1.3.4
    restart: on-failure
    entrypoint: /bin/sh
    command: ["/etc/vault/entry.sh"]
    environment:
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
      VAULT_DEV_ROOT_TOKEN_ID: "an insecure vault access token"
    ports:
      - "8200:8200"
    cap_add:
      - IPC_LOCK
    volumes:
      - vault:/vault/file
      - ./dev/vault:/etc/vault

  db:
    image: postgres:14.4
    ports:
      # 5432 may already in use by another PostgreSQL on host
      - "5433:5432"
    environment:
      POSTGRES_HOST_AUTH_METHOD: trust  # never do this in production!
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "postgres", "-d", "postgres"]
      interval: 1s

  stripe:
    image: stripe/stripe-mock:v0.140.0
    ports:
      - "12111:12111"

  redis:
    image: redis:4.0

  localstack:
    image: localstack/localstack:0.12.19.1
    environment:
      SERVICES: "sqs"
      HOSTNAME: "localstack"
      HOSTNAME_EXTERNAL: "localstack"
      DEFAULT_REGION: "us-east-2"
    ports:
      - "4566:4566"

  elasticsearch:
    image: elasticsearch:7.10.1
    environment:
      - xpack.security.enabled=false
      - discovery.type=single-node
    ulimits:
      nofile:
        soft: 65536
        hard: 65536

  camo:
    image: pypa/warehouse-camo:latest
    ports:
      - "9000:9000"
    environment:
      CAMO_KEY: "insecurecamokey"
      PORT: 9000

  web:
    build:
      context: .
      args:
        DEVEL: "yes"
        IPYTHON: "no"
    command: gunicorn --reload -b 0.0.0.0:8000 warehouse.wsgi:application
    env_file: dev/environment
    volumes:
      # We specify all of these directories instead of just . because we want to
      # avoid having ./node_modules from the host OS being shared with the docker
      # container, and since there's no way to exclude a directory, the only way
      # to make this work is to share multiple, smaller directories. These cover
      # the important things that we want to share, but changes to requirements
      # or any file not in these directories will require a rebuild.
      # The :z option fixes permission issues with SELinux by setting a
      # permissive security context.
      - ./dev:/opt/warehouse/src/dev:z
      - ./docs:/opt/warehouse/src/docs:z
      - ./warehouse:/opt/warehouse/src/warehouse:z
      - ./tests:/opt/warehouse/src/tests:z
      - ./htmlcov:/opt/warehouse/src/htmlcov:z
      - .coveragerc:/opt/warehouse/src/.coveragerc:z
      - packages:/var/opt/warehouse/packages
      - sponsorlogos:/var/opt/warehouse/sponsorlogos
      - policies:/var/opt/warehouse/policies
      - simple:/var/opt/warehouse/simple
      - ./bin:/opt/warehouse/src/bin:z
      - ./requirements:/opt/warehouse/src/requirements:z
      - caches:/root/.cache
      - caches:/opt/warehouse/src/.mypy_cache
      - caches:/opt/warehouse/src/.pytest_cache
    ports:
      - "${WEB_PORT:-80}:8000"
    depends_on:
      db:
        condition: service_healthy
      elasticsearch:
        condition: service_started
      redis:
        condition: service_started
      stripe:
        condition: service_started

  files:
    build:
      context: .
    working_dir: /var/opt/warehouse
    command: python -m http.server 9001
    volumes:
      - packages:/var/opt/warehouse/packages
      - sponsorlogos:/var/opt/warehouse/sponsorlogos
      - simple:/var/opt/warehouse/simple
    ports:
      - "9001:9001"

  worker:
    build:
      context: .
      args:
        DEVEL: "yes"
    command: hupper -m celery -A warehouse worker -B -S redbeat.RedBeatScheduler -l info
    volumes:
      - ./warehouse:/opt/warehouse/src/warehouse:z
    env_file: dev/environment
    environment:
      C_FORCE_ROOT: "1"
      FILES_BACKEND: "warehouse.packaging.services.LocalFileStorage path=/var/opt/warehouse/packages/ url=http://files:9001/packages/{path}"
      SIMPLE_BACKEND: "warehouse.packaging.services.LocalSimpleStorage path=/var/opt/warehouse/simple/ url=http://files:9001/simple/{path}"

  static:
    build:
      context: .
      target: static-deps
    environment:
      NODE_ENV: "development"
    command: bash -c "npm run watch"
    volumes:
      - ./warehouse:/opt/warehouse/src/warehouse:z
      - ./webpack.config.js:/opt/warehouse/src/webpack.config.js:z
      - ./.babelrc:/opt/warehouse/src/.babelrc:z
      - ./.stylelintrc.json:/opt/warehouse/src/.stylelintrc.json:z
      - ./tests/frontend:/opt/warehouse/src/tests/frontend:z
      - ./bin:/opt/warehouse/src/bin:z
      - caches:/opt/warehouse/src/.stylelintcache

  maildev:
    image: maildev/maildev:2.0.2
    ports:
      - "1080:1080"
      - "1025:1025"

  notdatadog:
    build:
      context: .
      args:
        DEVEL: "yes"
    command: python /opt/warehouse/dev/notdatadog.py 0.0.0.0:8125
    environment:
      METRICS_OUTPUT: "false"
    ports:
      - "8125:8125/udp"
    volumes:
      - ./dev/notdatadog.py:/opt/warehouse/dev/notdatadog.py

  notgithub:
    image: ewjoachim/notgithub-token-scanning
    environment:
      NOTGITHUB_DEFAULT_URL: "http://web:8000/_/github/disclose-token"
    ports:
      - "8964:8000"