docker-compose.yml

networks:
  placeos:
    name: placeos
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.31.231.0/24

volumes:
  elastic-data:
  influx-data:
  nginx-data:
  postgres-data:
  redis-data:
  core-drivers:
  www:
  minio:

# YAML Anchors

x-cap-drop: &cap-drop
  cap_drop:
    # - AUDIT_WRITE      # Write records to kernel auditing log.
    - CHOWN            # Make arbitrary changes to file UIDs and GIDs (see chown(2)).
    - DAC_OVERRIDE     # Bypass file read, write, and execute permission checks.
    # - FOWNER           # Bypass permission checks on operations that normally require the file system UID of the process to match the UID of the file.
    # - FSETID           # Don’t clear set-user-ID and set-group-ID permission bits when a file is modified.
    # - KILL             # Bypass permission checks for sending signals.
    - MKNOD            # Create special files using mknod(2).
    # - NET_BIND_SERVICE # Bind a socket to internet domain privileged ports (port numbers less than 1024).
    # - NET_RAW          # Use RAW and PACKET sockets.
    - SETFCAP          # Set file capabilities.
    - SETGID           # Make arbitrary manipulations of process GIDs and supplementary GID list.
    - SETPCAP          # Modify process capabilities.
    - SETUID           # Make arbitrary manipulations of process UIDs.
    - SYS_CHROOT       # Use chroot(2), change root directory.

x-deployment-env: &deployment-env
  PLACE_LOG_FORMAT: ${LOG_FORMAT:-JSON}
  LOG_LEVEL: ${LOG_LEVEL:-warn}
  ENV: ${ENV:-development}
  SG_ENV: ${SG_ENV:-development}
  TZ: $TZ

x-edge-env: &edge-env
  PLACE_EDGE_KEY: ${PLACE_EDGE_KEY:-}
  PLACE_URI: ${PLACE_URI:-http://api:3000}

x-jwt-public-key-env: &jwt-public-key-env .env.public_key

x-secret-key-env: &secret-key-env .env.secret_key

x-elastic-client-env: &elastic-client-env
  ELASTIC_HOST: ${ELASTIC_HOST:-elastic}
  ELASTIC_PORT: ${ELASTIC_PORT:-9200}
  ES_HOST: ${ELASTIC_HOST:-elastic}
  ES_PORT: ${ELASTIC_PORT:-9200}

x-influxdb-api-key: &influxdb-api-key .env.influxdb

x-influxdb-client-env: &influxdb-client-env
  INFLUX_BUCKET: ${INFLUX_BUCKET:-place}
  INFLUX_HOST: ${INFLUX_HOST:-http://influxdb:8086}
  INFLUX_ORG: ${INFLUX_ORG:-PlaceOS}

x-opentelemetry-env: &opentelemetry-env
  OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
  OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
  OTEL_EXPORTER_OTLP_API_KEY: ${OTEL_EXPORTER_OTLP_API_KEY:-}

x-place-loader-client-env: &place-loader-client-env
  PLACE_LOADER_URI: ${PLACE_LOADER_URI:-http://frontend-loader:3000}

x-redis-client-env: &redis-client-env
  REDIS_URL: ${REDIS_URL:-redis://redis:6379}

x-postgresdb-client-env: &postgresdb-client-env
  PG_HOST: ${PG_HOST:-postgres}
  PG_PORT: ${PG_PORT:-5432}
  PG_DB: ${PG_DB:-placeos}
  PG_USER: ${POSTGRES_USER:-postgres}
  PG_PASSWORD: ${POSTGRES_PASSWORD:-password}
  PG_DATABASE: ${PG_DB:-placeos}
  PG_DATABASE_URL: ${PG_DATABASE_URL:-postgresql://placeos:development@postgres:5432/placeos}

x-search-ingest-client-env: &search-ingest-client-env
  PLACE_SEARCH_INGEST_URI: ${PLACE_SEARCH_INGEST_URI:-http://search-ingest:3000}
  RUBBER_SOUL_URI: ${RUBBER_SOUL_URI:-http://rubber-soul:3000}

x-search-ingest-service: &search-ingest-service ${PLACE_SEARCH_INGEST_IMAGE:-search-ingest}

x-smtp-client-env: &smtp-client-env
  SMTP_SERVER: ${SMTP_SERVER:-}
  SMTP_PORT: ${SMTP_PORT:-587}
  SMTP_USER: ${SMTP_USER:-} # username if required, will not authenticate if blank
  SMTP_PASS: ${SMTP_PASS:-} # password if required
  SMTP_SECURE: ${SMTP_SECURE:-} # blank for unsecure, `SMTPS` for TLS, `STARTTLS` for negotiating TLS on unsecure connection

x-network: &std-network
  networks:
    placeos:

x-logging: &std-logging
  logging:
    driver: json-file
    options:
      max-size: 99m

services:
  # Services

  rest-api: # Rest API
    image: ${PLACE_REST_API_REGISTRY:-docker.io}/placeos/rest-api:${PLACE_REST_API_TAG:-latest} 
    restart: always
    container_name: rest-api
    hostname: api # Retained as nginx upstream is `api`
    <<: [*std-network,*std-logging, *cap-drop]
    depends_on:
      - auth
      - elastic
      - redis
      - postgres
      - search-ingest
    env_file:
      - *jwt-public-key-env
      - *secret-key-env
    environment:
      <<: [*deployment-env,*opentelemetry-env,*elastic-client-env,*place-loader-client-env,*redis-client-env,*postgresdb-client-env,*search-ingest-client-env]
    deploy:
      resources:
        limits:
          memory: "2g"

  auth: # Authentication Service
    image: ${PLACE_AUTH_REGISTRY:-docker.io}/placeos/auth:${PLACE_AUTH_TAG:-latest}
    restart: always
    container_name: auth
    hostname: auth
    <<: [*std-network,*std-logging,*cap-drop]
    depends_on:
      - redis
      - postgres
    env_file:
      - *secret-key-env
    environment:
      <<: [*opentelemetry-env,*postgresdb-client-env,*redis-client-env]
      COAUTH_NO_SSL: "true"
      TZ: $TZ
      PLACE_URI: https://${PLACE_DOMAIN:-localhost:8443}
    deploy:
      resources:
        limits:
          memory: "500m"

  core: # Module coordinator
    image: ${PLACE_CORE_REGISTRY:-docker.io}/placeos/core:${PLACE_CORE_TAG:-latest}
    init: true # An init process prevents leaking of PlaceOS Driver processes
    restart: always
    container_name: core
    hostname: core
    <<: [*std-network,*std-logging,*cap-drop]
    depends_on:
      - redis
      - postgres
    volumes:
      - type: volume
        source: core-drivers
        target: /app/bin/drivers/
    env_file:
      - *secret-key-env
    ulimits:
      nofile: 40000
      core:
        soft: 0
        hard: 0
    environment:
      <<: [*deployment-env,*opentelemetry-env,*redis-client-env,*postgresdb-client-env]
    deploy:
      resources:
        limits:
          memory: "4g"

  edge: # Module coordinator
    image: ${PLACE_EDGE_REGISTRY:-docker.io}/placeos/edge:${PLACE_EDGE_TAG:-latest}
    restart: "no"
    container_name: edge
    hostname: edge
    <<: [*std-network,*std-logging,*cap-drop]
    depends_on:
      - core
    environment:
      <<: [*deployment-env,*edge-env]
    deploy:
      resources:
        limits:
          memory: "2g"

  frontend-loader: # Frontend deployment service
    image: ${PLACE_FRONTEND_LOADER_REGISTRY:-docker.io}/placeos/${PLACE_FRONTEND_LOADER_IMAGE:-frontend-loader}:${PLACE_FRONTEND_LOADER_TAG:-latest}
    restart: always
    container_name: frontend-loader
    hostname: frontend-loader
    <<: [*std-network,*std-logging,*cap-drop]
    volumes:
      - type: volume
        source: www
        target: /app/www
    depends_on:
      - postgres
    env_file:
      - *secret-key-env
    environment:
      <<: [*deployment-env,*opentelemetry-env,*postgresdb-client-env]
      PLACE_LOADER_WWW: www
    deploy:
      resources:
        limits:
          memory: "500m"

  source:
    image: ${PLACE_SOURCE_REGISTRY:-docker.io}/placeos/source:${PLACE_SOURCE_TAG:-latest}
    profiles:
      - analytics
    restart: always
    container_name: source
    hostname: source
    <<: [*std-network,*std-logging,*cap-drop]
    depends_on:
      - influxdb
      - redis
      - postgres
    env_file:
      - *influxdb-api-key
      - *secret-key-env
    environment:
      <<: [*deployment-env,*opentelemetry-env,*influxdb-client-env,*redis-client-env,*postgresdb-client-env]
    deploy:
      resources:
        limits:
          memory: "500m"

  triggers: # Conditional execution service
    image: ${PLACE_TRIGGERS_REGISTRY:-docker.io}/placeos/triggers:${PLACE_TRIGGERS_TAG:-latest}
    restart: always
    container_name: triggers
    hostname: triggers
    <<: [*std-network,*std-logging,*cap-drop]
    depends_on:
      - core
      - redis
      - postgres
    env_file:
      - *secret-key-env
    environment:
      <<: [*deployment-env,*opentelemetry-env,*redis-client-env,*postgresdb-client-env,*smtp-client-env]
    deploy:
      resources:
        limits:
          memory: "250m"

  staff-api: # Staff API
    image: ${PLACE_STAFF_API_REGISTRY:-docker.io}/placeos/staff-api:${PLACE_STAFF_API_TAG:-latest}
    container_name: staff-api
    hostname: staff # Retained as nginx upstream is `staff`
    restart: unless-stopped
    <<: [*std-network,*std-logging,*cap-drop]
    depends_on:
      - rest-api
      - postgres
    env_file:
      - *jwt-public-key-env
      - *secret-key-env
    environment:
      <<: [*opentelemetry-env,*redis-client-env,*postgresdb-client-env]
      SG_ENV: production
      STAFF_TIME_ZONE: $TZ
      PLACE_URI: "https://nginx"
      SSL_VERIFY_NONE: "true"
    deploy:
      resources:
        limits:
          memory: "2g"

  # Support

  init:
    image: ${PLACE_INIT_REGISTRY:-docker.io}/placeos/init:${PLACE_INIT_TAG:-latest}
    container_name: init
    restart: on-failure
    <<: [*std-network,*std-logging,*cap-drop]
    depends_on:
      postgres:
        condition: service_healthy
      #- search-ingest
    env_file:
      - *secret-key-env
    environment:
      <<: [*deployment-env,*opentelemetry-env,*postgresdb-client-env,*elastic-client-env]
      # User/Application Configuration
      PLACE_DOMAIN: ${PLACE_DOMAIN:-localhost:8443}
      PLACE_APPLICATION: ${PLACE_APPLICATION:-backoffice}
      PLACE_AUTH_HOST: ${PLACE_AUTH_HOST:-auth:8080}
      PLACE_USERNAME: ${PLACE_USERNAME:-Place Support (localhost:8443)}
      PLACE_EMAIL: ${PLACE_EMAIL:-support@place.tech}
      PLACE_PASSWORD: ${PLACE_PASSWORD:-development}
      PLACE_TLS: "${PLACE_TLS:-true}"

  search-ingest: # PostgreSQL to Elasticsearch Service
    image: ${PLACE_SEARCH_INGEST_REGISTRY:-docker.io}/placeos/${PLACE_SEARCH_INGEST_IMAGE:-search-ingest}:${PLACE_SEARCH_INGEST_TAG:-latest}
    restart: always
    container_name: *search-ingest-service
    hostname: *search-ingest-service
    <<: [*std-network,*std-logging,*cap-drop]
    depends_on:
      elastic:
        condition: service_healthy
      postgres:
        condition: service_healthy
    environment:
      <<: [*deployment-env,*opentelemetry-env,*postgresdb-client-env,*elastic-client-env]
    deploy:
      resources:
        limits:
          memory: "250m"

  dispatch: # Engine driver server registration and data routing
    image: ${PLACE_DISPATCH_REGISTRY:-docker.io}/placeos/dispatch:${PLACE_DISPATCH_TAG:-latest}
    restart: always
    container_name: dispatch
    hostname: dispatch
    depends_on:
      - nginx
    <<: [*std-network,*std-logging,*cap-drop]
    env_file:
      - *secret-key-env
    deploy:
      resources:
        limits:
          memory: "250m"

  # Resources

  postgres: # Database used by PgORM Models
    image: postgres:${POSTGRES_VERSION:-16-alpine}
    container_name: postgres
    hostname: postgres
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $POSTGRES_USER -d $PG_DB"]
      interval: 10s
      timeout: 5s
      retries: 5
    <<: [*std-network,*std-logging]
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      <<: *postgresdb-client-env
      TZ: $TZ
      POSTGRES_USER: $POSTGRES_USER
      POSTGRES_PASSWORD: $POSTGRES_PASSWORD
      POSTGRES_DB: $PG_DB
    deploy:
      resources:
        limits:
          memory: "4g"

  elastic:
    image: elasticsearch:${ELASTIC_VERSION:-8.14.3}
    restart: always
    container_name: elastic
    hostname: elastic
    healthcheck:
      test: curl --silent --fail localhost:9200/_cat/health
      start_period: 1m
    <<: [*std-network,*std-logging]
    volumes:
      - type: volume
        source: elastic-data
        target: /usr/share/elasticsearch/data
    environment:
      bootstrap.memory_lock: "true"
      cluster.routing.allocation.disk.threshold_enabled: "false"
      discovery.type: single-node
      TZ: $TZ
    deploy:
      resources:
        limits:
          memory: "2g"

  influxdb:
    image: influxdb:${INFLUXDB_IMAGE_TAG:-2.0.8-alpine}
    profiles:
      - analytics
    restart: always
    container_name: influx
    hostname: influx
    <<: [*std-network,*std-logging]
    healthcheck:
      test: influx bucket list
    volumes:
      - type: volume
        source: influx-data
        target: /root/.influxdbv2
    command: "--reporting-disabled"
    deploy:
      resources:
        limits:
          memory: "1g"

  chronograf:
    image: chronograf:${CHRONOGRAF_IMAGE_TAG:-1.9}
    profiles:
      - analytics
    restart: always
    container_name: chronograf
    hostname: chronograf
    <<: [*std-network,*std-logging]
    depends_on:
      - influxdb
    env_file:
      - *influxdb-api-key
      - .env.chronograf # Contains TOKEN_SECRET for OAuth integration
    environment:
      BASE_PATH: /analytics
      INFLUXDB_URL: $INFLUX_HOST
      INFLUXDB_ORG: $INFLUX_ORG
      GENERIC_CLIENT_ID: "COPY_ANALYTICS_CLIENT_ID_FROM_BACKOFFICE"
      GENERIC_CLIENT_SECRET: "COPY_ANALYTICS_CLIENT_SECRET_FROM_BACKOFFICE"
      GENERIC_AUTH_URL: "https://${PLACE_DOMAIN}/auth/oauth/authorize"
      GENERIC_TOKEN_URL: "https://${PLACE_DOMAIN}/auth/oauth/token"
      GENERIC_API_URL: "https://${PLACE_DOMAIN}/api/engine/v2/users/current"
      GENERIC_API_KEY: "email"
      GENERIC_SCOPES: "public"
      GENERIC_NAME: "PlaceOS"
      PUBLIC_URL: "https://${PLACE_DOMAIN}"
    deploy:
      resources:
        limits:
          memory: "250m"

  mosquitto:
    image: iegomez/mosquitto-go-auth:${MOSQUITTO_IMAGE_TAG:-latest}
    profiles:
      - analytics
    restart: always
    container_name: mosquitto
    hostname: mosquitto
    <<: [*std-network,*std-logging]
    depends_on:
      - nginx
    volumes:
      - ${PWD}/config/mosquitto/mosquitto.conf:/etc/mosquitto/mosquitto.conf
    environment:
      TZ: $TZ
    deploy:
      resources:
        limits:
          memory: "250m"

  nginx:
    image: ${PLACE_NGINX_REGISTRY:-docker.io}/placeos/nginx:${PLACE_NGINX_TAG:-latest}
    restart: always
    container_name: nginx
    hostname: nginx
    ports:
      - 8080:80
      - 8443:443
    healthcheck:
      # Check if the http port is open
      test: "bash -c ': &>/dev/null </dev/tcp/127.0.0.1/80'"
    <<: [*std-network,*std-logging]
    depends_on:
      - rest-api
      - auth
      - staff-api
    volumes:
      - type: volume
        source: www
        target: /etc/nginx/html/
        read_only: true
      - type: volume
        source: nginx-data
        target: /etc/nginx/ssl
    env_file:
      - *secret-key-env
      - *jwt-public-key-env
      - *influxdb-api-key
    environment:
      TZ: $TZ
      PLACE_DOMAIN: ${PLACE_DOMAIN:-localhost:8443}
    deploy:
      resources:
        limits:
          memory: "250m"

  redis:
    image: eqalpha/keydb
    restart: always
    container_name: redis
    hostname: redis
    healthcheck:
      test: keydb-cli ping
    <<: [*std-network,*std-logging]
    volumes:
      - type: volume
        source: redis-data
        target: /data
    environment:
      TZ: $TZ
    deploy:
      resources:
        limits:
          memory: "250m"

  minio:
    image: minio/minio
    profiles:
      - lgtm    
    entrypoint:
      - sh
      - -euc
      - |
        mkdir -p /data/loki-data && \
        mkdir -p /data/loki-ruler && \
        minio server /data
    environment:
      - MINIO_ROOT_USER=loki
      - MINIO_ROOT_PASSWORD=supersecret
      - MINIO_PROMETHEUS_AUTH_TYPE=public
      - MINIO_UPDATE=off
    ports:
      - 9000
    volumes:
      - minio:/data
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9000/minio/health/live" ]
      interval: 15s
      timeout: 20s
      retries: 5

  loki:
    image: grafana/loki:latest
    profiles:
      - lgtm        
    container_name: loki
    ports:
      - "3100:3100"
    <<: [*std-network,*std-logging]
    volumes:
      - ${PWD}/config/lgtm/loki-config.yaml:/etc/loki/config.yaml
    depends_on:
      - minio

  promtail:
    image: grafana/promtail:latest
    profiles:
      - lgtm        
    volumes:
      - ${PWD}/config/lgtm/promtail-config.yaml:/etc/promtail/config.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock
    <<: [*std-network,*std-logging]
    command: -config.file=/etc/promtail/config.yaml
    depends_on:
      - loki

  grafana:
    image: grafana/grafana:latest
    profiles:
      - lgtm        
    ports:
      - "3000:3000"
    environment:
      - GF_PATHS_PROVISIONING=/etc/grafana/provisioning
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
    <<: [*std-network,*std-logging]
    depends_on:
      - loki
    entrypoint:
      - sh
      - -euc
      - |
        mkdir -p /etc/grafana/provisioning/datasources
        cat <<EOF > /etc/grafana/provisioning/datasources/ds.yaml
        apiVersion: 1
        datasources:
          - name: Loki
            type: loki
            access: proxy
            url: http://loki:3100
        EOF
        /run.sh