WebHosting_DMZ/docker-compose.yaml

services:
  # linux-eng@psi.ch
  nginx:
    image: gitea.psi.ch/images/nginx:1.29.8
    container_name: nginx_proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /etc/letsencrypt/live:/etc/letsencrypt/live:ro
      - /etc/letsencrypt/archive:/etc/letsencrypt/archive:ro
      - /etc/pki/tls/certs:/etc/nginx/certs:ro
      - /etc/pki/tls/private:/etc/nginx/private:ro
      - /etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - /etc/nginx/conf.d:/etc/nginx/conf.d:ro
      - /opt/webcontent/sinqstatus:/opt/webcontent/sinqstatus:ro
      - /mount/actris:/opt/webcontent/actris:ro
      - /opt/webcontent/DMZ:/opt/webcontent/DMZ:rw
    networks:
      - public
      - backend

  # rfwtools
  # gfa-status-test
  apache:
    image: gitea.psi.ch/images/php-apache:latest
    container_name: apache_app
    restart: always
    volumes:
      - /opt/webcontent/DMZ/rfmwtools:/var/www/rfmwtools:ro
      - /opt/webcontent/DMZ/fluid-eos:/var/www/fluid-eos:rw
      - /opt/webcontent/DMZ/cas-status:/var/www/cas_status:rw
      - /mount/srem/webhosting:/var/www/srem:rw
      - /mount/webhosting_dmz_write/tcpwiki:/var/www/tcpwiki:rw
      - /mount/webhosting_dmz_write/dokuwiki-core:/var/www/dokuwiki-core:r
      - /mount/webhosting_dmz_write/omny:/var/www/omny:rw
      - ./apache/conf:/etc/apache2/sites-enabled:ro
    networks:
      - backend

  # MCDA Calculator Huang He <river.huang@psi.ch>
  mcda-calculator:
    image: gitea.psi.ch/images/mcda-calculator:1.0.3
    container_name: mcda-calculator
    restart: always
    networks:
      - backend

  # MCDA DSS Huang He <river.huang@psi.ch>
  mcda-dss:
    image: gitea.psi.ch/images/mcda-dss:0.5.0
    container_name: mcda-dss
    restart: always
    networks:
      - backend

  # MCDA SRF Huang He <river.huang@psi.ch>
  mcda-srf:
    image: gitea.psi.ch/images/mcda-srf:1.0.3
    container_name: mcda-srf
    restart: always
    networks:
      - backend

  # River Huang <river.huang@psi.ch>
  # UP-MAVT-Suite
  up-mavt-suite-mongo:
    image: mongo:7.0
    container_name: up-mavt-suite-mongo
    environment:
      MONGO_INITDB_DATABASE: elicitation
    volumes:
      - /opt/webcontent/up-mavt-suite/mongo-data:/data/db
    networks:
      - up_mavt_suite_network
    restart: always

  up-mavt-suite-backend:
    image: gitea.psi.ch/images/up-mavt-suite-backend:0.9.8
    container_name: up-mavt-suite-backend
    environment:
      MONGO_URI: mongodb://up-mavt-suite-mongo:27017/elicitation
      FLASK_ENV: production
      ADMIN_PASSWORD: ${MCDA_UP_ADMIN_PASSWORD}
      OAUTH2_CLIENT_SECRET: ${MCDA_OAUTH2_SECRET}
      SMTP_HOST: smtp.office365.com
      SMTP_PORT: 587
      SMTP_USER: mcda@psi.ch
      EMAIL_AUTH_MODE: oauth2
      OAUTH2_TENANT_ID: 50f89ee2-f910-47c5-9913-a6ea08928f11
      OAUTH2_CLIENT_ID: 201ba262-3c76-41fb-8942-dcefb7729caa
      OAUTH2_SCOPE: https://outlook.office365.com/.default
      OAUTH2_USERNAME: mcda@psi.ch
      SMTP_USE_TLS: true
      EMAIL_FROM: mcda@psi.ch
      APP_BASE_URL: https://mcda-up.psi.ch/
    depends_on:
      - up-mavt-suite-mongo
    networks:
      - up_mavt_suite_network
      - backend
    restart: always

  up-mavt-suite-worker:
    image: gitea.psi.ch/images/up-mavt-suite-worker:0.9.8
    container_name: up-mavt-suite-worker
    environment:
      MONGO_URI: mongodb://up-mavt-suite-mongo:27017/elicitation
    depends_on:
      - up-mavt-suite-mongo
    networks:
      - up_mavt_suite_network
    restart: always

  up-mavt-suite-frontend:
    image: gitea.psi.ch/images/up-mavt-suite-frontend:0.9.8
    container_name: up-mavt-suite-frontend
    environment:
      VITE_DEBUG_CONSOLE: true
    depends_on:
      - up-mavt-suite-backend
    networks:
      - up_mavt_suite_network
      - backend
    restart: always

  # MCDA PCT tool
  # River Huang <river.huang@psi.ch>
  mcda-pct:
    image: gitea.psi.ch/images/mcda-pct:0.2.0
    container_name: mcda-pct
    restart: always
    networks:
      - backend

  # Romain Sacchi <romain.sacchi@psi.ch>
  swiss-ecargo:
    image: gitea.psi.ch/sacchi_r/swiss-ecargo:0.1.2
    container_name: swiss-ecargo
    restart: always
    environment:
      - HOSTED_API_KEY=${ecargo_api_key}
    networks:
      - backend

  # Romain Sacchi <romain.sacchi@psi.ch>
  # CLIC Django platform
  clic-web:
    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:754f9f8}
    container_name: clic-web
    restart: always
    env_file:
      - /mount/webhosting_dmz_write/clic/clic.env
    environment:
      - DJANGO_SETTINGS_MODULE=config.settings.production
      - POSTGRES_HOST=clic-db
      - POSTGRES_PORT=5432
      - CLIC_CACHE_BACKEND=redis
      - CLIC_REDIS_URL=redis://clic-redis:6379/0
      - CLIC_REQUIRE_SHARED_CACHE=1
    volumes:
      - /mount/webhosting_dmz_write/clic/media:/app/media
      - /mount/webhosting_dmz_write/clic/impact_factors:/app/data/impact_factors:ro
    depends_on:
      clic-db:
        condition: service_healthy
      clic-redis:
        condition: service_started
    healthcheck:
      # Match the public host and proxy scheme while probing the local listener.
      test:
        - CMD
        - python
        - -c
        - "import urllib.request; r = urllib.request.Request('http://127.0.0.1:8000/health/live/', headers={'Host': 'clic.psi.ch', 'X-Forwarded-Proto': 'https'}); urllib.request.urlopen(r, timeout=5)"
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - backend
      - clic_backend

  clic-package-exports:
    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:754f9f8}
    container_name: clic-package-exports
    restart: always
    env_file:
      - /mount/webhosting_dmz_write/clic/clic.env
    environment:
      - DJANGO_SETTINGS_MODULE=config.settings.production
      - POSTGRES_HOST=clic-db
      - POSTGRES_PORT=5432
      - CLIC_CACHE_BACKEND=redis
      - CLIC_REDIS_URL=redis://clic-redis:6379/0
      - CLIC_REQUIRE_SHARED_CACHE=1
    volumes:
      - /mount/webhosting_dmz_write/clic/media:/app/media
      - /mount/webhosting_dmz_write/clic/impact_factors:/app/data/impact_factors:ro
    entrypoint: ["python"]
    command: ["manage.py", "process_package_exports", "--skip-checks"]
    depends_on:
      clic-db:
        condition: service_healthy
      clic-redis:
        condition: service_started
    networks:
      - clic_backend

  clic-brightway-json-exports:
    image: ${CLIC_IMAGE:-gitea.psi.ch/images/clic:754f9f8}
    container_name: clic-brightway-json-exports
    restart: always
    env_file:
      - /mount/webhosting_dmz_write/clic/clic.env
    environment:
      - DJANGO_SETTINGS_MODULE=config.settings.production
      - POSTGRES_HOST=clic-db
      - POSTGRES_PORT=5432
      - CLIC_CACHE_BACKEND=redis
      - CLIC_REDIS_URL=redis://clic-redis:6379/0
      - CLIC_REQUIRE_SHARED_CACHE=1
    volumes:
      - /mount/webhosting_dmz_write/clic/media:/app/media
      - /mount/webhosting_dmz_write/clic/impact_factors:/app/data/impact_factors:ro
    entrypoint: ["python"]
    command:
      [
        "manage.py",
        "process_brightway_json_exports",
        "--skip-checks",
        "--sleep",
        "${CLIC_API_EXPORT_POLL_SECONDS:-2}",
      ]
    depends_on:
      clic-db:
        condition: service_healthy
      clic-redis:
        condition: service_started
    networks:
      - clic_backend

  clic-db:
    image: postgres:16
    container_name: clic-db
    restart: always
    env_file:
      - /mount/webhosting_dmz_write/clic/clic.env
    volumes:
      - /mount/webhosting_dmz_write/clic/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - clic_backend

  clic-redis:
    image: redis:7-alpine
    container_name: clic-redis
    restart: always
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - /mount/webhosting_dmz_write/clic/redis:/data
    networks:
      - clic_backend

  # Enea Zeolla <enea.zeolla@psi.ch>
  drsa-tiermaker:
    image: gitea.psi.ch/images/drsa-tiermaker:0.2.4
    container_name: drsa-tiermaker
    restart: always
    depends_on:
      drsa-tiermaker-db:
        condition: service_healthy
    environment:
      - DATABASE_URL=postgresql+psycopg2://${DRSA_TIERMAKER_DB_USER}:${DRSA_TIERMAKER_DB_PW}@drsa-tiermaker-db:5432/drsa_tiermaker
      - SECRET_KEY=${DRSA_TIERMAKER_SECRET_KEY}
      - FIRST_ADMIN_EMAIL=mcda@psi.ch
      - FIRST_ADMIN_PASSWORD=${DRSA_TIERMAKER_ADMIN_PW}
      - ENVIRONMENT=production
      - COOKIE_SECURE=true
      - DRSA_ENGINE=builtin
      - WEB_CONCURRENCY=2
      - CORS_ORIGINS=${DRSA_TIERMAKER_URL}
      - APP_BASE_URL=${DRSA_TIERMAKER_URL}
      - OAUTH2_CLIENT_SECRET=${MCDA_OAUTH2_SECRET}
      - SMTP_HOST=smtp.office365.com
      - SMTP_PORT=587
      - SMTP_USER=mcda@psi.ch
      - EMAIL_AUTH_MODE=oauth2
      - OAUTH2_TENANT_ID=50f89ee2-f910-47c5-9913-a6ea08928f11
      - OAUTH2_CLIENT_ID=201ba262-3c76-41fb-8942-dcefb7729caa
      - OAUTH2_SCOPE=https://outlook.office365.com/.default
      - OAUTH2_USERNAME=mcda@psi.ch
      - SMTP_USE_TLS=true
      - EMAIL_FROM=mcda@psi.ch
    networks:
      - backend
      - drsa_tiermaker_backend

  # Enea Zeolla <enea.zeolla@psi.ch>
  drsa-tiermaker-db:
    image: postgres:16-alpine
    container_name: drsa-tiermaker-db
    restart: always
    environment:
      - POSTGRES_USER=${DRSA_TIERMAKER_DB_USER}
      - POSTGRES_PASSWORD=${DRSA_TIERMAKER_DB_PW}
      - POSTGRES_DB=drsa_tiermaker
    volumes:
      - /mount/webhosting_dmz_write/drsa-tiermaker/db-data:/var/lib/postgresql/data
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U ${DRSA_TIERMAKER_DB_USER} -d drsa_tiermaker",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - drsa_tiermaker_backend

  # Lange Clemens <clemens.lange@psi.ch>
  # summer-project-selection.psi.ch
  summer-project-selection:
    image: gitea.psi.ch/lange_c/summer-project-selection:latest
    container_name: summer-project-selection
    restart: always
    volumes:
      - /mount/webhosting_dmz_write/summer-project-selection/data:/app/data
      - /opt/webcontent/DMZ/summer-project-selection/projects:/app/projects
      - /opt/webcontent/DMZ/summer-project-selection/applicants:/app/applicants
    networks:
      - backend

  # PEPISCO <andras.boedi@psi.ch> <patrick.hemberger@psi.ch>
  # PhotoElectron PhotoIon Spectral COmpendium
  pepisco:
    image: gitea.psi.ch/images/pepisco:v2026.03.13
    container_name: pepisco
    restart: always
    networks:
      - backend

  # Only on rhodo_network. The `backend` alias is required because
  # the frontend image's internal nginx uses http://backend:8000/
  rhodo-backend:
    image: gitea.psi.ch/images/grn_opsins-backend:1.2.0
    container_name: rhodo-backend
    restart: always
    networks:
      rhodo_network:
        aliases:
          - backend

  rhodo-frontend:
    image: gitea.psi.ch/images/grn_opsins-frontend:1.2.0
    container_name: rhodo-frontend
    restart: always
    depends_on:
      - rhodo-backend
    networks:
      - rhodo_network
      - backend

  scicat-rocrate-qa:
    image: gitea.psi.ch/data-catalog-services/scicat-rocrate:2.6.10-rc-openbis-doi.1
    container_name: scicat-rocrate-qa
    restart: always
    networks:
      - backend
    environment:
      - QUARKUS_REST_CLIENT_SCICAT_URL=https://dacat-qa.psi.ch
      - QUARKUS_REST_CLIENT_S3BROKER_URL=https://scicat-s3-broker.qa.psi.ch
      - QUARKUS_HTTP_LIMITS_MAX_BODY_SIZE=10G
      - SCICAT_PID_PREFIX=20.500.11935
      - QUARKUS_LOG_FILE_ENABLE=true
      - QUARKUS_LOG_FILE_PATH=/rocrate/scicat-rocrate-qa.log
    volumes:
      - /mount/rocrate_qa:/rocrate:rw

  scicat-rocrate:
    image: gitea.psi.ch/data-catalog-services/scicat-rocrate:2.6.5
    container_name: scicat-rocrate
    restart: always
    networks:
      - backend
    environment:
      - QUARKUS_REST_CLIENT_SCICAT_URL=https://dacat.psi.ch
      - QUARKUS_REST_CLIENT_S3BROKER_URL=https://scicat-s3-broker.psi.ch
      - QUARKUS_HTTP_LIMITS_MAX_BODY_SIZE=10G
      - SCICAT_PID_PREFIX=20.500.11935
      - QUARKUS_LOG_FILE_ENABLE=true
      - QUARKUS_LOG_FILE_PATH=/rocrate/scicat-rocrate.log
    volumes:
      - /mount/rocrate_prod:/rocrate:rw

  # LEAPS ultrafast frithjof.nolting@psi.ch
  felira-web:
    image: gitea.psi.ch/leaps/leaps-felira:3.1.39
    container_name: felira-web
    restart: always
    # volumes:
    #   - /mount/webhosting_dmz_write/leaps/web:/var/www/html:rw
    depends_on:
      - felira-db
    networks:
      - backend
      - leaps_db
    environment:
      - DB_DATABASE=felira_leaps_ultrafast
      - DB_USERNAME=felira_leaps_ultrafast
      - DB_PASSWORD=${LEAPS_DB_PW}
  felira-db:
    image: mariadb:latest
    container_name: felira-db
    restart: always
    environment:
      - MARIADB_ROOT_PASSWORD=${LEAPS_DB_PW}
      - MARIADB_DATABASE=felira_leaps_ultrafast
      - MARIADB_USER=felira_leaps_ultrafast
      - MARIADB_PASSWORD=${LEAPS_DB_PW}
    volumes:
      - /mount/webhosting_dmz_write/leaps/db_data:/var/lib/mysql
      - /mount/webhosting_dmz_write/leaps/init-db:/docker-entrypoint-initdb.d:ro
    networks:
      - leaps_db

  # Noah Pombas Teixeira De Freitas /  <noah.pombas@psi.ch>
  # PSI Trail - psitrail.psi.ch
  # Image: gitea.psi.ch/bb_if_produktiv/psitrail:181
  psitrail:
    image: gitea.psi.ch/bb_if_produktiv/psitrail:181
    container_name: psitrail
    restart: always
    networks:
      - backend

  # Noah Pombas Teixeira De Freitas /  <noah.pombas@psi.ch>
  # Pocket App - pocket.psi.ch
  # Image: gitea.psi.ch/bb_if_produktiv/pocketapp:17
  pocketapp:
    image: gitea.psi.ch/bb_if_produktiv/pocketapp:17
    container_name: pocketapp
    restart: always
    networks:
      - backend
    

#   # João Pedro Agostinho de Sousa <joao.agostinho-de-sousa@psi.ch>
#   # tubulin.xyz
#   neo4j:
#     image: neo4j:5
#     environment:
#       NEO4J_AUTH: neo4j/${NEO4J_PASSWORD}
#       NEO4J_server_memory_heap_initial__size: 1G
#       NEO4J_server_memory_heap_max__size: 2G
#       NEO4J_server_memory_pagecache_size: 1G
#     volumes:
#       - /mount/webhosting_dmz_write/tubulin/neo4j/data:/data
#       - /mount/webhosting_dmz_write/tubulin/neo4j/logs:/logs
#     healthcheck:
#       test:
#         [
#           "CMD",
#           "cypher-shell",
#           "-u",
#           "neo4j",
#           "-p",
#           "${NEO4J_PASSWORD}",
#           "RETURN 1",
#         ]
#       interval: 10s
#       timeout: 5s
#       retries: 10
#       start_period: 30s
#     restart: always
#     networks:
#       - tubulinxyz_backend
#     stop_grace_period: 60s
#     logging:
#       driver: json-file
#       options:
#         max-size: "50m"
#         max-file: "5"
#     deploy:
#       resources:
#         limits:
#           memory: 4G
#
#   bootstrap:
#     image: ghcr.io/rtviii/tubulinxyz:latest
#     pull_policy: always
#     environment:
#       NEO4J_URI: bolt://neo4j:7687
#       NEO4J_USER: neo4j
#       NEO4J_PASSWORD: ${NEO4J_PASSWORD}
#       NEO4J_CURRENTDB: neo4j
#       TUBXZ_ROOT: /app
#       TUBETL_DATA: /mnt/tubetl_data
#       NCBI_TAXA_SQLITE: /app/.etetoolkit/taxa.sqlite
#     volumes:
#       - /mount/webhosting_dmz_write/tubulin/data:/mnt/tubetl_data
#       - /mount/webhosting_dmz_write/tubulin/log:/var/log/tubxz
#     depends_on:
#       neo4j:
#         condition: service_healthy
#     entrypoint: ["/bin/sh", "/app/scripts/init_and_seed.sh"]
#     restart: always
#     networks:
#       - tubulinxyz_backend
#     logging:
#       driver: json-file
#       options:
#         max-size: "50m"
#         max-file: "3"
#     deploy:
#       resources:
#         limits:
#           memory: 4G
#
#   backend:
#     image: ghcr.io/rtviii/tubulinxyz:latest
#     pull_policy: always
#     environment:
#       NEO4J_URI: bolt://neo4j:7687
#       NEO4J_USER: neo4j
#       NEO4J_PASSWORD: ${NEO4J_PASSWORD}
#       NEO4J_CURRENTDB: neo4j
#       SECRET_KEY: ${SECRET_KEY}
#       TUBXZ_ROOT: /app
#       TUBETL_DATA: /mnt/tubetl_data
#       NCBI_TAXA_SQLITE: /app/.etetoolkit/taxa.sqlite
#     volumes:
#       - /mount/webhosting_dmz_write/tubulin/data:/mnt/tubetl_data
#       - /mount/webhosting_dmz_write/tubulin/log:/var/log/tubxz:ro
#     depends_on:
#       neo4j:
#         condition: service_healthy
#     healthcheck:
#       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
#       interval: 30s
#       timeout: 5s
#       retries: 3
#       start_period: 15s
#     restart: always
#     networks:
#       - backend
#       - tubulinxyz_backend
#     stop_grace_period: 30s
#     logging:
#       driver: json-file
#       options:
#         max-size: "50m"
#         max-file: "5"
#     deploy:
#       resources:
#         limits:
#           memory: 2G
#
#   scheduler:
#     image: ghcr.io/rtviii/tubulinxyz:latest
#     pull_policy: always
#     environment:
#       NEO4J_URI: bolt://neo4j:7687
#       NEO4J_USER: neo4j
#       NEO4J_PASSWORD: ${NEO4J_PASSWORD}
#       NEO4J_CURRENTDB: neo4j
#       TUBXZ_ROOT: /app
#       TUBETL_DATA: /mnt/tubetl_data
#       NCBI_TAXA_SQLITE: /app/.etetoolkit/taxa.sqlite
#     volumes:
#       - /mount/webhosting_dmz_write/tubulin/data:/mnt/tubetl_data
#       - /mount/webhosting_dmz_write/tubulin/log:/var/log/tubxz
#     depends_on:
#       neo4j:
#         condition: service_healthy
#     entrypoint: ["/bin/sh", "/app/scripts/start_scheduler.sh"]
#     restart: always
#     networks:
#       - tubulinxyz_backend
#     logging:
#       driver: json-file
#       options:
#         max-size: "50m"
#         max-file: "5"
#     deploy:
#       resources:
#         limits:
#           memory: 4G
#
#   frontend:
#     image: ghcr.io/rtviii/tubulinxyz-frontend:latest
#     pull_policy: always
#     depends_on:
#       backend:
#         condition: service_healthy
#     restart: always
#     networks:
#       - backend
#       - tubulinxyz_backend
#     logging:
#       driver: json-file
#       options:
#         max-size: "50m"
#         max-file: "3"
#     deploy:
#       resources:
#         limits:
#           memory: 512M
#
networks:
  public:
  backend:
  clic_backend:
  up_mavt_suite_network:
  rhodo_network:
  leaps_db:
  drsa_tiermaker_backend:
  tubulinxyz_backend: