WebHosting_DMZ/docker-compose.yaml

services:
  # linux-eng@psi.ch
  nginx:
    image: gitea.psi.ch/images/nginx:1.29.8
    container_name: nginx_proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /etc/letsencrypt/live:/etc/letsencrypt/live:ro
      - /etc/letsencrypt/archive:/etc/letsencrypt/archive:ro
      - /etc/pki/tls/certs:/etc/nginx/certs:ro
      - /etc/pki/tls/private:/etc/nginx/private:ro
      - /etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - /etc/nginx/conf.d:/etc/nginx/conf.d:ro
      - /opt/webcontent/sinqstatus:/opt/webcontent/sinqstatus:ro
      - /mount/actris:/opt/webcontent/actris:ro
      - /opt/webcontent/DMZ:/opt/webcontent/DMZ:rw
    networks:
      - public
      - backend

  # rfwtools
  # gfa-status-test
  apache:
    image: gitea.psi.ch/images/php-apache:latest
    container_name: apache_app
    restart: always
    volumes:
      - /opt/webcontent/DMZ/rfmwtools:/var/www/rfmwtools:ro
      - /opt/webcontent/DMZ/fluid-eos:/var/www/fluid-eos:rw
      - /opt/webcontent/DMZ/cas-status:/var/www/cas_status:rw
      - /mount/srem/webhosting:/var/www/srem:rw
      - /mount/webhosting_dmz_write/tcpwiki:/var/www/tcpwiki:rw
      - /mount/webhosting_dmz_write/dokuwiki-core:/var/www/dokuwiki-core:r
      - /mount/webhosting_dmz_write/omny:/var/www/omny:rw
      - ./apache/conf:/etc/apache2/sites-enabled:ro
    networks:
      - backend

  # MCDA Calculator Huang He <river.huang@psi.ch>
  mcda-calculator:
    image: gitea.psi.ch/images/mcda-calculator:1.0.3
    container_name: mcda-calculator
    restart: always
    networks:
      - backend

  # MCDA DSS Huang He <river.huang@psi.ch>
  mcda-dss:
    image: gitea.psi.ch/images/mcda-dss:0.5.0
    container_name: mcda-dss
    restart: always
    networks:
      - backend

  # MCDA SRF Huang He <river.huang@psi.ch>
  mcda-srf:
    image: gitea.psi.ch/images/mcda-srf:1.0.0
    container_name: mcda-srf
    restart: always
    networks:
      - backend

  # River Huang <river.huang@psi.ch>
  # UP-MAVT-Suite
  up-mavt-suite-mongo:
    image: mongo:7.0
    container_name: up-mavt-suite-mongo
    environment:
      MONGO_INITDB_DATABASE: elicitation
    volumes:
      - /opt/webcontent/up-mavt-suite/mongo-data:/data/db
    networks:
      - up_mavt_suite_network
    restart: always

  up-mavt-suite-backend:
    image: gitea.psi.ch/images/up-mavt-suite-backend:0.9.8
    container_name: up-mavt-suite-backend
    environment:
      MONGO_URI: mongodb://up-mavt-suite-mongo:27017/elicitation
      FLASK_ENV: production
      ADMIN_PASSWORD: ${MCDA_UP_ADMIN_PASSWORD}
      OAUTH2_CLIENT_SECRET: ${MCDA_OAUTH2_SECRET}
      SMTP_HOST: smtp.office365.com
      SMTP_PORT: 587
      SMTP_USER: mcda@psi.ch
      EMAIL_AUTH_MODE: oauth2
      OAUTH2_TENANT_ID: 50f89ee2-f910-47c5-9913-a6ea08928f11
      OAUTH2_CLIENT_ID: 201ba262-3c76-41fb-8942-dcefb7729caa
      OAUTH2_SCOPE: https://outlook.office365.com/.default
      OAUTH2_USERNAME: mcda@psi.ch
      SMTP_USE_TLS: true
      EMAIL_FROM: mcda@psi.ch
      APP_BASE_URL: https://mcda-up.psi.ch/
    depends_on:
      - up-mavt-suite-mongo
    networks:
      - up_mavt_suite_network
      - backend
    restart: always

  up-mavt-suite-worker:
    image: gitea.psi.ch/images/up-mavt-suite-worker:0.9.8
    container_name: up-mavt-suite-worker
    environment:
      MONGO_URI: mongodb://up-mavt-suite-mongo:27017/elicitation
    depends_on:
      - up-mavt-suite-mongo
    networks:
      - up_mavt_suite_network
    restart: always

  up-mavt-suite-frontend:
    image: gitea.psi.ch/images/up-mavt-suite-frontend:0.9.8
    container_name: up-mavt-suite-frontend
    environment:
      VITE_DEBUG_CONSOLE: true
    depends_on:
      - up-mavt-suite-backend
    networks:
      - up_mavt_suite_network
      - backend
    restart: always

  # MCDA PCT tool
  # River Huang <river.huang@psi.ch>
  mcda-pct:
    image: gitea.psi.ch/images/mcda-pct:0.2.0
    container_name: mcda-pct
    restart: always
    networks:
      - backend

  # Romain Sacchi <romain.sacchi@psi.ch>
  swiss-ecargo:
    image: gitea.psi.ch/sacchi_r/swiss-ecargo:0.1.2
    container_name: swiss-ecargo
    restart: always
    environment:
      - HOSTED_API_KEY=${ecargo_api_key}
    networks:
      - backend

  # Enea Zeolla <enea.zeolla@psi.ch>
  drsa-tiermaker:
    image: gitea.psi.ch/images/drsa-tiermaker:0.1.5
    container_name: drsa-tiermaker
    restart: always
    depends_on:
      drsa-tiermaker-db:
        condition: service_healthy
    environment:
      - DATABASE_URL=postgresql+psycopg2://${DRSA_TIERMAKER_DB_USER}:${DRSA_TIERMAKER_DB_PW}@drsa-tiermaker-db:5432/drsa_tiermaker
      - SECRET_KEY=${DRSA_TIERMAKER_SECRET_KEY}
      - FIRST_ADMIN_EMAIL=mcda@psi.ch
      - FIRST_ADMIN_PASSWORD=${DRSA_TIERMAKER_ADMIN_PW}
      - ENVIRONMENT=production
      - COOKIE_SECURE=true
      - DRSA_ENGINE=builtin
      - WEB_CONCURRENCY=2
      - CORS_ORIGINS=${DRSA_TIERMAKER_URL}
      - APP_BASE_URL=${DRSA_TIERMAKER_URL}
      - OAUTH2_CLIENT_SECRET= ${MCDA_OAUTH2_SECRET}
      - SMTP_HOST= smtp.office365.com
      - SMTP_PORT= 587
      - SMTP_USER= mcda@psi.ch
      - EMAIL_AUTH_MODE= oauth2
      - OAUTH2_TENANT_ID= 50f89ee2-f910-47c5-9913-a6ea08928f11
      - OAUTH2_CLIENT_ID= 201ba262-3c76-41fb-8942-dcefb7729caa
      - OAUTH2_SCOPE= https://outlook.office365.com/.default
      - OAUTH2_USERNAME= mcda@psi.ch
      - SMTP_USE_TLS= true
      - EMAIL_FROM= mcda@psi.ch
    networks:
      - backend
      - drsa_tiermaker_backend

  # Enea Zeolla <enea.zeolla@psi.ch>
  drsa-tiermaker-db:
    image: postgres:16-alpine
    container_name: drsa-tiermaker-db
    restart: always
    environment:
      - POSTGRES_USER=${DRSA_TIERMAKER_DB_USER}
      - POSTGRES_PASSWORD=${DRSA_TIERMAKER_DB_PW}
      - POSTGRES_DB=drsa_tiermaker
    volumes:
      - /mount/webhosting_dmz_write/drsa-tiermaker/db-data:/var/lib/postgresql/data
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U ${DRSA_TIERMAKER_DB_USER} -d drsa_tiermaker",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - drsa_tiermaker_backend

