docker-compose.yml

version: "3.9"

services:
  # Load balancer
  lb:
    platform: linux/amd64
    image: nginx:1.23.3
    # Reload to pick up new certificates
    command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'''
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
    ports:
      - 80:80
      - 443:443
    networks:
      - public
    depends_on:
      - api
      - web

  # UI / Static rendering
  web:
    platform: linux/amd64
    build:
      context: web
      labels:
        - "edu.stanford.bln.usps.service=web"
    image: uspsweb:latest
    restart: always
    networks:
      - public
    expose:
      - 3000
    ports:
      - 3000:3000
    secrets:
      - source: node_env
        target: /code/.env
        mode: 0400
    depends_on:
      - api

  # API service
  api:
    platform: linux/amd64
    build:
      context: api
      labels:
        - "edu.stanford.bln.usps.service=api"
    image: uspsapi:latest
    restart: always
    networks:
      - private
      - public
    expose:
      - 8080
    ports:
      - 8080:8080
    secrets:
      - source: db_pass
        target: /run/secrets/db_pass
        mode: 0400
      - source: db_user
        target: /run/secrets/db_user
        mode: 0400
      - source: db_host
        target: /run/secrets/db_host
        mode: 0400
      - source: db_name
        target: /run/secrets/db_name
      - source: sentry_dsn
        target: /run/secrets/sentry_dsn
        mode: 0400
    depends_on:
      - db

  # PostGIS controller node. Contains scripts and other tools for ingesting
  # TIGER and address data.
  ctl:
    platform: linux/amd64
    build:
      context: ctl
      labels:
        - "edu.stanford.bln.usps.service=ctl"
    image: uspsctl:latest
    restart: always
    networks:
      - private
    # Volume to contain TIGER data.
    # This should use a persistent volume, since TIGER data can take a long
    # time to download and install.
    volumes:
      - type: bind
        source: ./data/gis
        target: /gisdata
      - type: bind
        source: ./data/addr
        target: /addrdata
    secrets:
      - source: db_pass
        target: /run/secrets/db_pass
        mode: 0400
      - source: db_user
        target: /run/secrets/db_user
        mode: 0400
      - source: db_host
        target: /run/secrets/db_host
        mode: 0400
      - source: db_name
        target: /run/secrets/db_name
    depends_on:
      - db

  # PostGIS database.
  db:
    platform: linux/amd64
    image: postgis/postgis:14-3.3
    shm_size: 1g
    restart: always
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./postgresql.conf:/etc/postgresql/postgresql.conf
    environment:
      - POSTGRES_DB_FILE=/run/secrets/db_name
      - POSTGRES_USER_FILE=/run/secrets/db_user
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_pass
    secrets:
      - db_name
      - db_user
      - db_pass
    expose:
      - 5432
    ports:
      - 5432:5432
    networks:
      - private
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U postgres -d $$(cat /run/secrets/db_name | tr -d '\n')",
        ]
      interval: 2s
      timeout: 2s
      retries: 20
    deploy:
      # NOTE: Postgres is not set up for replication in this compose file.
      # You will have problems if you try to scale this db service.
      replicas: 1
      placement:
        max_replicas_per_node: 1

volumes:
  # Volume to contain postgres data.
  # This is an ephemeral volume in dev.
  pgdata:
    driver_opts: {}
  # Volumes for certificates.
  # These are not used on dev and are ephemeral.
  certconf:
    driver_opts: {}
  certwww:
    driver_opts: {}

secrets:
  # The following secrets are for development only. Override them in production
  # to deploy real, secure secrets.
  db_pass:
    file: ./secrets/db_pass.dev
  db_host:
    file: ./secrets/db_host.dev
  db_user:
    file: ./secrets/db_user.dev
  db_name:
    file: ./secrets/db_name.dev
  node_env:
    file: ./secrets/node_env.dev
  sentry_dsn:
    file: ./secrets/sentry_dsn.dev

networks:
  private:
  public: