claper/compose.yml

# NOTE: based on https://github.com/ClaperCo/Claper/blob/main/docker-compose.yml
# and https://github.com/ClaperCo/Claper/blob/main/config/runtime.exs
#
# Claper reads every config variable either from the environment or from a
# file named after the variable in CONFIG_DIR (default: /run/secrets). Secrets
# are therefore mounted with `target: <VARIABLE_NAME>`; only DATABASE_URL has
# to be assembled in abra-entrypoint.sh.

version: "3.8"
services:
  app:
    image: ghcr.io/claperco/claper:3.2.0
    networks:
      - proxy
      - internal
    entrypoint: /abra-entrypoint.sh
    # Overriding the entrypoint drops the image CMD, so it is repeated here.
    command:
      - sh
      - -c
      - "/app/bin/claper eval 'Claper.Release.migrate(); Code.eval_file(\"/bootstrap_admin.exs\"); Claper.Release.seeds()' && exec /app/bin/claper start"
    configs:
      - source: abra_entrypoint
        target: /abra-entrypoint.sh
        mode: 0555
      - source: bootstrap_admin
        target: /bootstrap_admin.exs
    secrets:
      - db_password
      - admin_pass
      - source: key_base
        target: SECRET_KEY_BASE
    environment:
      - STACK_NAME
      - ADMIN_EMAIL
      - BASE_URL=https://${DOMAIN}
      - SECURE_COOKIE=true
      - SAME_SITE_COOKIE
      # Docker swarm overlay networks, so the client IP is taken from X-Forwarded-For
      - REMOTE_IP_PROXIES=${REMOTE_IP_PROXIES:-10.0.0.0/8}
      - PRESENTATION_STORAGE=${PRESENTATION_STORAGE:-local}
      - PRESENTATION_STORAGE_DIR=/app/uploads
      - MAX_FILE_SIZE_MB
      - MAIL_TRANSPORT=${MAIL_TRANSPORT:-local}
      - MAIL_FROM
      - MAIL_FROM_NAME
      - ENABLE_ACCOUNT_CREATION
      - EMAIL_CONFIRMATION
      - ALLOW_UNLINK_EXTERNAL_PROVIDER
      - LOGOUT_REDIRECT_URL
      - GS_JPG_RESOLUTION
      - LANGUAGES
      - EVENT_INACTIVITY_DAYS
      - TERMS_URL
      - PRIVACY_URL
      - POOL_SIZE
    volumes:
      - uploads:/app/uploads
    deploy:
      restart_policy:
        condition: on-failure
      update_config:
        failure_action: rollback
        order: start-first
      labels:
        - "traefik.enable=true"
        - "traefik.swarm.network=proxy"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=4000"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "coop-cloud.${STACK_NAME}.version=0.1.1+3.2.0"
        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-300}"
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"
    healthcheck:
      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://localhost:4000/"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 2m

  db:
    image: pgautoupgrade/pgautoupgrade:18-debian
    networks:
      - internal
    environment:
      - POSTGRES_DB=claper
      - POSTGRES_USER=claper
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
      - PGDATA=/var/lib/postgresql/data/pgdata
    secrets:
      - db_password
    volumes:
      - postgres:/var/lib/postgresql/data/pgdata
    configs:
      - source: pg_backup
        target: /pg_backup.sh
        mode: 0555
    deploy:
      labels:
        backupbot.backup: "${ENABLE_BACKUPS:-true}"
        backupbot.backup.pre-hook: "/pg_backup.sh backup"
        backupbot.backup.volumes.postgres.path: "backup.sql"
        backupbot.restore.post-hook: "/pg_backup.sh restore"
    healthcheck:
      test: ["CMD", "pg_isready", "-q", "-U", "claper", "-d", "claper"]
      interval: 10s
      timeout: 5s
      retries: 30

secrets:
  db_password:
    external: true
    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
  key_base:
    external: true
    name: ${STACK_NAME}_key_base_${SECRET_KEY_BASE_VERSION}
  admin_pass:
    external: true
    name: ${STACK_NAME}_admin_pass_${SECRET_ADMIN_PASS_VERSION}

volumes:
  uploads:
  postgres:

configs:
  abra_entrypoint:
    name: ${STACK_NAME}_entrypoint_${ABRA_ENTRYPOINT_VERSION}
    file: abra-entrypoint.sh
  bootstrap_admin:
    name: ${STACK_NAME}_bootstrap_admin_${BOOTSTRAP_ADMIN_VERSION}
    file: bootstrap_admin.exs
  pg_backup:
    name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
    file: pg_backup.sh

networks:
  proxy:
    external: true
  internal: