docker-stack.yml

# Docker compose file to start a full ESGF node as a distributed stack

# Required env variables:
#
# ESGF_CONFIG : points to the root ESGF configuration directory
#       example: export ESGF_CONFIG=/Users/cinquini/ESGF_CONFIG
# ESGF_HOSTNAME: HostName or IP address for apache httpd front-end server
#       example: export ESGF_HOSTNAME=my-node.esgf.org
#       example: export ESGF_HOSTNAME=`docker-machine ip`
#
# Optional env variables:
# ESGF_VERSION: version of ESGF/Docker distribution
#       example: export ESGF_VERSION=latest
# ESGF_IMAGES_HUB: the repository of the esgf components images
#       example: export ESGF_IMAGES_HUB=esgfhub
#
# Services deployment:
# - front_node: httpd daemon, cog, and visualizer
# - db_node: postgres
# - index_node: esgf-search web application runnning within Tomcat
# - idp_node: esgf-idp web application running within Tomcat
# - data_node: TDS and esg-orp applications running within Tomcat
# - solr_node: Solr search engine running within Jetty

version: '3.3'

networks:
  # network to keep postgres database isolated
  dbnetwork:

configs:
          #################### HTTPD CONFIGS ##################
  httpd_esgf-httpd_conf:
    file: $ESGF_CONFIG/httpd/conf/esgf-httpd.conf
          ##################### SOLR CONFIGS ##################
  solr_esgf_shards_static_xml:
    file: $ESGF_CONFIG/esg/config/esgf_shards_static.xml
          #################### THREDDS CONFIGS ################
  thredds_web_xml:
    file: $ESGF_CONFIG/webapps/thredds/WEB-INF/web.xml
          ##################### NGINX CONFIGS #################
  nginx_nginx_conf:
    file: $ESGF_CONFIG/slcs/conf/nginx/nginx.conf

secrets:
          #################### HTTPD SECRETS ##################
  httpd_cachain_pem:
    file: $ESGF_CONFIG/httpd/certs/cachain.pem
  httpd_esgf-ca-bundle_crt:
    file: $ESGF_CONFIG/httpd/certs/esgf-ca-bundle.crt
  httpd_hostcert_pem:
    file: $ESGF_CONFIG/httpd/certs/hostcert.pem
  httpd_hostcert_pkcs12:
    file: $ESGF_CONFIG/httpd/certs/hostcert.pkcs12
  httpd_hostkey_pem:
    file: $ESGF_CONFIG/httpd/certs/hostkey.pem
          #################### TOMCAT SECRETS #################
  tomcat_esg-truststore_ts:
    file: $ESGF_CONFIG/esg/config/tomcat/esg-truststore.ts
          ##################### SLCS SECRETS ##################
  slcs_django_superuser_passwd_txt:
    file: $ESGF_CONFIG/slcs/conf/db/django_superuser_passwd.txt
  slcs_slcsdb_passwd_txt:
    file: $ESGF_CONFIG/slcs/conf/db/slcsdb_passwd.txt
  slcs_userdb_passwd_txt:
    file: $ESGF_CONFIG/slcs/conf/db/userdb_passwd.txt
  slcs_onlineca_crt:
    file: $ESGF_CONFIG/slcs/conf/ca/onlineca.crt
  slcs_onlineca_key:
    file: $ESGF_CONFIG/slcs/conf/ca/onlineca.key 
          ##################### GRID SECRETS ##################
  grid_certificates:
    file: $ESGF_CONFIG/archives/grid_security_certs.tar.xz
          ##################### ESGF SECRETS ##################
  esgf_config_files:
    file: $ESGF_CONFIG/archives/esgf_config.tar.xz


services:

  # ESGF postgres database
  esgf-postgres:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-postgres:${ESGF_VERSION-latest}
    ports:
      - "5432:5432"
    networks:
      - dbnetwork
    volumes:
      - pg_data:/var/lib/pgsql/data
    deploy:
      placement:
        constraints: [node.labels.esgf_db_node == true]

  # CoG
  # data container to hold CoG source code and python virtual environment
  esgf-cog:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-cog:${ESGF_VERSION-latest}
    ports:
      - "8000:8000"
    configs:
      - source: httpd_esgf-httpd_conf
        target: /etc/httpd/conf.d/esgf-httpd.conf
    secrets:
      - source: httpd_cachain_pem
        target: /etc/certs/cachain.pem
      - source: httpd_esgf-ca-bundle_crt
        target: /etc/certs/esgf-ca-bundle.crt
      - source: httpd_hostcert_pem
        target: /etc/certs/hostcert.pem
      - source: httpd_hostcert_pkcs12
        target: /etc/certs/hostcert.pkcs12
      - source: httpd_hostkey_pem
        target: /etc/certs/hostkey.pem
      - source: grid_certificates
        target: /root/archives/grid_security_certs.tar.xz
        mode:   0600
      - source: esgf_config_files
        target: /root/archives/esgf_config.tar.xz
        mode:   0600
    volumes:
      - cog_install_dir:/usr/local/cog/cog_install
      - cog_venv:/usr/local/cog/venv
      - cog_data:/usr/local/cog/cog_config
    #command: $ESGF_HOSTNAME true true # ESGF=true, keep django server runnining on port 8000
    command: $ESGF_HOSTNAME true false # ESGF=true, django server running on port 8000 = false
    depends_on:
      - esgf-postgres
    networks:
      - dbnetwork
    environment:
      - COG_DIR=/usr/local/cog
      - COG_INSTALL_DIR=/usr/local/cog/cog_install
      - COG_CONFIG_DIR=/usr/local/cog/cog_config
      - ESGF_HOSTNAME
      # flag to execute CoG initialization, defaults to true, may be overridden from shell environment before starting docker-compose
      - ${INIT:-true}
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.labels.esgf_front_node == true]


  esgf-solr:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-solr:${ESGF_VERSION-latest}
    ports:
      - "8983:8983"
      - "8984:8984"
    configs:
      - source: solr_esgf_shards_static_xml
        target: /esg/config/esgf_shards_static.xml
    volumes:
      - solr_data:/esg/solr-index
    networks:
      - default
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_solr_node == true]


  esgf-index-node:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-index-node:${ESGF_VERSION-latest}
    ports:
      - "8081:8080"
      - "8444:8443"
    depends_on:
      - esgf-solr
    secrets:
      - source: tomcat_esg-truststore_ts
        target: /usr/java/latest/jre/lib/security/jssecacerts
      - source: esgf_config_files
        target: /root/archives/esgf_config.tar.xz
        mode:   0600
    networks:
      - default
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_index_node == true]

  esgf-idp-node:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-idp-node:${ESGF_VERSION-latest}
    ports:
      - "8082:8080"
      - "8445:8443"
    networks:
      - default
      - dbnetwork
    secrets:
      - source: tomcat_esg-truststore_ts
        target: /usr/java/latest/jre/lib/security/jssecacerts
      - source: esgf_config_files
        target: /root/archives/esgf_config.tar.xz
        mode:   0600
    depends_on:
      - esgf-postgres
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_idp_node == true]

  esgf-orp:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-orp:${ESGF_VERSION-latest}
    ports:
      - "8083:8080"
      - "8446:8443"
    networks:
      - default
    secrets:
      - source: tomcat_esg-truststore_ts
        target: /usr/java/latest/jre/lib/security/jssecacerts
      - source: esgf_config_files
        target: /root/archives/esgf_config.tar.xz
        mode:   0600
    environment:
     - ESGF_HOSTNAME
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_data_node == true]

  esgf-tds:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-tds:${ESGF_VERSION-latest}
    ports:
      - "8084:8080"
      - "8447:8443"
    networks:
      - default
      - dbnetwork
    configs:
      - source: thredds_web_xml
        target: /usr/local/tomcat/webapps/thredds/WEB-INF/web.xml
    secrets:
      - source: tomcat_esg-truststore_ts
        target: /usr/java/latest/jre/lib/security/jssecacerts
      - source: esgf_config_files
        target: /root/archives/esgf_config.tar.xz
        mode:   0600
    volumes:
      - tds_data:/esg/content/thredds
      - $ESGF_DATA_DIR:/esg/data
    environment:
     - ESGF_HOSTNAME
    depends_on:
      - esgf-postgres
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_data_node == true]

  esgf-publisher:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-publisher:${ESGF_VERSION-latest}
    networks:
      - default
      - dbnetwork
    volumes:
      - tds_data:/esg/content/thredds
      - $ESGF_DATA_DIR:/esg/data
    secrets:
      - source: esgf_config_files
        target: /root/archives/esgf_config.tar.xz
        mode:   0600
    environment:
     - SSL_CERT_DIR=/etc/grid-security/certificates
     #- SSL_CERT_FILE=/etc/certs/esgf-ca-bundle.crt
     - ESGF_HOSTNAME
    depends_on:
      - esgf-postgres
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_data_node == true]

  esgf-dashboard:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-dashboard:${ESGF_VERSION-latest}
    networks:
      - default
      - dbnetwork
    secrets:
      - source: esgf_config_files
        target: /root/archives/esgf_config.tar.xz
        mode:   0600
    ports:
      - "8085:8080"
      - "8448:8443"
    depends_on:
      - esgf-postgres
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_data_node == true]

  # note: this service must run on the same host as the httpd front-end
  # so they can share data in the volume 'esgf_auth_install'
  esgf-auth:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-auth:${ESGF_VERSION-latest}
    volumes:
      - esgf_auth_install:/usr/local/esgf-auth
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_front_node == true]

  esgf-httpd:
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-httpd:${ESGF_VERSION-latest}
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    configs:
      - source: httpd_esgf-httpd_conf
        target: /etc/httpd/conf.d/esgf-httpd.conf
    secrets:
      - source: httpd_cachain_pem
        target: /etc/certs/cachain.pem
      - source: httpd_esgf-ca-bundle_crt
        target: /etc/certs/esgf-ca-bundle.crt
      - source: httpd_hostcert_pem
        target: /etc/certs/hostcert.pem
      - source: httpd_hostcert_pkcs12
        target: /etc/certs/hostcert.pkcs12
      - source: httpd_hostkey_pem
        target: /etc/certs/hostkey.pem
      - source: grid_certificates
        target: /root/archives/grid_security_certs.tar.xz
        mode:   0600
      - source: esgf_config_files
        target: /root/archives/esgf_config.tar.xz
        mode:   0600
    volumes:
      - cog_install_dir:/usr/local/cog/cog_install
      - cog_venv:/usr/local/cog/venv
      - cog_data:/usr/local/cog/cog_config
      - esgf_auth_install:/usr/local/esgf-auth
      # - esgf-node-manager
    environment:
      - SSL_CERT_DIR=/etc/grid-security/certificates
      - SSL_CERT_FILE=/etc/certs/esgf-ca-bundle.crt
      - COG_CONFIG_DIR=/usr/local/cog/cog_config
      - ESGF_HOSTNAME
    ports:
     - "80:80"
     - "443:443"
    depends_on:
     - esgf-cog
     - esgf-auth
    #  - esgf-node-manager
    # httpd URLs must use hostname=$ESGF_HOSTNAME
    networks:
      default:
        aliases:
          - "${ESGF_HOSTNAME}"
      dbnetwork: {}
    deploy:
      replicas: 1
      placement:
        constraints: [node.labels.esgf_front_node == true]

  esgf-slcs:
    command: ["-sn", "$ESGF_HOSTNAME", "-ds", "rootAdmin", "-sdn", "slcs", "-sdh", "slcs-postgres", "-sdu", "dbsuper", "-udn", "esgcet", "-udh", "esgf-postgres", "-udu", "dbsuper", "--static-url", "https://$ESGF_HOSTNAME/slcs-static/", "--url-prefix", "esgf-slcs", "--use-x-forwarded-host"]
    depends_on:
      - slcs-postgres
      - slcs-nginx
      - esgf-postgres
    image: ${ESGF_IMAGES_HUB-esgfhub}/esgf-slcs:${ESGF_VERSION-latest}
    networks:
      - default
      - dbnetwork
    ports:
      - "5000:5000"
    secrets:
      - source: slcs_django_superuser_passwd_txt
        target: /usr/local/esgf-slcs-server/conf/db/django_superuser_passwd.txt
      - source: slcs_slcsdb_passwd_txt
        target: /usr/local/esgf-slcs-server/conf/db/slcsdb_passwd.txt
      - source: slcs_userdb_passwd_txt
        target: /usr/local/esgf-slcs-server/conf/db/userdb_passwd.txt
      - source: slcs_onlineca_crt
        target: /usr/local/esgf-slcs-server/conf/ca/onlineca.crt
      - source: slcs_onlineca_key
        target: /usr/local/esgf-slcs-server/conf/ca/onlineca.key
    volumes:
      - "slcs_static_web:/var/www/static"
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.labels.esgf_idp_node == true]

  slcs-nginx:
    image: nginx
    networks:
      - default
      - dbnetwork
    configs:
      - source: nginx_nginx_conf
        target: /etc/nginx/conf.d/default.conf
    volumes:
      - "slcs_static_web:/usr/share/nginx/html"
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.labels.esgf_idp_node == true]

  slcs-postgres:
    environment:
      - POSTGRES_PASSWORD=changeit
      - POSTGRES_USER=dbsuper
      - POSTGRES_DB=slcs
      - POSTGRES_INITDB_ARGS=--encoding=UTF-8
    image: postgres
    networks:
      - default
      - dbnetwork
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.labels.esgf_idp_node == true]

  # useful visualizer container, not really needed
  visualizer:
    image: dockersamples/visualizer:stable
    ports:
      - "8080:8080"
    stop_grace_period: 1m30s
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    deploy:
      placement:
        constraints: [node.role == manager]

# Use Docker volumes to store persistent data
# that needs to be shared across services
# (which must be co-located on the same node).
# When services are first started, 
# volumes are initialized with content from directory in container
volumes:
  # cog source directory
  cog_install_dir:
  # cog venv directory
  cog_venv:
  # cog site data
  cog_data:
  # postgres database
  pg_data:
  # solr indexes
  solr_data:
  # TDS catalogs
  tds_data:
  # SLCS web pages
  slcs_static_web:
  # esgf-auth installation directory, including python virtual environment and sqllite database
  esgf_auth_install: