lasuite-drive/compose.yml

# NOTE: based on https://github.com/suitenumerique/docs/pull/855/ and https://github.com/suitenumerique/docs/pull/583/

x-common-env: &common-env
  DJANGO_CONFIGURATION: Production
  DJANGO_ALLOWED_HOSTS: "*"
  # DJANGO_SECRET_KEY supplied via secrets
  DJANGO_SETTINGS_MODULE: drive.settings
  # DJANGO_SUPERUSER_PASSWORD supplied via secrets
  # Logging
  # Set to DEBUG level for dev only
  LOGGING_LEVEL_HANDLERS_CONSOLE:
  LOGGING_LEVEL_LOGGERS_ROOT:
  LOGGING_LEVEL_LOGGERS_APP:
  # Python
  PYTHONPATH: /app
  PYLINTHOME: /app/.pylint.d
  # Mail
  DJANGO_EMAIL_BRAND_NAME:
  DJANGO_EMAIL_HOST:
  DJANGO_EMAIL_LOGO_IMG:
  DJANGO_EMAIL_PORT:
  DJANGO_EMAIL_HOST_USER:
  # DJANGO_EMAIL_HOST_PASSWORD supplied via secret
  DJANGO_EMAIL_USE_SSL:
  DJANGO_EMAIL_USE_TLS:
  DJANGO_EMAIL_FROM:
  DJANGO_EMAIL_URL_APP:
  DJANGO_CSRF_TRUSTED_ORIGINS:
  DATA_UPLOAD_MAX_MEMORY_SIZE:
  # Backend url
  DRIVE_BASE_URL: "https://${DOMAIN}"
  # Media
  STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
  AWS_S3_ENDPOINT_URL: http://rustfs:9000
  AWS_S3_DOMAIN_REPLACE: https://${RUSTFS_DOMAIN}
  # AWS_S3_ACCESS_KEY_ID supplied via secret (this is same as RUSTFS_ACCESS_KEY)
  # AWS_S3_SECRET_ACCESS_KEY supplied via secret (this is same as RUSTFS_SECRET_KEY)
  MEDIA_BASE_URL: https://${DOMAIN}
  AWS_STORAGE_BUCKET_NAME: drive-media-storage
  # OIDC - settings from .env, see .env.sample
  OIDC_OP_JWKS_ENDPOINT:
  OIDC_OP_AUTHORIZATION_ENDPOINT:
  OIDC_OP_TOKEN_ENDPOINT:
  OIDC_OP_USER_ENDPOINT:
  OIDC_RP_CLIENT_ID:
  # OIDC_RP_CLIENT_SECRET supplied via secrets
  OIDC_RP_SIGN_ALGO:
  OIDC_RP_SCOPES:
  LOGIN_REDIRECT_URL:
  LOGIN_REDIRECT_URL_FAILURE:
  LOGOUT_REDIRECT_URL:
  OIDC_REDIRECT_ALLOWED_HOSTS:
  OIDC_AUTH_REQUEST_EXTRA_PARAMS:
  # REDIS
  REDIS_URL: redis://${STACK_NAME}_redis:6379/0
  # AI (Fixme: remove?)
  AI_FEATURE_ENABLED: "false"
  AI_BASE_URL: https://openaiendpoint.com
  AI_API_KEY: password
  AI_MODEL: llama
  # Collaboration
  COLLABORATION_API_URL: https://$DOMAIN/collaboration/api/
  # SDK picker pages (/sdk) and SDK relay API, used by other La Suite apps
  SDK_ENABLED: ${SDK_ENABLED:-false}

  # WOPI
  WOPI_CLIENTS: "collabora,onlyoffice"
  WOPI_COLLABORA_DISCOVERY_URL: "https://${COLLABORA_DOMAIN}/hosting/discovery"
  WOPI_ONLYOFFICE_DISCOVERY_URL: "https://${ONLY_OFFICE_DOMAIN}/hosting/discovery"
  WOPI_SRC_BASE_URL: "https://${DOMAIN}"
  # WOPI scheduling (Celery Beat crontab for WOPI configuration task)
  WOPI_CONFIGURATION_CRONTAB_MINUTE: ${WOPI_CONFIGURATION_CRONTAB_MINUTE:-0}
  WOPI_CONFIGURATION_CRONTAB_HOUR: ${WOPI_CONFIGURATION_CRONTAB_HOUR:-3}
  WOPI_CONFIGURATION_CRONTAB_DAY_OF_MONTH: ${WOPI_CONFIGURATION_CRONTAB_DAY_OF_MONTH:-*}
  WOPI_CONFIGURATION_CRONTAB_MONTH_OF_YEAR: ${WOPI_CONFIGURATION_CRONTAB_MONTH_OF_YEAR:-*}

x-postgres-env: &postgres-env
  # Postgresql db container configuration
  POSTGRES_DB: drive
  POSTGRES_USER: drive
  POSTGRES_PASSWORD_FILE: /run/secrets/postgres_p
  # App database configuration
  DB_HOST: db
  DB_NAME: drive
  DB_USER: drive
  DB_PORT: 5432
  # DB_PASSWORD supplied via secrets (this is same as POSTGRES_PASSWORD)

x-rustfs-env: &rustfs-env
  RUSTFS_ACCESS_KEY_FILE: /run/secrets/rustfs_ru
  RUSTFS_SECRET_KEY_FILE: /run/secrets/rustfs_rp
  RUSTFS_CONSOLE_ENABLE: "false"

services:

  app:
    user: "${DOCKER_USER:-1000}"
    image: lasuite/drive-frontend:v0.25.3
    networks:
      - backend
    deploy:
      labels:
        - "traefik.enable=false"
        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
        - "coop-cloud.${STACK_NAME}.version=0.13.3+v0.22.0"
    environment:
      <<: [ *common-env ]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080"]
      interval: 15s
      timeout: 30s
      retries: 20
      start_period: 10s
    depends_on:
      - backend

  backend:
    user: ${DOCKER_USER:-1000}
    image: lasuite/drive-backend:v0.25.3
    command: [ "gunicorn", "-c", "/usr/local/etc/gunicorn/drive.py", "drive.wsgi:application" ]
    entrypoint: >
      sh -c "/s3-initialize.sh || echo '⚠ s3-initialize failed, run: abra app cmd <app> backend s3_initialize' ;
      if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
    environment:
      <<: [ *common-env, *postgres-env ]
      AUTO_MIGRATIONS: "${AUTO_MIGRATIONS:-true}"
    networks:
      - backend
    depends_on:
      - db
    configs:
      - source: abra_entrypoint
        target: /abra-entrypoint.sh
        mode: 0555
      - source: migrate
        target: /migrate.sh
        mode: 0555
      - source: s3_initialize
        target: /s3-initialize.sh
        mode: 0555
    secrets:
      - django_sk
      - django_sp
      - oidc_rpcs
      - rustfs_rp
      - rustfs_ru
      - postgres_p
      - email_pass

  celery:
    user: ${DOCKER_USER:-1000}
    image: lasuite/drive-backend:v0.25.3
    networks:
      - backend
    command: [ "celery", "-A", "drive.celery_app", "worker", "-l", "INFO" ]
    entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"]
    environment:
      <<: [*common-env, *postgres-env]
      RUN_WOPI_ON_STARTUP: "true"
    configs:
      - source: abra_entrypoint
        target: /abra-entrypoint.sh
        mode: 0555
    secrets:
      - django_sk
      - django_sp
      - oidc_rpcs
      - rustfs_rp
      - rustfs_ru
      - postgres_p
      - email_pass

  celery-beat:
    user: ${DOCKER_USER:-1000}
    image: lasuite/drive-backend:v0.25.3
    networks:
      - backend
    command: [ "celery", "-A", "drive.celery_app", "beat", "-l", "INFO", "--schedule", "/tmp/celerybeat-schedule" ]
    entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"]
    environment:
      <<: [*common-env, *postgres-env]
      # Maintenance commands scheduled by celery beat: crontab expression followed by command arguments
      CLEAN_PENDING_ITEMS_SCHEDULE: ${CLEAN_PENDING_ITEMS_SCHEDULE:-30 0 * * *}
      PURGE_DELETED_ITEMS_SCHEDULE: ${PURGE_DELETED_ITEMS_SCHEDULE:-45 0 * * *}
    configs:
      - source: abra_entrypoint
        target: /abra-entrypoint.sh
        mode: 0555
    secrets:
      - django_sk
      - django_sp
      - oidc_rpcs
      - rustfs_rp
      - rustfs_ru
      - postgres_p
      - email_pass

  db:
    image: pgautoupgrade/pgautoupgrade:18-debian
    networks:
      - backend 
    healthcheck:
      test: ["CMD", "pg_isready", "-q", "-U", "drive", "-d", "drive"]
      interval: 1s
      timeout: 2s
      retries: 300
    environment:
      <<: *postgres-env
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres:/var/lib/postgresql/data/pgdata
    deploy:
      labels:
        backupbot.backup: "${ENABLE_BACKUPS:-true}"
        backupbot.backup.pre-hook: "/pg_backup.sh backup"
        backupbot.backup.volumes.postgres.path: "backup.sql"
        backupbot.restore.post-hook: '/pg_backup.sh restore'
    configs:
        - source: pg_backup
          target: /pg_backup.sh
          mode: 0555
    secrets:
      - postgres_p

  redis:
    image: redis:8.10.3
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  mailcatcher:
    image: sj26/mailcatcher:v0.11.0
    networks:
      - backend

  rustfs:
    image: rustfs/rustfs:1.0.3
    environment: *rustfs-env
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:9000/health"]
      interval: 5s
      timeout: 20s
      retries: 60
    networks:
      - backend
      - proxy
    volumes:
      - rustfs:/data
    secrets:
      - rustfs_rp
      - rustfs_ru
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.${STACK_NAME}_rustfs.rule=Host(`${RUSTFS_DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}_rustfs.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}_rustfs.tls=true"
        - "traefik.http.routers.${STACK_NAME}_rustfs.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.services.${STACK_NAME}_rustfs.loadbalancer.server.port=9000"
        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlAllowOriginList=https://${DOMAIN}"
        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlAllowMethods=GET,POST,PUT,DELETE,OPTIONS"
        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlAllowHeaders=*"
        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlExposeHeaders=ETag,Content-Length"
        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlMaxAge=600"
        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.addVaryHeader=true"
        - "traefik.http.routers.${STACK_NAME}_rustfs.middlewares=${STACK_NAME}_rustfs-cors"
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"

  collabora:
    image: collabora/code:26.04.5.2.1
    # Since 26.04 the image is distroless (no sh, no curl, no
    # start-collabora-online.sh): keep the image entrypoint
    # (coolwsd --use-env-vars), which reads the env vars below directly.
    healthcheck:
      # --use-env-vars so the probe honours ssl.enable=false from extra_params
      test: [ "CMD", "/usr/bin/coolwsd", "--probe", "--use-env-vars" ]
      interval: 30s
      retries: 5
      start_period: 60s
      timeout: 10s
    networks:
      - backend
      - proxy
    environment:
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
      - username=${COLLABORA_ADMIN_USERNAME:-admin}
      - password=${COLLABORA_ADMIN_PASSWORD}
      - server_name=${COLLABORA_DOMAIN}
    deploy:
      labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.${STACK_NAME}_collabora.rule=Host(`${COLLABORA_DOMAIN}`)"
      - "traefik.http.routers.${STACK_NAME}_collabora.entrypoints=web-secure"
      - "traefik.http.routers.${STACK_NAME}_collabora.tls=true"
      - "traefik.http.routers.${STACK_NAME}_collabora.tls.certresolver=${LETS_ENCRYPT_ENV}"
      - "traefik.http.services.${STACK_NAME}_collabora.loadbalancer.server.port=9980"
      - "traefik.http.middlewares.${STACK_NAME}_collabora-cors.headers.accessControlAllowOriginList=https://${DOMAIN}"
      - "traefik.http.middlewares.${STACK_NAME}_collabora-cors.headers.accessControlAllowMethods=GET,POST,PUT,DELETE,OPTIONS"
      - "traefik.http.middlewares.${STACK_NAME}_collabora-cors.headers.accessControlAllowHeaders=*"
      - "traefik.http.middlewares.${STACK_NAME}_collabora-cors.headers.accessControlExposeHeaders=ETag,Content-Length"
      - "traefik.http.middlewares.${STACK_NAME}_collabora-cors.headers.accessControlMaxAge=600"
      - "traefik.http.middlewares.${STACK_NAME}_collabora-cors.headers.addVaryHeader=true"
      - "traefik.http.routers.${STACK_NAME}_collabora.middlewares=${STACK_NAME}_collabora-cors"

  onlyoffice:
    image: onlyoffice/documentserver-de:10.0.2.1
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost/hosting/discovery" ]
      interval: 30s
      retries: 5
      start_period: 60s
      timeout: 10s
    environment:
      TZ: "Europe/Berlin"
      USE_UNAUTHORIZED_STORAGE: "true"
      ONLY_OFFICE_DOMAIN: ${ONLY_OFFICE_DOMAIN} # need to make variable available for golang template
      # onlyoffice >= 10.0.2 only sends WOPI requests to hosts named in an
      # ipfilter rule (wopi.requireIpFilterRule), see onlyoffice-config.json.tmpl
      DOMAIN: ${DOMAIN}
    networks:
      - backend
      - proxy
    configs:
      - source: onlyoffice_conf
        target: /etc/onlyoffice/documentserver/local-production-linux.json

    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.${STACK_NAME}_onlyoffice.rule=Host(`${ONLY_OFFICE_DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}_onlyoffice.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}_onlyoffice.tls=true"
        - "traefik.http.routers.${STACK_NAME}_onlyoffice.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.services.${STACK_NAME}_onlyoffice.loadbalancer.server.port=80"
        - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.accessControlAllowOriginList=https://${DOMAIN}"
        - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.accessControlAllowMethods=GET,POST,PUT,DELETE,OPTIONS"
        - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.accessControlAllowHeaders=*"
        - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.accessControlExposeHeaders=ETag,Content-Length"
        - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.accessControlMaxAge=600"
        - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.addVaryHeader=true"
        - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-fwdproto.headers.customRequestHeaders.X-Forwarded-Proto=https"
        - "traefik.http.routers.${STACK_NAME}_onlyoffice.middlewares=${STACK_NAME}_onlyoffice-cors,${STACK_NAME}_onlyoffice-fwdproto"


  web:
    image: nginx:1.31.8
    configs:
      - source: nginx_conf
        target: /etc/nginx/conf.d/default.conf
    networks:
      proxy:
      backend:
    depends_on:
      - backend
      - app
    environment:
      - STACK_NAME
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.${STACK_NAME}.tls=true"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8083"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"

networks:
  proxy:
    external: true
  backend:

volumes:
  postgres:
  rustfs:

configs:
  nginx_conf:
    name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
    file: nginx.conf.tmpl
    template_driver: golang
  pg_backup:
    name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
    file: pg_backup.sh
  abra_entrypoint:
    name: ${STACK_NAME}_entrypoint_${ABRA_ENTRYPOINT_VERSION}
    file: abra-entrypoint.sh
  migrate:
    name: ${STACK_NAME}_migrate_${MIGRATE_VERSION}
    file: migrate.sh
  s3_initialize:
    name: ${STACK_NAME}_s3_initialize_${S3_INITIALIZE_VERSION}
    file: s3-initialize.sh
  onlyoffice_conf:
    name: ${STACK_NAME}_onlyoffice_conf_${ONLYOFFICE_CONF_VERSION}
    file: onlyoffice-config.json.tmpl
    template_driver: golang

secrets:
  django_sk:
    external: true
    name: ${STACK_NAME}_django_sk_${SECRET_DJANGO_SK_VERSION}
  oidc_rpcs:
    external: true
    name: ${STACK_NAME}_oidc_rpcs_${SECRET_OIDC_RPCS_VERSION}
  django_sp:
    external: true
    name: ${STACK_NAME}_django_sp_${SECRET_DJANGO_SP_VERSION}
  postgres_p:
    external: true
    name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION}
  rustfs_rp:
    external: true
    name: ${STACK_NAME}_rustfs_rp_${SECRET_RUSTFS_RP_VERSION}
  rustfs_ru:
    external: true
    name: ${STACK_NAME}_rustfs_ru_${SECRET_RUSTFS_RU_VERSION}
  email_pass:
    external: true
    name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}