diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..3256566 --- /dev/null +++ b/.env.example @@ -0,0 +1,6 @@ +# Optional nonsecret Compose setting; this is also the default when unset. +# Puppet/Hiera owns the deployed .env. Do not replace it with this example: +# Other applications and rollback still use its existing settings. +# Migrated application credentials live in the eleven service env files listed +# in README.md and are read with format: raw. +WEBHOSTING_ENV_DIR=/etc/webhosting diff --git a/.gitignore b/.gitignore index 4c49bd7..1a8ac72 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,3 @@ .env +.env.* +*.env diff --git a/README.md b/README.md new file mode 100644 index 0000000..6438d43 --- /dev/null +++ b/README.md @@ -0,0 +1,17 @@ +# WebHosting + +Shared web applications behind Nginx/Apache, deployed in `/opt/WebHosting`. + +- `docker-compose.yaml` combines `stacks//compose.yaml` into one Compose project. + Run commands from the repository root; relative paths resolve from there. +- Only Nginx publishes host ports (`80`/`443`) and joins `public` and `backend`. + Web applications share `backend`; databases use their separate application networks. + These are bridge networks with outbound access, without `internal: true`. +- Puppet manages secrets through `hiera/data-lx/default/lx-docker-01.psi.ch.yaml`. + The service env files live under `/etc/webhosting/`, separately from this repo. +- Env files are root-owned (`0600`, directories `0700`) and use `format: raw`: + keep values literal, without adding quotes or escaping dollar signs. + +Puppet must provision all required env files before Compose validation or deployment. +Use `config --quiet` to avoid printing secrets. After an update, check the application; +if its container IP changed, validate and reload Nginx using the host's deployment procedure. diff --git a/conf.d/elog-lmx.conf b/conf.d/elog-lmx.conf index a720b23..b182c86 100644 --- a/conf.d/elog-lmx.conf +++ b/conf.d/elog-lmx.conf @@ -7,13 +7,12 @@ server { server { listen 443 ssl; server_name elog-lmx.psi.ch; - - client_max_body_size 64M; + + client_max_body_size 0; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; - types_hash_max_size 4096; ssl_certificate /etc/nginx/certs/elog-lmx.psi.ch.crt; ssl_certificate_key /etc/nginx/private/elog-lmx.psi.ch.key; diff --git a/docker-compose.yaml b/docker-compose.yaml index 006c2ab..6086d7d 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -1,537 +1,43 @@ -services: - # linux-eng@psi.ch - # Reverse Proxy handling all HTTP/HTTPS requests - # Only container that is exposed to the network - # Communication to other services is trough docker network - nginx: - image: nginx:latest - container_name: nginx_proxy - restart: always - ports: - - "80:80" - - "443:443" - volumes: - - /etc/letsencrypt/live:/etc/letsencrypt/live:ro - - /etc/letsencrypt/archive:/etc/letsencrypt/archive:ro - - /etc/pki/tls/certs:/etc/nginx/certs:ro - - /etc/pki/tls/private:/etc/nginx/private:ro - - /etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro - - /etc/nginx/conf.d:/etc/nginx/conf.d:ro - - /opt/webcontent/sinqstatus-test:/opt/webcontent/sinqstatus-test:ro - - /opt/webcontent/it-strategy-dashboard/frontend/:/opt/webcontent/it-strategy-dashboard/:ro - networks: - - public - - backend - - # rfwtools - # gfa-status-test - # fluid-eos - # spaceweather - apache: - image: gitea.psi.ch/images/php-apache:latest - container_name: apache_app - restart: always - volumes: - - /opt/webcontent/rfmwtools:/var/www/rfmwtools:ro - - /opt/webcontent/cas-status:/var/www/cas-status:rw - - /opt/webcontent/fluid-eos:/var/www/fluid-eos:rw - - /opt/webcontent/sls2:/var/www/sls2:rw - - /opt/webcontent/megwiki:/var/www/megwiki:rw - - /opt/webcontent/sinqimaging:/var/www/sinqimaging:rw - - /opt/webcontent/omny:/var/www/omny:rw - - /mount/srem/webhosting:/var/www/srem:rw - - ./apache/conf:/etc/apache2/sites-enabled:ro - networks: - - backend - - legacy_scheduleit: - # image: gitea.psi.ch/images/php-apache:latest - image: gitea.psi.ch/images/legacy_scheduleit:latest - restart: always - container_name: legacy-scheduleit - volumes: - - /opt/webcontent/lbr-scheduler/code:/var/www/lbr-scheduler:rw - - /opt/webcontent/lbr-scheduler/apache/conf:/etc/apache2/sites-enabled:ro - networks: - - backend - - # linux-eng@psi.ch - # Test app - excalidraw: - image: excalidraw/excalidraw:latest - container_name: excalidraw - restart: always - networks: - - backend - - # benjamin.brem@psi.ch - LAC - # Elog instance - lac-elog: - image: gitea.psi.ch/images/elog:3.1.5 - container_name: lac-elog - restart: always - volumes: - - /opt/logbooks/lac:/usr/local/elog/logbooks - - /opt/webcontent/lac/elog.cfg:/usr/local/elog/elogd.cfg - networks: - - backend - - # valerio.scagnoli@psi.ch - LMX - # Elog instance - lmx-elog: - image: gitea.psi.ch/images/elog:3.1.5 - container_name: lmx-elog - restart: always - volumes: - - /opt/logbooks/lmx:/usr/local/elog/logbooks - - /opt/webcontent/lmx/passwd.txt:/usr/local/elog/passwd.txt - - /opt/webcontent/lmx/elog.cfg:/usr/local/elog/elogd.cfg - networks: - - backend - - # Rostomyan Tigran - # INC0137443 - # Elog instance - pif-elog: - image: gitea.psi.ch/images/elog:3.1.5 - container_name: pif-elog - restart: always - volumes: - - /opt/logbooks/pif:/usr/local/elog/logbooks - - /opt/webcontent/pif/elog.cfg:/usr/local/elog/elogd.cfg - networks: - - backend - - # Krieger Jonas Andreas , Raselli Andrea-Raeto - # Elog as a Service PoC mit musr-elog.psi.ch? linux-eng@psi.ch - lmu-elog: - image: gitea.psi.ch/images/elog:3.1.5 - container_name: lmu-elog - restart: always - volumes: - - /opt/logbooks/LMU:/usr/local/elog/logbooks - - /opt/webcontent/LMU/elog.cfg:/usr/local/elog/elogd.cfg - networks: - - backend - - # PEPISCO - # PhotoElectron PhotoIon Spectral COmpendium - pepisco: - image: gitea.psi.ch/images/pepisco:v2026.03.13 - container_name: pepisco-test - restart: always - networks: - - backend - - # Romain Sacchi - swiss-ecargo: - image: gitea.psi.ch/sacchi_r/swiss-ecargo:0.1.2 - container_name: swiss-ecargo - restart: always - environment: - - HOSTED_API_KEY=${ecargo_api_key} - networks: - - backend - - # Augustin Sven - # POC for SiwssFel - hedgedoc_app: - image: quay.io/hedgedoc/hedgedoc:latest - container_name: hedgedoc - environment: - - CMD_DB_URL=postgres://${hedgedoc_user}:${hedgedoc_password}@hedgedoc_db:5432/hedgedoc - - CMD_DOMAIN=hedgedoc.psi.ch - - CMD_URL_ADDPORT=false - - CMD_PROTOCOL_USESSL=true - - CMD_LDAP_URL=ldaps://dc00.d.psi.ch - - CMD_LDAP_BINDDN=${bind_user} - - CMD_LDAP_BINDCREDENTIALS=${bind_password} - - CMD_LDAP_SEARCHBASE=OU=users,OU=psi,DC=d,DC=psi,DC=ch - - CMD_LDAP_SEARCHFILTER=(&(objectcategory=person)(objectclass=user)(|(sAMAccountName={{username}})(mail={{username}}))) - - CMD_LDAP_USERIDFIELD=sAMAccountName - - CMD_LDAP_PROVIDERNAME="PSI" - - NODE_ENV=production - - CMD_EMAIL=false - - CMD_ALLOW_EMAIL_REGISTER=false - - CMD_SESSION_SECRET=${session_secret} - volumes: - - /opt/webcontent/sf-hedgedoc/uploads:/hedgedoc/public/uploads - restart: always - depends_on: - - hedgedoc_db - networks: - - backend - - hedgedoc_backend - - # Augustin Sven - hedgedoc_db: - image: postgres:13.4-alpine - container_name: hedgedoc_db - environment: - - POSTGRES_USER={{ hedgedoc_user }} - - POSTGRES_PASSWORD={{ hedgedoc_password }} - - POSTGRES_DB=hedgedoc - volumes: - - /opt/webcontent/sf-hedgedoc/data:/var/lib/postgresql/data - restart: always - networks: - - hedgedoc_backend - - # Flechsig Uwe - # opticswiki - # webcontent: - # lx-fs-01.psi.ch:/lx_webhosting - opticswiki: - image: gitea.psi.ch/images/opticswiki:1.8 - container_name: opticswiki - restart: always - volumes: - - /opt/webcontent/opticswiki/data:/usr/local/apache2/wiki/data - - /opt/webcontent/opticswiki/pub:/usr/local/apache2/wiki/pub - - /opt/webcontent/opticswiki/working:/usr/local/apache2/wiki/working - - /opt/webcontent/opticswiki/lib:/usr/local/apache2/wiki/lib - - /opt/webcontent/opticswiki/conf:/usr/local/apache2/conf - - /opt/webcontent/opticswiki/htdocs:/usr/local/apache2/htdocs - - /opt/webcontent/opticswiki/log:/var/log/apache2 - networks: - - backend - - # Flechsig Uwe - # slsbl - # webcontent: - # lx-fs-01.psi.ch:/lx_webhosting - slsbl: - image: gitea.psi.ch/images/slsbl:1.0 - container_name: slsbl - restart: always - volumes: - - /opt/webcontent/slsbl/cgi-bin:/usr/local/apache2/cgi-bin - - /opt/webcontent/slsbl/conf:/usr/local/apache2/conf - - /opt/webcontent/slsbl/htdocs:/usr/local/apache2/htdocs - - /opt/webcontent/slsbl/log:/var/log/apache2 - networks: - - backend - - # Angelo Sozzi INC0150655 angelo.sozzi@psi.ch - # POC Software - might be installed on docker-dmz - n8n: - image: docker.n8n.io/n8nio/n8n - container_name: n8n - restart: always - environment: - - N8N_HOST=n8n - - N8N_PORT=5678 - - N8N_PROTOCOL=http - - NODE_ENV=production - - WEBHOOK_URL=https://n8n.psi.ch - - GENERIC_TIMEZONE=Europe/Zurich - - DB_SQLITE_POOL_SIZE=4 - - N8N_RUNNERS_ENABLED=true - volumes: - - /opt/webcontent/n8n/n8n_data:/home/node/.n8n - - /opt/webcontent/n8n/local_files:/files - networks: - - backend - - # Ritter Tom - # It-Strategy monitoring dashboard - - it-strategy-dashboard-frontend: - image: gitea.psi.ch/9501/it-strategy-dashboard-frontend:4.0.4 - container_name: it-strategy-dashboard-frontend - command: ["sh", "-c", "/usr/local/bin/copyData.sh"] - volumes: - - /opt/webcontent/it-strategy-dashboard/frontend:/opt/webcontent/it-strategy-dashboard/frontend - restart: "no" - networks: - - it_strategy_dashboard_backend - - it-strategy-dashboard-backend: - image: gitea.psi.ch/9501/it-strategy-dashboard-backend:4.0.5 - container_name: it-strategy-dashboard-backend - restart: always - environment: - - DB_HOST=it-strategy-dashboard-db - - DB_PORT=3306 - - DB_NAME=itstrategy - - DB_USER=${IT_DASHBOARD_DB_USER} - - DB_PASS=${IT_DASHBOARD_DB_PW} - - JWT_SECRET=${JWT_SECRET} - - ADMIN_PW_HASH=${ADMIN_PW_HASH} - depends_on: - it-strategy-dashboard-db: - condition: service_healthy - networks: - - it_strategy_dashboard_backend - - backend - - it-strategy-dashboard-db: - image: mariadb:12 - container_name: it-strategy-dashboard-db - restart: always - environment: - - MYSQL_ROOT_PASSWORD=${IT_DASHBOARD_DB_ROOT_PW} - - MYSQL_DATABASE=itstrategy - - MYSQL_USER=${IT_DASHBOARD_DB_USER} - - MYSQL_PASSWORD=${IT_DASHBOARD_DB_PW} - volumes: - - /opt/webcontent/it-strategy-dashboard/mysql/data:/var/lib/mysql - depends_on: - it-strategy-dashboard-frontend: - condition: service_completed_successfully - networks: - - it_strategy_dashboard_backend - healthcheck: - test: - [ - "CMD", - "mariadb-admin", - "ping", - "-h", - "localhost", - "-u${IT_DASHBOARD_DB_USER}", - "-p${IT_DASHBOARD_DB_PW}", - ] - interval: 2s - timeout: 5s - retries: 5 - - # Christoph Hug , Simon Suter - # Panda-Maintenance (OpenMaint) - panda-maintenance-db: - image: postgis/postgis:17-3.5-alpine - container_name: panda-maintenance-db - volumes: - - /opt/webcontent/panda-maintenance/data:/var/lib/postgresql/data:rw - environment: - - POSTGRES_USER=postgres - - POSTGRES_PASSWORD=${PANDA_MAINTENANCE_DB_PW} - restart: always - mem_limit: 4000m - mem_reservation: 2000m - healthcheck: - test: ["CMD-SHELL", "pg_isready -U postgres"] - interval: 30s - timeout: 10s - retries: 3 - start_period: 80s - networks: - - panda_maintenance_backend - panda-maintenance-app: - image: itmicus/cmdbuild:om-2.4-4.1.0 - container_name: panda-maintenance-app - links: - - panda-maintenance-db - depends_on: - panda-maintenance-db: - condition: service_healthy - restart: always - volumes: - - /opt/webcontent/panda-maintenance/docker-entrypoint.sh:/usr/local/bin/docker-entrypoint.sh:ro - environment: - - POSTGRES_USER=postgres - - POSTGRES_PASSWORD=${PANDA_MAINTENANCE_DB_PW} - - POSTGRES_PORT=5432 - - POSTGRES_HOST=panda-maintenance-db - - POSTGRES_DB=openmaint - - CMDBUILD_DUMP=empty.dump.xz - - JAVA_OPTS=-Xmx6000m -Xms3000m - mem_limit: 6000m - mem_reservation: 3500m - healthcheck: - test: ["CMD", "curl", "-f", "-L", "http://localhost:8080/cmdbuild/ui"] - interval: 30s - timeout: 10s - retries: 5 - start_period: 120s - networks: - - backend - - panda_maintenance_backend - - # michael.schmidt@psi.ch - # SAP Archiv Programm von der Firma KGS supportabteilung@kgs-software.com - tiacore-test: - container_name: tiacore-test - image: images.kgs-cloud.de/tia/core/saphttp:3.17.1 - restart: always - volumes: - - /opt/webcontent/tiacore-test/config/license:/application/license - - /opt/webcontent/tiacore-test/config/keystore:/application/ssl - - /opt/webcontent/tiacore-test/config:/application/config/ - - /mount/saparchive/testdata:/application/data - environment: - LOGGING_LEVEL_ROOT: INFO - # Authentifizierung für WebUI - WEBAPP_SECURITY_AUTH_BASIC_USERNAME: psiadmin - WEBAPP_SECURITY_AUTH_BASIC_PASSWORD: "$$2y$$10$$LA.TjBKRIDM/c6AJ86BZ/elpa9InzVbzqzLsyfc1Wt7h3S3N8MUPm" - networks: - - backend - - # michael.schmidt@psi.ch - # SAP Archiv Programm von der Firma KGS supportabteilung@kgs-software.com - tiacore-prod: - container_name: tiacore-prod - image: images.kgs-cloud.de/tia/core/saphttp:3.17.1 - restart: always - volumes: - - /opt/webcontent/tiacore-prod/config/license:/application/license - - /opt/webcontent/tiacore-prod/config/keystore:/application/ssl - - /opt/webcontent/tiacore-prod/config:/application/config/ - - /mount/saparchive/proddata:/application/data - environment: - LOGGING_LEVEL_ROOT: INFO - # Authentifizierung für WebUI - WEBAPP_SECURITY_AUTH_BASIC_USERNAME: psiadmin - WEBAPP_SECURITY_AUTH_BASIC_PASSWORD: "$$2y$$10$$LA.TjBKRIDM/c6AJ86BZ/elpa9InzVbzqzLsyfc1Wt7h3S3N8MUPm" - networks: - - backend - - # michael.schmidt@psi.ch - # SAP Document Router von der Firma KGS supportabteilung@kgs-software.com - documentrouter-prod: - container_name: tiadocrouter-prod - image: images.kgs-cloud.de/tia-documentrouter/tia-documentrouter:5.2.0 - restart: always - volumes: - - /opt/webcontent/tiadocrouter-prod/work:/application/work - - /opt/webcontent/tiadocrouter-prod/input:/application/input - - /opt/webcontent/tiadocrouter-prod/log:/application/log - - /opt/webcontent/tiadocrouter-prod/lib:/application/lib - - /opt/webcontent/tiadocrouter-prod/config:/application/config - environment: - LOGGING_LEVEL_ROOT: INFO - # Authentifizierung für WebUI - WEBAPP_SECURITY_AUTH_BASIC_USERNAME: psiadmin - WEBAPP_SECURITY_AUTH_BASIC_PASSWORD: "$$2y$$10$$LA.TjBKRIDM/c6AJ86BZ/elpa9InzVbzqzLsyfc1Wt7h3S3N8MUPm" - CLASSPATH: "/application/lib/sapjco3.jar" - LD_LIBRARY_PATH: "/usr/glibc-compat/lib:/application/lib" - networks: - - backend - banf-fetcher-prod: - container_name: banf-fetcher-prod - image: python:3.12 - restart: always - volumes: - - /opt/webcontent/tiadocrouter-prod/banf-data:/data - - /opt/webcontent/tiadocrouter-prod/input:/data/banf-dr - environment: - - SCP_HOST=filetransfer.openordering.de - - SCP_PORT=22 - - SCP_USER=PSIProduktiv - - SCP_PASSWORD=${BANF_FETCHER_PROD_PASSWORD} - - SCP_REMOTE_DIR=Anlagen - - SCP_HOSTKEY_FINGERPRINT="ssh-rsa 1024 fingerprint" - command: > - sh -c "pip install paramiko scp lxml && - while true; do python /data/script/banf_ftpload_convert.py; sleep 120; done" - - # michael.schmidt@psi.ch - # SAP Document Router von der Firma KGS supportabteilung@kgs-software.com - documentrouter-test: - container_name: tiadocrouter-test - image: images.kgs-cloud.de/tia-documentrouter/tia-documentrouter:5.2.0 - restart: always - volumes: - - /opt/webcontent/tiadocrouter-test/work:/application/work - - /opt/webcontent/tiadocrouter-test/input:/application/input - - /opt/webcontent/tiadocrouter-test/log:/application/log - - /opt/webcontent/tiadocrouter-test/lib:/application/lib - - /opt/webcontent/tiadocrouter-test/config:/application/config - environment: - LOGGING_LEVEL_ROOT: INFO - # Authentifizierung für WebUI - WEBAPP_SECURITY_AUTH_BASIC_USERNAME: psiadmin - WEBAPP_SECURITY_AUTH_BASIC_PASSWORD: "$$2y$$10$$LA.TjBKRIDM/c6AJ86BZ/elpa9InzVbzqzLsyfc1Wt7h3S3N8MUPm" - CLASSPATH: "/application/lib/sapjco3.jar" - LD_LIBRARY_PATH: "/usr/glibc-compat/lib:/application/lib" - - networks: - - backend - banf-fetcher-test: - container_name: banf-fetcher-test - image: python:3.12 - restart: always - volumes: - - /opt/webcontent/tiadocrouter-test/banf-data:/data - - /opt/webcontent/tiadocrouter-test/input:/data/banf-dr - environment: - - SCP_HOST=filetransfer.test.openordering.de - - SCP_PORT=22 - - SCP_USER=PSITest - - SCP_PASSWORD=${BANF_FETCHER_TEST_PASSWORD} - - SCP_REMOTE_DIR=Anlagen - - SCP_HOSTKEY_FINGERPRINT="ssh-rsa 1024 fingerprint" - command: > - sh -c "pip install paramiko scp lxml && - while true; do python /data/script/banf_ftpload_convert.py; sleep 120; done" - - # Lange Clemens - # summer-project-selection.psi.ch - summer-project-selection: - image: gitea.psi.ch/lange_c/summer-project-selection:latest - restart: always - volumes: - - /opt/webcontent/summer-project-selection/data:/app/data - - /opt/webcontent/summer-project-selection/projects:/app/projects - - /opt/webcontent/summer-project-selection/applicants:/app/applicants - networks: - - backend - - # Tomcat Beamline Wiki INC0159147 tomcatwiki.psi.ch - # goran.lovric@psi.ch - tomcatwikidb: - image: postgres:15-alpine - container_name: tomcatwiki_db - restart: always - environment: - - POSTGRES_DB=wiki - - POSTGRES_PASSWORD=${TOMCATWIKI_DB_SECRET} - - POSTGRES_USER=wiki - volumes: - - /opt/webcontent/tomcatwiki/db-data:/var/lib/postgresql/data - networks: - - tomcatwiki_backend - - tomcatwiki: - image: ghcr.io/requarks/wiki:2 - container_name: tomcatwiki - restart: always - depends_on: - - tomcatwikidb - environment: - - DB_TYPE=postgres - - DB_HOST=tomcatwikidb - - DB_PORT=5432 - - DB_USER=wiki - - DB_PASS=${TOMCATWIKI_DB_SECRET} - - DB_NAME=wiki - networks: - - tomcatwiki_backend - - backend - - scicat-rocrate-dev: - image: gitea.psi.ch/data-catalog-services/scicat-rocrate:2.6.0 - container_name: scicat-rocrate-dev - restart: always - networks: - - backend - environment: - - QUARKUS_REST_CLIENT_SCICAT_URL=https://scicat.development.psi.ch - - QUARKUS_REST_CLIENT_S3BROKER_URL=https://scicat-s3-broker.development.psi.ch - - QUARKUS_HTTP_LIMITS_MAX_BODY_SIZE=10G - volumes: - - /opt/webcontent/rocrate-dev/dev:/ro-crate:rw - - # Aimo Altorfer / Roger Kalt - RF - # rf-pikett.psi.ch - Pikettlischte Beautifier - # Image is built from https://gitea.psi.ch/RF/pikettlischte-beautifier - pikettlischte-beautifier: - image: gitea.psi.ch/rf/pikettlischte-beautifier:latest - container_name: pikettlischte-beautifier - restart: always - networks: - - backend +# Requires Docker Compose 2.30.0 or later (raw service env files). +# Run Compose from this directory to keep the existing project and .env. +# All modules resolve relative paths and their default .env from this root. +include: + - path: stacks/proxy/compose.yaml + project_directory: . + - path: stacks/legacy-web/compose.yaml + project_directory: . + - path: stacks/excalidraw/compose.yaml + project_directory: . + - path: stacks/elog/compose.yaml + project_directory: . + - path: stacks/pepisco/compose.yaml + project_directory: . + - path: stacks/swiss-ecargo/compose.yaml + project_directory: . + - path: stacks/hedgedoc/compose.yaml + project_directory: . + - path: stacks/opticswiki/compose.yaml + project_directory: . + - path: stacks/slsbl/compose.yaml + project_directory: . + - path: stacks/n8n/compose.yaml + project_directory: . + - path: stacks/dashboard/compose.yaml + project_directory: . + - path: stacks/panda-maintenance/compose.yaml + project_directory: . + - path: stacks/sap/compose.yaml + project_directory: . + - path: stacks/summer-project-selection/compose.yaml + project_directory: . + - path: stacks/tomcatwiki/compose.yaml + project_directory: . + - path: stacks/scicat-rocrate/compose.yaml + project_directory: . + - path: stacks/pikettlischte-beautifier/compose.yaml + project_directory: . +# Network definitions remain shared by the single Compose project. networks: public: backend: diff --git a/stacks/dashboard/compose.yaml b/stacks/dashboard/compose.yaml new file mode 100644 index 0000000..12bd763 --- /dev/null +++ b/stacks/dashboard/compose.yaml @@ -0,0 +1,63 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Ritter Tom + # It-Strategy monitoring dashboard + + it-strategy-dashboard-frontend: + image: gitea.psi.ch/9501/it-strategy-dashboard-frontend:4.0.4 + container_name: it-strategy-dashboard-frontend + command: ["sh", "-c", "/usr/local/bin/copyData.sh"] + volumes: + - /opt/webcontent/it-strategy-dashboard/frontend:/opt/webcontent/it-strategy-dashboard/frontend + restart: "no" + networks: + - it_strategy_dashboard_backend + + it-strategy-dashboard-backend: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/dashboard/backend.env + required: true + format: raw + image: gitea.psi.ch/9501/it-strategy-dashboard-backend:4.0.5 + container_name: it-strategy-dashboard-backend + restart: always + environment: + - DB_HOST=it-strategy-dashboard-db + - DB_PORT=3306 + - DB_NAME=itstrategy + depends_on: + it-strategy-dashboard-db: + condition: service_healthy + networks: + - it_strategy_dashboard_backend + - backend + + it-strategy-dashboard-db: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/dashboard/db.env + required: true + format: raw + image: mariadb:12 + container_name: it-strategy-dashboard-db + restart: always + environment: + - MYSQL_DATABASE=itstrategy + volumes: + - /opt/webcontent/it-strategy-dashboard/mysql/data:/var/lib/mysql + depends_on: + it-strategy-dashboard-frontend: + condition: service_completed_successfully + networks: + - it_strategy_dashboard_backend + healthcheck: + # Authenticate over TCP; do not embed the password in the command arguments. + test: + - CMD-SHELL + - >- + MYSQL_PWD="$${MYSQL_PASSWORD}" mariadb --protocol=TCP + -h 127.0.0.1 -u "$${MYSQL_USER}" "$${MYSQL_DATABASE}" + -e 'SELECT 1' >/dev/null + interval: 10s + timeout: 5s + retries: 5 + start_period: 30s diff --git a/stacks/elog/compose.yaml b/stacks/elog/compose.yaml new file mode 100644 index 0000000..ae89900 --- /dev/null +++ b/stacks/elog/compose.yaml @@ -0,0 +1,51 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # benjamin.brem@psi.ch - LAC + # Elog instance + lac-elog: + image: gitea.psi.ch/images/elog:3.1.5 + container_name: lac-elog + restart: always + volumes: + - /opt/logbooks/lac:/usr/local/elog/logbooks + - /opt/webcontent/lac/elog.cfg:/usr/local/elog/elogd.cfg + networks: + - backend + + # valerio.scagnoli@psi.ch - LMX + # Elog instance + lmx-elog: + image: gitea.psi.ch/images/elog:3.1.5 + container_name: lmx-elog + restart: always + volumes: + - /opt/logbooks/lmx:/usr/local/elog/logbooks + - /opt/webcontent/lmx/passwd.txt:/usr/local/elog/passwd.txt + - /opt/webcontent/lmx/elog.cfg:/usr/local/elog/elogd.cfg + networks: + - backend + + # Rostomyan Tigran + # INC0137443 + # Elog instance + pif-elog: + image: gitea.psi.ch/images/elog:3.1.5 + container_name: pif-elog + restart: always + volumes: + - /opt/logbooks/pif:/usr/local/elog/logbooks + - /opt/webcontent/pif/elog.cfg:/usr/local/elog/elogd.cfg + networks: + - backend + + # Krieger Jonas Andreas , Raselli Andrea-Raeto + # Elog as a Service PoC mit musr-elog.psi.ch? linux-eng@psi.ch + lmu-elog: + image: gitea.psi.ch/images/elog:3.1.5 + container_name: lmu-elog + restart: always + volumes: + - /opt/logbooks/LMU:/usr/local/elog/logbooks + - /opt/webcontent/LMU/elog.cfg:/usr/local/elog/elogd.cfg + networks: + - backend diff --git a/stacks/excalidraw/compose.yaml b/stacks/excalidraw/compose.yaml new file mode 100644 index 0000000..acbbfbc --- /dev/null +++ b/stacks/excalidraw/compose.yaml @@ -0,0 +1,10 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # linux-eng@psi.ch + # Test app + excalidraw: + image: excalidraw/excalidraw:latest + container_name: excalidraw + restart: always + networks: + - backend diff --git a/stacks/hedgedoc/compose.yaml b/stacks/hedgedoc/compose.yaml new file mode 100644 index 0000000..62b9d1e --- /dev/null +++ b/stacks/hedgedoc/compose.yaml @@ -0,0 +1,58 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Augustin Sven + # POC for SiwssFel + hedgedoc_app: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/hedgedoc/app.env + required: true + format: raw + image: quay.io/hedgedoc/hedgedoc:latest + container_name: hedgedoc + environment: + - CMD_DB_DIALECT=postgres + - CMD_DB_HOST=hedgedoc_db + - CMD_DB_PORT=5432 + - CMD_DB_DATABASE=hedgedoc + - CMD_DOMAIN=hedgedoc.psi.ch + - CMD_URL_ADDPORT=false + - CMD_PROTOCOL_USESSL=true + - CMD_LDAP_URL=ldaps://dc00.d.psi.ch + - CMD_LDAP_SEARCHBASE=OU=users,OU=psi,DC=d,DC=psi,DC=ch + - CMD_LDAP_SEARCHFILTER=(&(objectcategory=person)(objectclass=user)(|(sAMAccountName={{username}})(mail={{username}}))) + - CMD_LDAP_USERIDFIELD=sAMAccountName + - CMD_LDAP_PROVIDERNAME=PSI + - NODE_ENV=production + - CMD_EMAIL=false + - CMD_ALLOW_EMAIL_REGISTER=false + volumes: + - /opt/webcontent/sf-hedgedoc/uploads:/hedgedoc/public/uploads + restart: always + depends_on: + hedgedoc_db: + condition: service_healthy + networks: + - backend + - hedgedoc_backend + + # Augustin Sven + hedgedoc_db: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/hedgedoc/db.env + required: true + format: raw + image: postgres:13.4-alpine + container_name: hedgedoc_db + environment: + - POSTGRES_DB=hedgedoc + volumes: + - /opt/webcontent/sf-hedgedoc/data:/var/lib/postgresql/data + restart: always + healthcheck: + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""] + interval: 10s + timeout: 5s + retries: 5 + start_period: 30s + networks: + - hedgedoc_backend diff --git a/stacks/legacy-web/compose.yaml b/stacks/legacy-web/compose.yaml new file mode 100644 index 0000000..1029d51 --- /dev/null +++ b/stacks/legacy-web/compose.yaml @@ -0,0 +1,33 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # rfwtools + # gfa-status-test + # fluid-eos + # spaceweather + apache: + image: gitea.psi.ch/images/php-apache:latest + container_name: apache_app + restart: always + volumes: + - /opt/webcontent/rfmwtools:/var/www/rfmwtools:ro + - /opt/webcontent/cas-status:/var/www/cas-status:rw + - /opt/webcontent/fluid-eos:/var/www/fluid-eos:rw + - /opt/webcontent/sls2:/var/www/sls2:rw + - /opt/webcontent/megwiki:/var/www/megwiki:rw + - /opt/webcontent/sinqimaging:/var/www/sinqimaging:rw + - /opt/webcontent/omny:/var/www/omny:rw + - /mount/srem/webhosting:/var/www/srem:rw + - ./apache/conf:/etc/apache2/sites-enabled:ro + networks: + - backend + + legacy_scheduleit: + # image: gitea.psi.ch/images/php-apache:latest + image: gitea.psi.ch/images/legacy_scheduleit:latest + restart: always + container_name: legacy-scheduleit + volumes: + - /opt/webcontent/lbr-scheduler/code:/var/www/lbr-scheduler:rw + - /opt/webcontent/lbr-scheduler/apache/conf:/etc/apache2/sites-enabled:ro + networks: + - backend diff --git a/stacks/n8n/compose.yaml b/stacks/n8n/compose.yaml new file mode 100644 index 0000000..57e1b11 --- /dev/null +++ b/stacks/n8n/compose.yaml @@ -0,0 +1,22 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Angelo Sozzi INC0150655 angelo.sozzi@psi.ch + # POC Software - might be installed on docker-dmz + n8n: + image: docker.n8n.io/n8nio/n8n + container_name: n8n + restart: always + environment: + - N8N_HOST=n8n + - N8N_PORT=5678 + - N8N_PROTOCOL=http + - NODE_ENV=production + - WEBHOOK_URL=https://n8n.psi.ch + - GENERIC_TIMEZONE=Europe/Zurich + - DB_SQLITE_POOL_SIZE=4 + - N8N_RUNNERS_ENABLED=true + volumes: + - /opt/webcontent/n8n/n8n_data:/home/node/.n8n + - /opt/webcontent/n8n/local_files:/files + networks: + - backend diff --git a/stacks/opticswiki/compose.yaml b/stacks/opticswiki/compose.yaml new file mode 100644 index 0000000..665c81a --- /dev/null +++ b/stacks/opticswiki/compose.yaml @@ -0,0 +1,20 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Flechsig Uwe + # opticswiki + # webcontent: + # lx-fs-01.psi.ch:/lx_webhosting + opticswiki: + image: gitea.psi.ch/images/opticswiki:1.8 + container_name: opticswiki + restart: always + volumes: + - /opt/webcontent/opticswiki/data:/usr/local/apache2/wiki/data + - /opt/webcontent/opticswiki/pub:/usr/local/apache2/wiki/pub + - /opt/webcontent/opticswiki/working:/usr/local/apache2/wiki/working + - /opt/webcontent/opticswiki/lib:/usr/local/apache2/wiki/lib + - /opt/webcontent/opticswiki/conf:/usr/local/apache2/conf + - /opt/webcontent/opticswiki/htdocs:/usr/local/apache2/htdocs + - /opt/webcontent/opticswiki/log:/var/log/apache2 + networks: + - backend diff --git a/stacks/panda-maintenance/compose.yaml b/stacks/panda-maintenance/compose.yaml new file mode 100644 index 0000000..2d9a639 --- /dev/null +++ b/stacks/panda-maintenance/compose.yaml @@ -0,0 +1,59 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Christoph Hug , Simon Suter + # Panda-Maintenance (OpenMaint) + panda-maintenance-db: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/panda-maintenance/db.env + required: true + format: raw + image: postgis/postgis:17-3.5-alpine + container_name: panda-maintenance-db + volumes: + - /opt/webcontent/panda-maintenance/data:/var/lib/postgresql/data:rw + environment: + - POSTGRES_USER=postgres + restart: always + mem_limit: 4000m + mem_reservation: 2000m + healthcheck: + test: ["CMD-SHELL", "pg_isready -U postgres"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 80s + networks: + - panda_maintenance_backend + panda-maintenance-app: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/panda-maintenance/app.env + required: true + format: raw + image: itmicus/cmdbuild:om-2.4-4.1.0 + container_name: panda-maintenance-app + links: + - panda-maintenance-db + depends_on: + panda-maintenance-db: + condition: service_healthy + restart: always + volumes: + - /opt/webcontent/panda-maintenance/docker-entrypoint.sh:/usr/local/bin/docker-entrypoint.sh:ro + environment: + - POSTGRES_USER=postgres + - POSTGRES_PORT=5432 + - POSTGRES_HOST=panda-maintenance-db + - POSTGRES_DB=openmaint + - CMDBUILD_DUMP=empty.dump.xz + - JAVA_OPTS=-Xmx6000m -Xms3000m + mem_limit: 6000m + mem_reservation: 3500m + healthcheck: + test: ["CMD", "curl", "-f", "-L", "http://localhost:8080/cmdbuild/ui"] + interval: 30s + timeout: 10s + retries: 5 + start_period: 120s + networks: + - backend + - panda_maintenance_backend diff --git a/stacks/pepisco/compose.yaml b/stacks/pepisco/compose.yaml new file mode 100644 index 0000000..1a7a9fb --- /dev/null +++ b/stacks/pepisco/compose.yaml @@ -0,0 +1,10 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # PEPISCO + # PhotoElectron PhotoIon Spectral COmpendium + pepisco: + image: gitea.psi.ch/images/pepisco:v2026.03.13 + container_name: pepisco-test + restart: always + networks: + - backend diff --git a/stacks/pikettlischte-beautifier/compose.yaml b/stacks/pikettlischte-beautifier/compose.yaml new file mode 100644 index 0000000..115f55e --- /dev/null +++ b/stacks/pikettlischte-beautifier/compose.yaml @@ -0,0 +1,11 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Aimo Altorfer / Roger Kalt - RF + # rf-pikett.psi.ch - Pikettlischte Beautifier + # Image is built from https://gitea.psi.ch/RF/pikettlischte-beautifier + pikettlischte-beautifier: + image: gitea.psi.ch/rf/pikettlischte-beautifier:latest + container_name: pikettlischte-beautifier + restart: always + networks: + - backend diff --git a/stacks/proxy/compose.yaml b/stacks/proxy/compose.yaml new file mode 100644 index 0000000..8caae65 --- /dev/null +++ b/stacks/proxy/compose.yaml @@ -0,0 +1,25 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # linux-eng@psi.ch + # Reverse Proxy handling all HTTP/HTTPS requests + # Only container that is exposed to the network + # Communication to other services is trough docker network + nginx: + image: nginx:latest + container_name: nginx_proxy + restart: always + ports: + - "80:80" + - "443:443" + volumes: + - /etc/letsencrypt/live:/etc/letsencrypt/live:ro + - /etc/letsencrypt/archive:/etc/letsencrypt/archive:ro + - /etc/pki/tls/certs:/etc/nginx/certs:ro + - /etc/pki/tls/private:/etc/nginx/private:ro + - /etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro + - /etc/nginx/conf.d:/etc/nginx/conf.d:ro + - /opt/webcontent/sinqstatus-test:/opt/webcontent/sinqstatus-test:ro + - /opt/webcontent/it-strategy-dashboard/frontend/:/opt/webcontent/it-strategy-dashboard/:ro + networks: + - public + - backend diff --git a/stacks/sap/compose.yaml b/stacks/sap/compose.yaml new file mode 100644 index 0000000..03848ba --- /dev/null +++ b/stacks/sap/compose.yaml @@ -0,0 +1,124 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # michael.schmidt@psi.ch + # SAP Archiv Programm von der Firma KGS supportabteilung@kgs-software.com + tiacore-test: + container_name: tiacore-test + image: images.kgs-cloud.de/tia/core/saphttp:3.17.1 + restart: always + volumes: + - /opt/webcontent/tiacore-test/config/license:/application/license + - /opt/webcontent/tiacore-test/config/keystore:/application/ssl + - /opt/webcontent/tiacore-test/config:/application/config/ + - /mount/saparchive/testdata:/application/data + environment: + LOGGING_LEVEL_ROOT: INFO + # Authentifizierung für WebUI + WEBAPP_SECURITY_AUTH_BASIC_USERNAME: psiadmin + WEBAPP_SECURITY_AUTH_BASIC_PASSWORD: "$$2y$$10$$LA.TjBKRIDM/c6AJ86BZ/elpa9InzVbzqzLsyfc1Wt7h3S3N8MUPm" + networks: + - backend + + # michael.schmidt@psi.ch + # SAP Archiv Programm von der Firma KGS supportabteilung@kgs-software.com + tiacore-prod: + container_name: tiacore-prod + image: images.kgs-cloud.de/tia/core/saphttp:3.17.1 + restart: always + volumes: + - /opt/webcontent/tiacore-prod/config/license:/application/license + - /opt/webcontent/tiacore-prod/config/keystore:/application/ssl + - /opt/webcontent/tiacore-prod/config:/application/config/ + - /mount/saparchive/proddata:/application/data + environment: + LOGGING_LEVEL_ROOT: INFO + # Authentifizierung für WebUI + WEBAPP_SECURITY_AUTH_BASIC_USERNAME: psiadmin + WEBAPP_SECURITY_AUTH_BASIC_PASSWORD: "$$2y$$10$$LA.TjBKRIDM/c6AJ86BZ/elpa9InzVbzqzLsyfc1Wt7h3S3N8MUPm" + networks: + - backend + + # michael.schmidt@psi.ch + # SAP Document Router von der Firma KGS supportabteilung@kgs-software.com + documentrouter-prod: + container_name: tiadocrouter-prod + image: images.kgs-cloud.de/tia-documentrouter/tia-documentrouter:5.2.0 + restart: always + volumes: + - /opt/webcontent/tiadocrouter-prod/work:/application/work + - /opt/webcontent/tiadocrouter-prod/input:/application/input + - /opt/webcontent/tiadocrouter-prod/log:/application/log + - /opt/webcontent/tiadocrouter-prod/lib:/application/lib + - /opt/webcontent/tiadocrouter-prod/config:/application/config + environment: + LOGGING_LEVEL_ROOT: INFO + # Authentifizierung für WebUI + WEBAPP_SECURITY_AUTH_BASIC_USERNAME: psiadmin + WEBAPP_SECURITY_AUTH_BASIC_PASSWORD: "$$2y$$10$$LA.TjBKRIDM/c6AJ86BZ/elpa9InzVbzqzLsyfc1Wt7h3S3N8MUPm" + CLASSPATH: "/application/lib/sapjco3.jar" + LD_LIBRARY_PATH: "/usr/glibc-compat/lib:/application/lib" + networks: + - backend + banf-fetcher-prod: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/sap/banf-prod.env + required: true + format: raw + container_name: banf-fetcher-prod + image: python:3.12 + restart: always + volumes: + - /opt/webcontent/tiadocrouter-prod/banf-data:/data + - /opt/webcontent/tiadocrouter-prod/input:/data/banf-dr + environment: + - SCP_HOST=filetransfer.openordering.de + - SCP_PORT=22 + - SCP_USER=PSIProduktiv + - SCP_REMOTE_DIR=Anlagen + - SCP_HOSTKEY_FINGERPRINT="ssh-rsa 1024 fingerprint" + command: > + sh -c "pip install paramiko scp lxml && + while true; do python /data/script/banf_ftpload_convert.py; sleep 120; done" + + # michael.schmidt@psi.ch + # SAP Document Router von der Firma KGS supportabteilung@kgs-software.com + documentrouter-test: + container_name: tiadocrouter-test + image: images.kgs-cloud.de/tia-documentrouter/tia-documentrouter:5.2.0 + restart: always + volumes: + - /opt/webcontent/tiadocrouter-test/work:/application/work + - /opt/webcontent/tiadocrouter-test/input:/application/input + - /opt/webcontent/tiadocrouter-test/log:/application/log + - /opt/webcontent/tiadocrouter-test/lib:/application/lib + - /opt/webcontent/tiadocrouter-test/config:/application/config + environment: + LOGGING_LEVEL_ROOT: INFO + # Authentifizierung für WebUI + WEBAPP_SECURITY_AUTH_BASIC_USERNAME: psiadmin + WEBAPP_SECURITY_AUTH_BASIC_PASSWORD: "$$2y$$10$$LA.TjBKRIDM/c6AJ86BZ/elpa9InzVbzqzLsyfc1Wt7h3S3N8MUPm" + CLASSPATH: "/application/lib/sapjco3.jar" + LD_LIBRARY_PATH: "/usr/glibc-compat/lib:/application/lib" + + networks: + - backend + banf-fetcher-test: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/sap/banf-test.env + required: true + format: raw + container_name: banf-fetcher-test + image: python:3.12 + restart: always + volumes: + - /opt/webcontent/tiadocrouter-test/banf-data:/data + - /opt/webcontent/tiadocrouter-test/input:/data/banf-dr + environment: + - SCP_HOST=filetransfer.test.openordering.de + - SCP_PORT=22 + - SCP_USER=PSITest + - SCP_REMOTE_DIR=Anlagen + - SCP_HOSTKEY_FINGERPRINT="ssh-rsa 1024 fingerprint" + command: > + sh -c "pip install paramiko scp lxml && + while true; do python /data/script/banf_ftpload_convert.py; sleep 120; done" diff --git a/stacks/scicat-rocrate/compose.yaml b/stacks/scicat-rocrate/compose.yaml new file mode 100644 index 0000000..b00509d --- /dev/null +++ b/stacks/scicat-rocrate/compose.yaml @@ -0,0 +1,14 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + scicat-rocrate-dev: + image: gitea.psi.ch/data-catalog-services/scicat-rocrate:2.6.0 + container_name: scicat-rocrate-dev + restart: always + networks: + - backend + environment: + - QUARKUS_REST_CLIENT_SCICAT_URL=https://scicat.development.psi.ch + - QUARKUS_REST_CLIENT_S3BROKER_URL=https://scicat-s3-broker.development.psi.ch + - QUARKUS_HTTP_LIMITS_MAX_BODY_SIZE=10G + volumes: + - /opt/webcontent/rocrate-dev/dev:/ro-crate:rw diff --git a/stacks/slsbl/compose.yaml b/stacks/slsbl/compose.yaml new file mode 100644 index 0000000..6748d96 --- /dev/null +++ b/stacks/slsbl/compose.yaml @@ -0,0 +1,17 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Flechsig Uwe + # slsbl + # webcontent: + # lx-fs-01.psi.ch:/lx_webhosting + slsbl: + image: gitea.psi.ch/images/slsbl:1.0 + container_name: slsbl + restart: always + volumes: + - /opt/webcontent/slsbl/cgi-bin:/usr/local/apache2/cgi-bin + - /opt/webcontent/slsbl/conf:/usr/local/apache2/conf + - /opt/webcontent/slsbl/htdocs:/usr/local/apache2/htdocs + - /opt/webcontent/slsbl/log:/var/log/apache2 + networks: + - backend diff --git a/stacks/summer-project-selection/compose.yaml b/stacks/summer-project-selection/compose.yaml new file mode 100644 index 0000000..d978db1 --- /dev/null +++ b/stacks/summer-project-selection/compose.yaml @@ -0,0 +1,13 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Lange Clemens + # summer-project-selection.psi.ch + summer-project-selection: + image: gitea.psi.ch/lange_c/summer-project-selection:latest + restart: always + volumes: + - /opt/webcontent/summer-project-selection/data:/app/data + - /opt/webcontent/summer-project-selection/projects:/app/projects + - /opt/webcontent/summer-project-selection/applicants:/app/applicants + networks: + - backend diff --git a/stacks/swiss-ecargo/compose.yaml b/stacks/swiss-ecargo/compose.yaml new file mode 100644 index 0000000..6f5f7b7 --- /dev/null +++ b/stacks/swiss-ecargo/compose.yaml @@ -0,0 +1,13 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Romain Sacchi + swiss-ecargo: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/swiss-ecargo/app.env + required: true + format: raw + image: gitea.psi.ch/sacchi_r/swiss-ecargo:0.1.2 + container_name: swiss-ecargo + restart: always + networks: + - backend diff --git a/stacks/tomcatwiki/compose.yaml b/stacks/tomcatwiki/compose.yaml new file mode 100644 index 0000000..8ad4851 --- /dev/null +++ b/stacks/tomcatwiki/compose.yaml @@ -0,0 +1,46 @@ +# Included by ../../docker-compose.yaml; use the root Compose entrypoint. +services: + # Tomcat Beamline Wiki INC0159147 tomcatwiki.psi.ch + # goran.lovric@psi.ch + tomcatwikidb: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/tomcatwiki/db.env + required: true + format: raw + image: postgres:15-alpine + container_name: tomcatwiki_db + restart: always + environment: + - POSTGRES_DB=wiki + - POSTGRES_USER=wiki + volumes: + - /opt/webcontent/tomcatwiki/db-data:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""] + interval: 10s + timeout: 5s + retries: 5 + start_period: 30s + networks: + - tomcatwiki_backend + + tomcatwiki: + env_file: + - path: ${WEBHOSTING_ENV_DIR:-/etc/webhosting}/tomcatwiki/app.env + required: true + format: raw + image: ghcr.io/requarks/wiki:2 + container_name: tomcatwiki + restart: always + depends_on: + tomcatwikidb: + condition: service_healthy + environment: + - DB_TYPE=postgres + - DB_HOST=tomcatwikidb + - DB_PORT=5432 + - DB_USER=wiki + - DB_NAME=wiki + networks: + - tomcatwiki_backend + - backend