--- # NOTE: based on https://github.com/suitenumerique/docs/pull/855/ and https://github.com/suitenumerique/docs/pull/583/ x-common-env: &common-env DJANGO_CONFIGURATION: Production DJANGO_ALLOWED_HOSTS: "*" # DJANGO_SECRET_KEY supplied via secrets DJANGO_SETTINGS_MODULE: impress.settings # DJANGO_SUPERUSER_PASSWORD supplied via secrets # Logging # Set to DEBUG level for dev only LOGGING_LEVEL_HANDLERS_CONSOLE: LOGGING_LEVEL_LOGGERS_ROOT: LOGGING_LEVEL_LOGGERS_APP: # Python PYTHONPATH: /app # Mail DJANGO_EMAIL_BRAND_NAME: DJANGO_EMAIL_HOST: DJANGO_EMAIL_LOGO_IMG: DJANGO_EMAIL_PORT: DJANGO_EMAIL_HOST_USER: # DJANGO_EMAIL_HOST_PASSWORD supplied via secret DJANGO_EMAIL_USE_SSL: DJANGO_EMAIL_USE_TLS: DJANGO_EMAIL_FROM: # Backend url IMPRESS_BASE_URL: "https://${DOMAIN}" # Media STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage AWS_S3_ENDPOINT_URL: http://minio:9000 # AWS_S3_ACCESS_KEY_ID supplied via secret (this is same MINIO_ROOT_USER) # AWS_S3_SECRET_ACCESS_KEY supplied via secret (this is same as MINIO_ROOT_PASSWORD) MEDIA_BASE_URL: https://${DOMAIN} AWS_STORAGE_BUCKET_NAME: docs-media-storage # OIDC - settings from .env, see .env.sample OIDC_OP_JWKS_ENDPOINT: OIDC_OP_AUTHORIZATION_ENDPOINT: OIDC_OP_TOKEN_ENDPOINT: OIDC_OP_USER_ENDPOINT: OIDC_RP_CLIENT_ID: # OIDC_RP_CLIENT_SECRET supplied via secrets OIDC_RP_SIGN_ALGO: OIDC_RP_SCOPES: LOGIN_REDIRECT_URL: LOGIN_REDIRECT_URL_FAILURE: LOGOUT_REDIRECT_URL: OIDC_REDIRECT_ALLOWED_HOSTS: OIDC_AUTH_REQUEST_EXTRA_PARAMS: # AI (Fixme: remove?) AI_FEATURE_ENABLED: "false" AI_BASE_URL: https://openaiendpoint.com AI_API_KEY: password AI_MODEL: llama # Collaboration COLLABORATION_API_URL: https://$DOMAIN/collaboration/api/ x-postgres-env: &postgres-env # Postgresql db container configuration POSTGRES_DB: docs POSTGRES_USER: docs POSTGRES_PASSWORD_FILE: /run/secrets/postgres_p # App database configuration DB_HOST: db DB_NAME: docs DB_USER: docs DB_PORT: 5432 # DB_PASSWORD supplied via secrets (this is same as POSTGRES_PASSWORD) x-yprovider-env: &yprovider-env COLLABORATION_LOGGING: "true" # Y_PROVIDER_API_KEY supplied via secrets COLLABORATION_API_URL: http://y-provider:4444/api/ COLLABORATION_SERVER_ORIGIN: https://${DOMAIN} # COLLABORATION_SERVER_SECRET supplied via secrets COLLABORATION_BACKEND_BASE_URL: https://${DOMAIN} COLLABORATION_WS_URL: wss://${DOMAIN}/collaboration/ws/ x-minio-env: &minio-env MINIO_ROOT_USER_FILE: /run/secrets/minio_ru MINIO_ROOT_PASSWORD_FILE: /run/secrets/minio_rp services: app: image: lasuite/impress-frontend:v4.0.0 networks: - backend deploy: labels: - "traefik.enable=false" - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}" - "coop-cloud.${STACK_NAME}.version=0.2.2+v3.4.2" # healthcheck: # test: ["CMD", "curl", "-f", "http://localhost:8080"] # interval: 15s # timeout: 30s # retries: 20 # start_period: 10s backend: image: lasuite/impress-backend:v4.0.0 networks: - backend environment: <<: [*common-env, *postgres-env, *yprovider-env] # healthcheck: # test: ["CMD", "/abra-entrypoint.sh", "python", "manage.py", "check"] # interval: 15s # timeout: 30s # retries: 20 # start_period: 10s # healthcheck: # test: ["CMD-SHELL", "/abra-entrypoint.sh", "/usr/local/bin/entrypoint", "python", "manage.py", "check"] # interval: 15s # timeout: 30s # retries: 20 # start_period: 10s command: ["gunicorn", "-c", "/usr/local/etc/gunicorn/impress.py", "impress.wsgi:application"] entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"] configs: - source: abra_entrypoint target: /abra-entrypoint.sh mode: 0555 secrets: - django_sk - django_sp - oidc_rpcs - collab_ss - minio_rp - minio_ru - postgres_p - y_api_key - email_pass celery: image: lasuite/impress-backend:v4.0.0 networks: - backend command: ["celery", "-A", "impress.celery_app", "worker", "-l", "INFO"] environment: <<: [*common-env, *postgres-env, *yprovider-env] entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"] configs: - source: abra_entrypoint target: /abra-entrypoint.sh mode: 0555 secrets: - django_sk - django_sp - oidc_rpcs - collab_ss - minio_rp - postgres_p - y_api_key - email_pass y-provider: image: lasuite/impress-y-provider:v3.4.2 networks: - backend environment: *yprovider-env entrypoint: > sh -c "export Y_PROVIDER_API_KEY=\"$$(cat /run/secrets/y_api_key)\" && exec /usr/local/bin/entrypoint \"$$@\"" -- command: ["yarn", "start"] # NOTE: healthcheck - `wget` is available in the container, but `wget http://localhost:4444` gives a 403 secrets: - y_api_key db: image: postgres:16 networks: - backend healthcheck: test: ["CMD", "pg_isready", "-q", "-U", "docs", "-d", "docs"] interval: 1s timeout: 2s retries: 300 environment: <<: *postgres-env PGDATA: var/lib/postgresql/data/pgdata volumes: - postgres:/var/lib/postgresql/data/pgdata deploy: labels: backupbot.backup: "${ENABLE_BACKUPS:-true}" backupbot.backup.pre-hook: "/pg_backup.sh backup" backupbot.backup.volumes.postgres.path: "backup.sql" backupbot.restore.post-hook: '/pg_backup.sh restore' configs: - source: pg_backup target: /pg_backup.sh mode: 0555 secrets: - postgres_p redis: image: redis:8 networks: - backend minio-bootstrap: # NOTE: Not started by default, only run with a manual `abra app restart` / `docker service scale` image: minio/mc:RELEASE.2025-05-21T01-59-54Z environment: *minio-env networks: - backend entrypoint: > sh -c " MINIO_ROOT_USER=\"\$$(cat /run/secrets/minio_ru)\" && MINIO_ROOT_PASSWORD=\"\$$(cat /run/secrets/minio_rp)\" && /usr/bin/mc alias set docs http://minio:9000 \$${MINIO_ROOT_USER} \"\$${MINIO_ROOT_PASSWORD}\" && /usr/bin/mc mb --ignore-existing docs/docs-media-storage && /usr/bin/mc version enable docs/docs-media-storage && exit 0" deploy: mode: replicated replicas: 0 restart_policy: condition: none secrets: - minio_rp - minio_ru minio: image: minio/minio:RELEASE.2025-05-24T17-08-30Z environment: *minio-env healthcheck: test: ["CMD", "mc", "ready", "local"] interval: 1s timeout: 20s retries: 300 networks: - backend command: minio server /data entrypoint: ["/usr/bin/docker-entrypoint.sh"] volumes: - minio:/data deploy: labels: backupbot.backup: "${ENABLE_BACKUPS:-true}" entrypoint: /abra-entrypoint.sh configs: - source: abra_entrypoint target: /abra-entrypoint.sh mode: 0555 secrets: - minio_rp - minio_ru web: image: nginx:1.29 configs: - source: nginx_conf target: /etc/nginx/conf.d/default.conf networks: proxy: backend: depends_on: - backend - app environment: - STACK_NAME deploy: labels: - "traefik.enable=true" - "traefik.docker.network=proxy" - "traefik.http.routers.${STACK_NAME}.tls=true" - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8083" - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})" - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}" - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure" networks: proxy: external: true backend: volumes: postgres: minio: configs: nginx_conf: name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION} file: nginx.conf.tmpl template_driver: golang pg_backup: name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION} file: pg_backup.sh abra_entrypoint: name: ${STACK_NAME}_entrypoint_${ABRA_ENTRYPOINT_VERSION} file: abra-entrypoint.sh secrets: django_sk: external: true name: ${STACK_NAME}_django_sk_${SECRET_DJANGO_SK_VERSION} oidc_rpcs: external: true name: ${STACK_NAME}_oidc_rpcs_${SECRET_OIDC_RPCS_VERSION} django_sp: external: true name: ${STACK_NAME}_django_sp_${SECRET_DJANGO_SP_VERSION} postgres_p: external: true name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION} collab_ss: external: true name: ${STACK_NAME}_collab_ss_${SECRET_COLLAB_SS_VERSION} minio_rp: external: true name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION} minio_ru: external: true name: ${STACK_NAME}_minio_ru_${SECRET_MINIO_RP_VERSION} y_api_key: external: true name: ${STACK_NAME}_y_api_key_${SECRET_Y_API_KEY_VERSION} email_pass: external: true name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}