radicle/compose.yml

version: "3.8"

services:
  # Web frontend: serves the radicle-explorer SPA and proxies /api/v1/* to the
  # httpd service (same origin -> no CORS, single TLS cert). Only service on the
  # proxy network / exposed via Traefik.
  web:
    image: git.coopcloud.tech/c4dt/radicle-explorer:${EXPLORER_VERSION}
    depends_on:
      - httpd
    configs:
      - source: nginx_conf
        target: /etc/nginx/conf.d/default.conf
      - source: explorer_config
        target: /usr/share/nginx/html/config.json
    networks:
      - proxy
      - internal
    deploy:
      update_config:
        failure_action: rollback
        order: start-first
      rollback_config:
        order: start-first
      restart_policy:
        max_attempts: 3
      resources:
        limits:
          memory: 128M
      labels:
        - "traefik.enable=true"
        - "traefik.swarm.network=proxy"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
        - "caddy=${DOMAIN}"
        - "caddy.reverse_proxy={{upstreams 80}}"
        - "caddy.tls.on_demand="
        - "coop-cloud.${STACK_NAME}.version=0.1.0+1.9.1"
        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost/ || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  # HTTP API daemon the browser talks to (via the web proxy). Reads the node's
  # control socket and storage from the shared RAD_HOME volume. Internal only.
  httpd:
    image: git.coopcloud.tech/c4dt/radicle:${RADICLE_VERSION}
    command: radicle-httpd --listen 0.0.0.0:8080
    depends_on:
      - node
    environment:
      - RAD_HOME=/var/lib/radicle
    volumes:
      - radicle_home:/var/lib/radicle
    networks:
      - internal
    deploy:
      update_config:
        failure_action: rollback
        order: stop-first
      restart_policy:
        max_attempts: 3
      resources:
        limits:
          memory: 256M
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/api/v1 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  # Radicle seed node (p2p). Owns the identity key and config.json in the
  # shared RAD_HOME volume. p2p port published on the host so peers can dial it.
  node:
    image: git.coopcloud.tech/c4dt/radicle:${RADICLE_VERSION}
    configs:
      - source: node_entrypoint
        target: /entrypoint.sh
        mode: 0555
    entrypoint: /entrypoint.sh
    secrets:
      - keypass
    environment:
      - RAD_HOME=/var/lib/radicle
      - RAD_ALIAS
      - RAD_EXTERNAL_ADDRESS
      - RAD_SEEDING_POLICY
      - RAD_SEEDING_SCOPE
      - RAD_P2P_PORT
    volumes:
      - radicle_home:/var/lib/radicle
    ports:
      # Radicle p2p protocol. Open this port on the host firewall.
      - "${RAD_P2P_PORT:-8776}:8776"
    networks:
      - internal
    deploy:
      update_config:
        failure_action: rollback
        order: stop-first
      restart_policy:
        max_attempts: 3
      resources:
        limits:
          memory: 512M
      labels:
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"
        - "backupbot.backup.path=/var/lib/radicle"
    healthcheck:
      test: ["CMD-SHELL", "test -S /var/lib/radicle/node/control.sock"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

secrets:
  keypass:
    external: true
    name: ${STACK_NAME}_keypass_${SECRET_KEYPASS_VERSION}

configs:
  nginx_conf:
    name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
    file: nginx.conf.tmpl
    template_driver: golang
  explorer_config:
    name: ${STACK_NAME}_explorer_config_${EXPLORER_CONFIG_VERSION}
    file: explorer-config.json.tmpl
    template_driver: golang
  node_entrypoint:
    name: ${STACK_NAME}_node_entrypoint_${NODE_ENTRYPOINT_VERSION}
    file: node-entrypoint.sh.tmpl
    template_driver: golang

volumes:
  radicle_home:

networks:
  proxy:
    external: true
  internal: