From 7676b00d4e53ecad426e400922be538aeba786a6 Mon Sep 17 00:00:00 2001
From: romainsacchi <r_s@me.com>
Date: Fri, 4 Sep 2026 12:47:50 +0200
Subject: [PATCH] Add CLIC stack to DMZ hosting

---
 conf.d/clic.conf    |  27 +++++++++++
 docker-compose.yaml | 112 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 139 insertions(+)
 create mode 100644 conf.d/clic.conf

diff --git a/conf.d/clic.conf b/conf.d/clic.conf
new file mode 100644
index 0000000..3af2b1e
--- /dev/null
+++ b/conf.d/clic.conf
@@ -0,0 +1,27 @@
+server {
+    listen 80;
+    server_name clic.psi.ch;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name clic.psi.ch;
+
+    ssl_certificate /etc/nginx/certs/lx-docker-dmz-01.psi.ch.crt;
+    ssl_certificate_key /etc/nginx/private/lx-docker-dmz-01.psi.ch.key;
+
+    client_max_body_size 100m;
+    proxy_connect_timeout 60s;
+    proxy_send_timeout 300s;
+    proxy_read_timeout 300s;
+
+    location / {
+        proxy_pass http://clic-web:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+    }
+}
diff --git a/docker-compose.yaml b/docker-compose.yaml
index b8dac51..073d430 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -144,6 +144,117 @@ services:
     networks:
       - backend
 
+  # Romain Sacchi <romain.sacchi@psi.ch>
+  # CLIC Django platform
+  clic-web:
+    image: ${CLIC_IMAGE:-gitea.psi.ch/sacchi_r/clic:f6f0ed5}
+    container_name: clic-web
+    restart: always
+    env_file:
+      - /opt/webcontent/clic/clic.env
+    environment:
+      - DJANGO_SETTINGS_MODULE=config.settings.production
+      - POSTGRES_HOST=clic-db
+      - POSTGRES_PORT=5432
+      - CLIC_CACHE_BACKEND=redis
+      - CLIC_REDIS_URL=redis://clic-redis:6379/0
+      - CLIC_REQUIRE_SHARED_CACHE=1
+    volumes:
+      - /opt/webcontent/clic/media:/app/media
+      - /opt/webcontent/clic/impact_factors:/app/data/impact_factors:ro
+    depends_on:
+      clic-db:
+        condition: service_healthy
+      clic-redis:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/live/', timeout=5)"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - backend
+      - clic_backend
+
+  clic-package-exports:
+    image: ${CLIC_IMAGE:-gitea.psi.ch/sacchi_r/clic:f6f0ed5}
+    container_name: clic-package-exports
+    restart: always
+    env_file:
+      - /opt/webcontent/clic/clic.env
+    environment:
+      - DJANGO_SETTINGS_MODULE=config.settings.production
+      - POSTGRES_HOST=clic-db
+      - POSTGRES_PORT=5432
+      - CLIC_CACHE_BACKEND=redis
+      - CLIC_REDIS_URL=redis://clic-redis:6379/0
+      - CLIC_REQUIRE_SHARED_CACHE=1
+    volumes:
+      - /opt/webcontent/clic/media:/app/media
+      - /opt/webcontent/clic/impact_factors:/app/data/impact_factors:ro
+    entrypoint: ["/bin/sh", "-c"]
+    command: exec python manage.py process_package_exports
+    depends_on:
+      clic-db:
+        condition: service_healthy
+      clic-redis:
+        condition: service_started
+    networks:
+      - clic_backend
+
+  clic-brightway-json-exports:
+    image: ${CLIC_IMAGE:-gitea.psi.ch/sacchi_r/clic:f6f0ed5}
+    container_name: clic-brightway-json-exports
+    restart: always
+    env_file:
+      - /opt/webcontent/clic/clic.env
+    environment:
+      - DJANGO_SETTINGS_MODULE=config.settings.production
+      - POSTGRES_HOST=clic-db
+      - POSTGRES_PORT=5432
+      - CLIC_CACHE_BACKEND=redis
+      - CLIC_REDIS_URL=redis://clic-redis:6379/0
+      - CLIC_REQUIRE_SHARED_CACHE=1
+    volumes:
+      - /opt/webcontent/clic/media:/app/media
+      - /opt/webcontent/clic/impact_factors:/app/data/impact_factors:ro
+    entrypoint: ["/bin/sh", "-c"]
+    command: exec python manage.py process_brightway_json_exports --skip-checks --sleep "${CLIC_API_EXPORT_POLL_SECONDS:-2}"
+    depends_on:
+      clic-db:
+        condition: service_healthy
+      clic-redis:
+        condition: service_started
+    networks:
+      - clic_backend
+
+  clic-db:
+    image: postgres:16
+    container_name: clic-db
+    restart: always
+    env_file:
+      - /opt/webcontent/clic/clic.env
+    volumes:
+      - /opt/webcontent/clic/postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - clic_backend
+
+  clic-redis:
+    image: redis:7-alpine
+    container_name: clic-redis
+    restart: always
+    command: ["redis-server", "--appendonly", "yes"]
+    volumes:
+      - /opt/webcontent/clic/redis:/data
+    networks:
+      - clic_backend
+
   # Enea Zeolla <enea.zeolla@psi.ch>
   drsa-tiermaker:
     image: gitea.psi.ch/images/drsa-tiermaker:0.2.3
@@ -311,6 +422,7 @@ services:
 networks:
   public:
   backend:
+  clic_backend:
   up_mavt_suite_network:
   rhodo_network:
   leaps_db: