docker-compose.yml

# Some people have reported problems with the balrogui API proxy not working correctly.
# This appears to be the same problem reported in https://github.com/docker/compose/issues/2172,
# and seems to only occur with certain (older) versions of docker-compose.
version: '2.1'
services:
  balrogadmin:
    build:
      context: .
      dockerfile: Dockerfile.test
      args:
        PYTHON_VERSION: 3.11
    depends_on:
      balrogdb:
        condition: service_healthy
    entrypoint:
      - bash
      - scripts/initdb_and_run.sh
    command: admin
    expose:
      - "7070"
    volumes:
      - .:/app
    links:
      - balrogdb
    environment:
      - DBURI=mysql://balrogadmin:balrogadmin@balrogdb/balrog
      - DB_HOST=balrogdb
      - SECRET_KEY=blahblah
      - PORT=7070
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
      - INSECURE_SESSION_COOKIE=1
      - LOCALDEV=1
      - AUTH0_CLIENT_ID=GlZhJQfx52b7MLQ19AjuTJHieiB4oh1j
      - AUTH0_REDIRECT_URI=https://localhost:8010/login
      - AUTH0_DOMAIN=balrog-localdev.auth0.com
      - AUTH0_AUDIENCE=balrog-localdev
      - AUTH0_RESPONSE_TYPE=token id_token
      - AUTH0_SCOPE=full-user-credentials openid profile email
      # By default, we disable writes to releases history for local development
      # and read existing history from the production bucket.
      # If you want to test release history writes, you need to set up your own
      # bucket, change these variables, and provide credentials in google.json.
      - RELEASES_HISTORY_BUCKET=balrog-prod-release-history-v1
      - NIGHTLY_HISTORY_BUCKET=balrog-prod-nightly-history-v1
      - GOOGLE_APPLICATION_CREDENTIALS=google.json
      - CORS_ORIGINS=*
      - STAGING
      - LOCAL_ADMIN
    healthcheck:
        test: nc -z -v balrogadmin 7070
        interval: 5s
        timeout: 30s
        retries: 50
    ulimits:
      nofile:
        soft: 4096
        hard: 4096


  balrogpub:
    build:
      context: .
      dockerfile: Dockerfile.test
      args:
        PYTHON_VERSION: 3.11
    depends_on:
      balrogdb:
        condition: service_healthy
    command: public
    ports:
      - "9010:9010"
    volumes:
      - .:/app
    environment:
      - DBURI=mysql://balrogadmin:balrogadmin@balrogdb/balrog
      - AUTOGRAPH_URL=http://autograph:8000
      - AUTOGRAPH_KEYID=normandy
      - AUTOGRAPH_KEYID_LEGACY=remote-settings
      - AUTOGRAPH_USERNAME=alice
      - AUTOGRAPH_PASSWORD=fs5wgcer9qj819kfptdlp8gm227ewxnzvsuj9ztycsx08hfhzu
      - SECRET_KEY=blahblah
      - PORT=9010
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
    links:
      - autograph
      - balrogdb
    ulimits:
      nofile:
        soft: 4096
        hard: 4096


  balrogagent:
    build:
      context: ./agent
      args:
        PYTHON_VERSION: 3.11
    depends_on:
      nginx:
        condition: service_healthy
    volumes:
      - ./agent:/app
    links:
      - nginx
    environment:
      - BALROG_API_ROOT=http://nginx:8011/api
      - BALROG_USERNAME=balrogagent
      - BALROG_PASSWORD=na
      - TELEMETRY_API_ROOT=abc
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
      - AUTH0_DOMAIN=balrog-localdev.auth0.com
      - AUTH0_AUDIENCE=balrog-localdev
      # Not a real secret. This machine-to-machine clientId is in its own
      # Auth0 account, and has access to nothing except the Balrog
      # local development API.
      - AUTH0_M2M_CLIENT_ID=41U6XJQdSa6CL8oGa6CXvO4aZWlnq5xg
      - AUTH0_M2M_CLIENT_SECRET=updk4Gi1f6ncXDCDBH5ZclbsbIUaZmqvEXYCQLCFI56RnWlnTQXCQe6-h9n86QTv


  balrogui:
    build: ./ui
    depends_on:
      balrogadmin:
        condition: service_healthy
    ports:
      - "9000:9000"
    environment:
      - BALROG_ROOT_URL=https://localhost:8010
      - HOST=0.0.0.0
      - PORT=9000
    volumes:
      - ./ui:/app
      - node_modules:/app/node_modules
    entrypoint:
      - /bin/bash
      - --login
      - -c
      - yarn install && yarn start


  nginx:
    build:
      context: .
      dockerfile: Dockerfile.nginx
    ports:
      - "8010:8010"
      - "8011:8011"
    links:
      - balrogadmin
    volumes:
      - ./scripts/nginx.conf:/etc/nginx/conf.d/http_balrog.conf.template
      - ./scripts/server.crt:/etc/nginx/server.crt
      - ./scripts/server.key:/etc/nginx/server.key
      - ./scripts/dhparam.pem:/etc/nginx/dhparam.pem
    environment:
      - NGINX_PORT=8010
      - NGINX_BALROG_AGENT_PORT=8011
      - BALROG_ADMIN_ROOT=http://balrogadmin:7070
    command: /bin/bash -c "envsubst '$$NGINX_PORT $$NGINX_BALROG_AGENT_PORT $$BALROG_ADMIN_ROOT' < /etc/nginx/conf.d/http_balrog.conf.template > /etc/nginx/conf.d/http_balrog.conf && nginx -g 'daemon off;'"
    healthcheck:
        test: nc -z -v nginx 8010 && nc -z -v nginx 8011
        interval: 5s
        timeout: 30s
        retries: 50


  balrogdb:
    build:
      context: .
      dockerfile: Dockerfile.database
    expose:
      - "3306"
    ports:
      - "3306:3306"
    environment:
      - MYSQL_DATABASE=balrog
      - MYSQL_USER=balrogadmin
      - MYSQL_PASSWORD=balrogadmin
      - MYSQL_ROOT_PASSWORD=admin
    volumes:
      - mysqldb:/var/lib/mysql
    logging:
      driver: none
    healthcheck:
        test: nc -z -v balrogdb 3306
        interval: 30s
        timeout: 30s
        retries: 10

  # TODO: provide our own config so that we can guarantee the keyid
  autograph:
    image: mozilla/autograph:latest
    expose:
      - "8000"
    ports:
      - "8000:8000"
    volumes:
      - autographtmp:/tmp/
    logging:
      driver: none
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/__heartbeat__"]
      interval: 60s
      timeout: 10s
      retries: 3

volumes:
  node_modules:
  autographtmp:
  mysqldb: