docker-stack.yml

version: '3.2'

services:
  traefik:
    image: traefik:v3.6
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      - target: 8080
        published: 8080
        protocol: tcp
    networks:
      - traefik-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik:/etc/traefik
      - ./traefik/certs/fullchain.pem:/cert.pem
      - ./traefik/certs/privkey.pem:/key.pem
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"
      placement:
        constraints:
          - "node.role == manager"
    environment:
      - TRAEFIK_PROVIDERS_DOCKER_DEFAULTRULE="Host(`\{\{ trimPrefix `/` .Name \}\}.${domain}`)"
    command:
      - "--accesslog=true"
      - "--accesslog.format=json"
      - "--accesslog.filepath=/dev/stdout"

  projects:
    image: node:22-bookworm
    networks:
      - traefik-net
    volumes:
      - ${src_aimdl_projects:-./src/aimdl-projects}:/srv
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.projects.rule=Host(`projects.${domain}`)"
        - "traefik.http.routers.projects.entrypoints=websecure"
        - "traefik.http.routers.projects.tls=true"
        - "traefik.http.services.projects.loadbalancer.server.port=5173"
        - "traefik.http.services.projects.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"
    working_dir: /srv
    extra_hosts:
      - "girder.${domain}:host-gateway"
    command:
      - "npm"
      - "run"
      - "dev"
      - "--host"

  mongo:
    image: mongo:4.4
    networks:
      - mongo
    volumes:
      - mongo-data:/data/db
      - mongo-cfg:/data/configdb
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  local_worker:
    image: xarthisius/girder:5-dev
    networks:
      - celery
      - mongo
    volumes:
      - ./volumes:/srv/data
      - ${src_girder_virtual_resources:-./src/girder-virtual-resources}:/girder-plugins/01-girder-virtual-resources
      - ${src_girder_wholetale:-./src/girder-wholetale}:/girder-plugins/02-girder-wholetale
      - ${src_girder_sem_viewer:-./src/girder-sem-viewer}:/girder-plugins/03-girder-sem-viewer
      - ${src_girder_sample_tracker:-./src/girder-sample-tracker}:/girder-plugins/04-girder-sample-tracker
      - ${src_girder_jsonforms:-./src/girder-jsonforms}:/girder-plugins/05-girder-jsonforms
      - ${src_girder_dashboards:-./src/girder-dashboards}:/girder-plugins/06-girder-dashboards
      - ${src_girder_dashboards_precipitate:-./src/girder-dashboards-precipitate}:/girder-plugins/07-girder-dashboards-precipitate
      - ${src_gwvolman:-./src/gwvolman}:/gwvolman
      - ${src_girderfs:-./src/girderfs}:/girderfs
      - /tmp:/tmp
    environment:
      - DOMAIN=${domain}
      - GIRDER_MONGO_URI=mongodb://mongo:27017/girder
      - GIRDER_HOST=0.0.0.0
      - GIRDER_WORKER_BROKER=redis://redis/
      - GIRDER_WORKER_BACKEND=redis://redis/
      - GIRDER_NOTIFICATION_REDIS_URL=redis://redis:6379/
      - GOSU_USER=1001:1001:${docker_group}
      - GIRDER_LOCAL_FONTELLO_ARCHIVE=/girder/clients/web/static/built/fontello.zip
      - HOSTDIR=/
    extra_hosts:
      - "girder.${domain}:host-gateway" # for the local queue
      - "images.${domain}:host-gateway"
      - "minio.${domain}:host-gateway"
    working_dir: /girder-plugins   # for reload
    entrypoint: ["/usr/bin/tini", "--", "/docker-entrypoint-worker.sh"]
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"

  girder:
    image: xarthisius/girder:5-dev
    networks:
      - traefik-net
      - celery
      - mongo
    volumes:
      - ./volumes/base:/srv/data/base
      - ./volumes/base:/volumes/base
      - ./volumes/ps:/srv/data/ps
      - ./volumes/runs:/srv/data/runs
      - ./volumes/versions:/srv/data/versions
      - ./volumes/homes:/srv/data/homes
      - ./volumes/workspaces:/srv/data/workspaces
      - ${src_girder_virtual_resources:-./src/girder-virtual-resources}:/girder-plugins/01-girder-virtual-resources
      - ${src_girder_wholetale:-./src/girder-wholetale}:/girder-plugins/02-girder-wholetale
      - ${src_girder_sem_viewer:-./src/girder-sem-viewer}:/girder-plugins/03-girder-sem-viewer
      - ${src_girder_sample_tracker:-./src/girder-sample-tracker}:/girder-plugins/04-girder-sample-tracker
      - ${src_girder_jsonforms:-./src/girder-jsonforms}:/girder-plugins/05-girder-jsonforms
      - ${src_girder_dashboards:-./src/girder-dashboards}:/girder-plugins/06-girder-dashboards
      - ${src_girder_dashboards_precipitate:-./src/girder-dashboards-precipitate}:/girder-plugins/07-girder-dashboards-precipitate
      - ${src_gwvolman:-./src/gwvolman}:/gwvolman
      - ${src_girderfs:-./src/girderfs}:/girderfs
      - /var/run/docker.sock:/var/run/docker.sock
      - /tmp:/tmp
    environment:
      - APP=girder_jsonforms.asgi:create_app()
      - DOMAIN=${domain}
      - DASHBOARD_URL=https://dashboard.${domain}
      - GIRDER_MONGO_URI=mongodb://mongo:27017/girder
      - GIRDER_HOST=0.0.0.0
      - GIRDER_WORKER_BROKER=redis://redis/
      - GIRDER_WORKER_BACKEND=redis://redis/
      - GIRDER_NOTIFICATION_REDIS_URL=redis://redis:6379/
      - GOSU_USER=1001:1001:${docker_group}
      - GOSU_CHOWN=/srv/data
      - DATAONE_URL=https://cn-stage-2.test.dataone.org/cn
      - GIRDER_LOCAL_FONTELLO_ARCHIVE=/girder/clients/web/static/built/fontello.zip
      - HOSTDIR=/
      - WATCHFILES_FORCE_POLLING=true
    working_dir: /girder-plugins   # for reload
    extra_hosts:
      - "girder.${domain}:host-gateway" # for the local queue
      - "images.${domain}:host-gateway"
      - "minio.${domain}:host-gateway"
      - "influxdb.${domain}:host-gateway"
    # entrypoint: ["/bin/sleep", "infinity"]
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.girder.rule=Host(`girder.${domain}`)"
        - "traefik.http.routers.girder.entrypoints=websecure"
        - "traefik.http.routers.girder.tls=true"
        - "traefik.http.routers.girder.tls.certresolver=default"
        - "traefik.http.routers.girder.tls.domains[0].main=${domain}"
        - "traefik.http.routers.girder.tls.domains[0].sans=*.${domain}"
        - "traefik.http.services.girder.loadbalancer.server.port=8080"
        - "traefik.http.services.girder.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"
        - "traefik.http.middlewares.girder.forwardauth.address=http://girder:8080/api/v1/user/authorize/"
        - "traefik.http.middlewares.girder.forwardauth.trustforwardheader=true"

  # Centralized IGSN registry: allocates sample identifiers and publishes them
  # to DataCite on behalf of every Girder instance and any external project.
  #
  # Girder reaches it in-cluster as http://igsn:8000 (both are on traefik-net),
  # so plugin traffic never leaves the overlay; the traefik router exists for the
  # public resolver at igsn.${domain}, which is what published DOIs point at.
  # The `mongo` network is only for its own database (`igsn` on the shared server).
  #
  # Dev setup mirrors `projects`: the sibling checkout is bind-mounted and the
  # app runs with --reload, so host edits take effect. Production should run the
  # image built from the repo's own Dockerfile rather than pip-installing on
  # every start.
  #igsn:
  #  image: python:3.12-slim
  #  networks:
  #    - traefik-net
  #    - mongo
  #  volumes:
  #    - /home/xarth/codes/wholetale-ng/igsn-service:/app
  #  working_dir: /app
  #  environment:
  #    - IGSN_MONGO_URI=mongodb://mongo:27017
  #    - IGSN_MONGO_DB=igsn
  #    - IGSN_PUBLIC_URL=https://igsn.${domain}
  #    - IGSN_ADMIN_TOKEN=${igsn_admin_token}
  #    - IGSN_LOG_LEVEL=INFO
  #    # One env var per tenant, named by that tenant's `datacite.password_env`.
  #    # DataCite passwords are deliberately not stored in Mongo.
  #    - DATACITE_PW_HTMDEC=${datacite_pw_htmdec}
  #    - DATACITE_PW_TEST=${datacite_pw_test}
  #  command:
  #    - "sh"
  #    - "-c"
  #    - "pip install --quiet -e '.[backfill]' && exec uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload"
  #  deploy:
  #    replicas: 0
  #    labels:
  #      - "traefik.enable=true"
  #      - "traefik.http.routers.igsn.rule=Host(`igsn.${domain}`)"
  #      - "traefik.http.routers.igsn.entrypoints=websecure"
  #      - "traefik.http.routers.igsn.tls=true"
  #      - "traefik.http.routers.igsn.tls.certresolver=default"
  #      - "traefik.http.services.igsn.loadbalancer.server.port=8000"
  #      - "traefik.http.services.igsn.loadbalancer.passhostheader=true"
  #      - "traefik.docker.network=wt_traefik-net"

  logger:
    image: xarthisius/wt-instance-logger:latest
    networks:
      - celery
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  redis:
    image: redis:7-bullseye
    networks:
      - celery
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=false"

  dashboard:
    image: wholetale/ngx-dashboard:latest 
    networks:
      - traefik-net
    volumes:
      - ${src_dashboard_dist:-./src/ngx-dashboard/dist/browser}:/usr/share/nginx/html/
    environment:
      - GIRDER_API_URL=https://girder.${domain}/api/v1
      - AUTH_PROVIDER=Globus
      - DATAONE_URL=https://cn.dataone.org/cn/v2
      - RTD_URL=https://wholetale.readthedocs.io/en/latest
      - DASHBOARD_DEV=true
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.dashboard.rule=Host(`dashboard.${domain}`)"
        - "traefik.http.routers.dashboard.entrypoints=websecure"
        - "traefik.http.routers.dashboard.tls=true"
        - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
        - "traefik.http.services.dashboard.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"

  instance-errors:
    image: xarthisius/wt-custom-errors:latest
    networks:
      - traefik-net
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.instance-errors.rule=HostRegexp(`{host:tmp-.*}`)"
        - "traefik.http.routers.instance-errors.entrypoints=websecure"
        - "traefik.http.routers.instance-errors.tls=true"
        - "traefik.http.routers.instance-errors.priority=1"
        - "traefik.http.routers.instance-errors.middlewares=error-pages-middleware"
        - "traefik.http.middlewares.error-pages-middleware.errors.status=400-599"
        - "traefik.http.middlewares.error-pages-middleware.errors.service=instance-errors"
        - "traefik.http.middlewares.error-pages-middleware.errors.query=/{status}.html"
        - "traefik.http.services.instance-errors.loadbalancer.server.port=80"
        - "traefik.docker.network=wt_traefik-net"

  registry:
    image: registry:2.8
    networks:
      - traefik-net
    volumes:
      - ./registry:/var/lib/registry
      - ./registry/auth:/auth:ro
    environment:
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm"
      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/registry.password
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.registry.rule=Host(`registry.${domain}`)"
        - "traefik.http.routers.registry.entrypoints=websecure"
        - "traefik.http.routers.registry.tls=true"
        - "traefik.http.services.registry.loadbalancer.server.port=5000"
        - "traefik.http.services.registry.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"

  images:
    image: registry:2.8
    networks:
      - traefik-net
    volumes:
      - ./registry:/var/lib/registry:ro
    deploy:
      replicas: 0
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.images.rule=Host(`images.${domain}`)"
        - "traefik.http.routers.images.rule=Method(`GET`)"
        - "traefik.http.routers.images.entrypoints=websecure"
        - "traefik.http.routers.images.tls=true"
        - "traefik.http.services.images.loadbalancer.server.port=5000"
        - "traefik.http.services.images.loadbalancer.passhostheader=true"
        - "traefik.docker.network=wt_traefik-net"

  celery_worker:
    image: xarthisius/gwvolman:latest
    networks:
      - celery
    labels:
      - "traefik.enable=false"
    environment:
      - GOSU_USER=ubuntu:1000:${docker_group}
      - DOMAIN=${domain}
      - DEV=true
      - REPO2DOCKER_VERSION=${r2d_version}
      - GIRDERFS_IMAGE=${girderfs_image}
      - TRAEFIK_NETWORK=wt_traefik-net
      - TRAEFIK_ENTRYPOINT=websecure
      - REGISTRY_USER=${registry_user}
      - REGISTRY_URL=https://registry.${domain}
      - REGISTRY_PASS=${registry_pass}
      - WT_LICENSE_PATH=${PWD}/volumes/licenses
      - WT_VOLUMES_PATH=${PWD}/volumes
      - MATLAB_FILE_INSTALLATION_KEY=${matlab_file_installation_key}
      - SWARM_NODE_ID={{.Node.ID}}
        # - BUILDER_URL=https://builder.${domain}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./volumes/tmp:/var/tmp
      - ./volumes/tmp:/tmp
      - ${src_gwvolman:-./src/gwvolman}:/gwvolman
      - ${src_girderfs:-./src/girderfs}:/girderfs
      - type: bind
        source: ${PWD}/volumes
        target: ${PWD}/volumes
        bind:
          propagation: rshared
    extra_hosts:
      - "registry.${domain}:host-gateway"
      - "images.${domain}:host-gateway"
      - "girder.${domain}:host-gateway"
      - "builder.${domain}:host-gateway"
    deploy:
      mode: global
      labels:
        - "traefik.enable=true"
    command: -c 3

networks:
  traefik-net:
    driver: overlay
  mongo:
    driver: overlay
  celery:
    driver: overlay
    attachable: true

volumes:
  mongo-data: {}
  mongo-cfg: {}