lasuite-docs/compose.yml

---

# NOTE: based on https://github.com/suitenumerique/docs/pull/855/ and https://github.com/suitenumerique/docs/pull/583/

x-common-env: &common-env
  DJANGO_CONFIGURATION: Demo
  DJANGO_ALLOWED_HOSTS: "*"
  DJANGO_SECRET_KEY: ThisIsAnExampleKeyForDevPurposeOnly
  DJANGO_SETTINGS_MODULE: impress.settings
  # FIXME: Move to docker secret
  DJANGO_SUPERUSER_PASSWORD: admin
  # Logging
  # Set to DEBUG level for dev only
  LOGGING_LEVEL_HANDLERS_CONSOLE: INFO
  LOGGING_LEVEL_LOGGERS_ROOT: INFO
  LOGGING_LEVEL_LOGGERS_APP: INFO
  # Python
  PYTHONPATH: /app
  # Mail
  DJANGO_EMAIL_BRAND_NAME: "La Suite Numérique"
  DJANGO_EMAIL_HOST: "mailcatcher"
  DJANGO_EMAIL_LOGO_IMG: "http://$DOMAIN/assets/logo-suite-numerique.png"
  DJANGO_EMAIL_PORT: 1025
  # Backend url
  IMPRESS_BASE_URL: "https://${DOMAIN}"
  # Media
  STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
  AWS_S3_ENDPOINT_URL: http://minio:9000
  AWS_S3_ACCESS_KEY_ID: user
  # FIXME: Move to docker secret
  AWS_S3_SECRET_ACCESS_KEY: password
  MEDIA_BASE_URL: https://${DOMAIN}
  AWS_STORAGE_BUCKET_NAME: docs-media-storage
  # OIDC
  OIDC_OP_JWKS_ENDPOINT: https://auth.${DOMAIN}/realms/impress/protocol/openid-connect/certs
  OIDC_OP_AUTHORIZATION_ENDPOINT: https://auth.${DOMAIN}/realms/impress/protocol/openid-connect/auth
  OIDC_OP_TOKEN_ENDPOINT: https://auth.${DOMAIN}/realms/impress/protocol/openid-connect/token
  OIDC_OP_USER_ENDPOINT: https://auth.${DOMAIN}/realms/impress/protocol/openid-connect/userinfo
  OIDC_RP_CLIENT_ID: impress
  OIDC_RP_CLIENT_SECRET:
  OIDC_RP_SIGN_ALGO: RS256
  OIDC_RP_SCOPES: "openid email"
  LOGIN_REDIRECT_URL: https://${DOMAIN}
  LOGIN_REDIRECT_URL_FAILURE: https://${DOMAIN}
  LOGOUT_REDIRECT_URL: https://${DOMAIN}
  OIDC_REDIRECT_ALLOWED_HOSTS: '["https://auth.${DOMAIN}", "https://${DOMAIN}"]'
  OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
  # AI
  AI_FEATURE_ENABLED: "false"
  AI_BASE_URL: https://openaiendpoint.com
  AI_API_KEY: password
  AI_MODEL: llama
  # Collaboration
  COLLABORATION_API_URL: https://$DOMAIN/collaboration/api/

x-postgres-env: &postgres-env
  # Postgresql db container configuration
  POSTGRES_DB: docs
  POSTGRES_USER: docs
  # FIXME: Move to docker secret
  POSTGRES_PASSWORD: password
  # App database configuration
  DB_HOST: db
  DB_NAME: docs
  DB_USER: docs
  # FIXME: Move to docker secret
  DB_PASSWORD: password
  DB_PORT: 5432

x-yprovider-env: &yprovider-env
  COLLABORATION_LOGGING: "true"
  Y_PROVIDER_API_KEY: foobar
  COLLABORATION_API_URL: http://y-provider:4444/api/
  COLLABORATION_SERVER_ORIGIN: https://${DOMAIN}
  COLLABORATION_SERVER_SECRET: my-secret
  COLLABORATION_BACKEND_BASE_URL: https://${DOMAIN}
  COLLABORATION_WS_URL: wss://${DOMAIN}/collaboration/ws/

x-minio-env: &minio-env
  MINIO_ROOT_USER: user
  # FIXME: Move to docker secret
  MINIO_ROOT_PASSWORD: password

x-keycloak-env: &kc-keycloak-env
  KC_BOOTSTRAP_ADMIN_USERNAME: admin
  # FIXME: Move to docker secret
  KC_BOOTSTRAP_ADMIN_PASSWORD: admin
  KC_DB: postgres
  KC_DB_URL_HOST: kc_postgresql
  KC_DB_SCHEMA: public
  PROXY_ADDRESS_FORWARDING: 'true'
  KC_HOSTNAME: https://auth.${DOMAIN}
  KC_HTTP_ENABLED: "true"
  # KC_HTTPS_CERTIFICATE_FILE: /etc/ssl/certs/docs.crt
  # KC_HTTPS_CERTIFICATE_KEY_FILE: /etc/ssl/private/docs.key`

x-kc-postgres-env: &kc-postgres-env
  # Postgresql db container configuration
  POSTGRES_DB: keycloak
  POSTGRES_USER: keycloak
  # FIXME: Move to docker secret
  POSTGRES_PASSWORD: keycloak
  # Keycloak database configuration
  KC_DB_URL_DATABASE: keycloak
  KC_DB_USERNAME: keycloak
  # FIXME: Move to docker secret
  KC_DB_PASSWORD: keycloak

services:
  app:
    image: lasuite/impress-frontend:v3.3.0
    networks:
      - backend 
    deploy:
      labels:
        - "traefik.enable=false"
        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
        - "coop-cloud.${STACK_NAME}.version=0.0.0+v3.3.0"

  backend:
    image: lasuite/impress-backend:v3.3.0
    networks:
      - backend 
    environment:
      <<: [*common-env, *postgres-env, *yprovider-env]
      DJANGO_CONFIGURATION: Production
    healthcheck:
      test: ["CMD", "python", "manage.py", "check"]
      interval: 15s
      timeout: 30s
      retries: 20
      start_period: 10s

  # backend-migration:
  #   image: lasuite/impress-backend:v3.3.0
  #   networks:
  #     - backend 
  #   command: ["python", "manage.py", "migrate", "--noinput"]
  #   environment:
  #     <<: [*common-env, *postgres-env, *yprovider-env]
  #     DJANGO_CONFIGURATION: Production

  celery:
    image: lasuite/impress-backend:v3.3.0
    networks:
      - backend 
    command: ["celery", "-A", "impress.celery_app", "worker", "-l", "INFO"]
    environment:
      <<: [*common-env, *postgres-env, *yprovider-env]
      DJANGO_CONFIGURATION: Production

  y-provider:
    image: lasuite/impress-y-provider:v3.3.0
    networks:
      - backend 
    environment: *yprovider-env

  db:
    image: postgres:16
    networks:
      - backend 
    healthcheck:
      test: ["CMD", "pg_isready", "-q", "-U", "docs", "-d", "docs"]
      interval: 1s
      timeout: 2s
      retries: 300
    environment:
      <<: *postgres-env
      PGDATA: var/lib/postgresql/data/pgdata
    volumes:
      - postgres:/var/lib/postgresql/data/pgdata

  redis:
    image: redis:5
    networks:
      - backend 

  # TODO: Move to abra.sh command
  # minio-bootstrap:
  #   image: minio/mc
  #   environment: *minio-env
  #   networks:
  #     - backend 
  #   entrypoint: >
  #     sh -c "
  #     /usr/bin/mc alias set docs http://minio:9000 $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD} && \
  #     /usr/bin/mc mb --ignore-existing docs/docs-media-storage && \
  #     /usr/bin/mc version enable docs/docs-media-storage && \
  #     exit 0;"

  minio:
    image: minio/minio
    environment: *minio-env
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 1s
      timeout: 20s
      retries: 300
    entrypoint: ""
    networks:
      - backend 
    command: minio server /data
    volumes:
      - minio:/data

  web:
    image: nginx:1.27
    configs:
      - source: nginx_conf
        target: /etc/nginx/conf.d/default.conf
    networks:
      proxy:
      backend:
    # volumes:
    #   - certs:/etc/nginx/ssl:ro
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.${STACK_NAME}.tls=true"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8083"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"

  # FIXME: remove
  kc_postgresql:
    image: postgres:16
    networks:
      - backend
    healthcheck:
      test: ["CMD", "pg_isready", "-q", "-U", "keycloak", "-d", "keycloak"]
      interval: 1s
      timeout: 2s
      retries: 300    
    environment:
      <<: *kc-postgres-env
      PGDATA: var/lib/postgresql/data/pgdata
    volumes:
      - postgres_keycloak:/var/lib/postgresql/data/pgdata

  keycloak:
    image: quay.io/keycloak/keycloak:26.1.0
    command: ["start"]
    networks:
      - proxy
      - backend
    environment:
      <<: [*kc-keycloak-env, *kc-postgres-env]
    # volumes:
    #   - certs:/etc/ssl/certs:ro
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.${STACK_NAME}-keycloak.tls=true"
        - "traefik.http.services.${STACK_NAME}-keycloak.loadbalancer.server.port=8080"
        - "traefik.http.routers.${STACK_NAME}-keycloak.rule=Host(`auth.${DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}-keycloak.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}-keycloak.entrypoints=web-secure"

networks:
  proxy:
    external: true
  backend:

volumes:
  postgres:
  minio:
  # FIXME: remove this
  postgres_keycloak:
  # certs:

configs:
  nginx_conf:
    name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
    file: nginx.conf