  # Lange Clemens <clemens.lange@psi.ch>
  # summer-project-selection.psi.ch
  summer-project-selection:
    image: gitea.psi.ch/lange_c/summer-project-selection:latest
    container_name: summer-project-selection
    restart: always
    volumes:
      - /mount/webhosting_dmz_write/summer-project-selection/data:/app/data
      - /opt/webcontent/DMZ/summer-project-selection/projects:/app/projects
      - /opt/webcontent/DMZ/summer-project-selection/applicants:/app/applicants
    networks:
      - backend

  # PEPISCO <andras.boedi@psi.ch> <patrick.hemberger@psi.ch>
  # PhotoElectron PhotoIon Spectral COmpendium
  pepisco:
    image: gitea.psi.ch/images/pepisco:v2026.03.13
    container_name: pepisco
    restart: always
    networks:
      - backend

  # Only on rhodo_network. The `backend` alias is required because
  # the frontend image's internal nginx uses http://backend:8000/
  rhodo-backend:
    image: gitea.psi.ch/images/grn_opsins-backend:1.2.0
    container_name: rhodo-backend
    restart: always
    networks:
      rhodo_network:
        aliases:
          - backend

  rhodo-frontend:
    image: gitea.psi.ch/images/grn_opsins-frontend:1.2.0
    container_name: rhodo-frontend
    restart: always
    depends_on:
      - rhodo-backend
    networks:
      - rhodo_network
      - backend

  scicat-rocrate-qa:
    image: gitea.psi.ch/data-catalog-services/scicat-rocrate:2.6.5-rc-ra-ingest.1
    container_name: scicat-rocrate-qa
    restart: always
    networks:
      - backend
    environment:
      - QUARKUS_REST_CLIENT_SCICAT_URL=https://dacat-qa.psi.ch
      - QUARKUS_REST_CLIENT_S3BROKER_URL=https://scicat-s3-broker.qa.psi.ch
      - QUARKUS_HTTP_LIMITS_MAX_BODY_SIZE=10G
      - SCICAT_PID_PREFIX=20.500.11935
      - QUARKUS_LOG_FILE_ENABLE=true
      - QUARKUS_LOG_FILE_PATH=/rocrate/scicat-rocrate-qa.log
    volumes:
      - /mount/rocrate_qa:/rocrate:rw

  # LEAPS ultrafast frithjof.nolting@psi.ch
  felira-web:
    image: gitea.psi.ch/leaps/leaps-felira:3.0.3
    container_name: felira-web
    restart: always
    # volumes:
    #   - /mount/webhosting_dmz_write/leaps/web:/var/www/html:rw
    depends_on:
      - felira-db
    networks:
      - backend
      - leaps_db
    environment:
      - DB_DATABASE=felira_leaps_ultrafast
      - DB_USERNAME=felira_leaps_ultrafast
      - DB_PASSWORD=${LEAPS_DB_PW}
  felira-db:
    image: mariadb:latest
    container_name: felira-db
    restart: always
    environment:
      - MARIADB_ROOT_PASSWORD=${LEAPS_DB_PW}
      - MARIADB_DATABASE=felira_leaps_ultrafast
      - MARIADB_USER=felira_leaps_ultrafast
      - MARIADB_PASSWORD=${LEAPS_DB_PW}
    volumes:
      - /mount/webhosting_dmz_write/leaps/db_data:/var/lib/mysql
      - /mount/webhosting_dmz_write/leaps/init-db:/docker-entrypoint-initdb.d:ro
    networks:
      - leaps_db

networks:
  public:
  backend:
  up_mavt_suite_network:
  rhodo_network:
  leaps_db: