docker-compose.yml

version: '3.9'

volumes:
  simple:
  packages:
  packages-archive:
  sponsorlogos:
  policies:
  vault:
  caches:
  rstuf-worker-data:
  rstuf-metadata:

services:
  vault:
    # NOTE: pinned for consistency with whats available in our deployment
    image: vault:1.12.3
    restart: on-failure
    entrypoint: /bin/sh
    command: ["/etc/vault/entry.sh"]
    environment:
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
      VAULT_DEV_ROOT_TOKEN_ID: "an insecure vault access token"
    ports:
      - "8200:8200"
    cap_add:
      - IPC_LOCK
    volumes:
      - vault:/vault/file
      - ./dev/vault:/etc/vault

  db:
    image: postgres:14.4
    ports:
      # 5432 may already in use by another PostgreSQL on host
      - "5433:5432"
    environment:
      POSTGRES_HOST_AUTH_METHOD: trust  # never do this in production!
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "postgres", "-d", "postgres"]
      interval: 1s

  stripe:
    image: stripe/stripe-mock:v0.162.0
    ports:
      - "12111:12111"

  redis:
    image: redis:4.0

  localstack:
    image: localstack/localstack:1.4
    environment:
      SERVICES: "sqs"
      HOSTNAME: "localstack"
      HOSTNAME_EXTERNAL: "localstack"
      DEFAULT_REGION: "us-east-2"
      LS_LOG: "error"
    ports:
      - "4566:4566"

  elasticsearch:
    image: elasticsearch:7.10.1
    environment:
      - xpack.security.enabled=false
      - discovery.type=single-node
    ulimits:
      nofile:
        soft: 65536
        hard: 65536

  camo:
    image: pypa/warehouse-camo:2.0.0
    command: /bin/go-camo --listen=0.0.0.0:9000
    ports:
      - "9000:9000"
    environment:
      GOCAMO_HMAC: "insecurecamokey"
      GOCAMO_MAXSIZE: 10000
      GOCAMO_MAXSIZEREDIRECT: "https://warehouse-camo.ingress.cmh1.psfhosted.org/d1e139dd79d95783a48690c79813071314e45a69/68747470733a2f2f73746f726167652e676f6f676c65617069732e636f6d2f707970692d6173736574732f696d6167652d746f6f2d6c617267652d31306d622e706e67"

  base:
    build:
      context: .
      args:
        DEVEL: "yes"
        IPYTHON: "no"
    image: warehouse:docker-compose
    volumes: &base_volumes
      # We specify paths explicitly to only add what we need, and to avoid
      # adding the entire repository.
      # The :z option fixes permission issues with SELinux by setting a
      # permissive security context.
      - ./dev:/opt/warehouse/src/dev:z
      - ./docs:/opt/warehouse/src/docs:z
      - ./warehouse:/opt/warehouse/src/warehouse:z
      - ./tests:/opt/warehouse/src/tests:z
      - ./htmlcov:/opt/warehouse/src/htmlcov:z
      - ./pyproject.toml:/opt/warehouse/src/pyproject.toml:z
      - .coveragerc:/opt/warehouse/src/.coveragerc:z
      - packages:/var/opt/warehouse/packages
      - packages-archive:/var/opt/warehouse/packages-archive
      - sponsorlogos:/var/opt/warehouse/sponsorlogos
      - policies:/var/opt/warehouse/policies
      - simple:/var/opt/warehouse/simple
      - ./bin:/opt/warehouse/src/bin:z
      - ./requirements:/opt/warehouse/src/requirements:z
      - caches:/root/.cache
      - caches:/opt/warehouse/src/.mypy_cache
      - caches:/opt/warehouse/src/.pytest_cache
      # Included to support linters during development
      - ./gunicorn-prod.conf.py:/opt/warehouse/src/gunicorn-prod.conf.py:z
      - ./gunicorn-uploads.conf.py:/opt/warehouse/src/gunicorn-uploads.conf.py:z
      - rstuf-metadata:/var/opt/warehouse/metadata
      - ./dev/tufkeys:/opt/warehouse/src/dev/tufkeys:z

  web:
    image: warehouse:docker-compose
    command: gunicorn --reload -b 0.0.0.0:8000 --access-logfile - --error-logfile - warehouse.wsgi:application
    env_file: dev/environment
    pull_policy: never
    volumes: *base_volumes
    ports:
      - "${WEB_PORT:-80}:8000"
    depends_on:
      db:
        condition: service_healthy
      elasticsearch:
        condition: service_started
      redis:
        condition: service_started
      stripe:
        condition: service_started

  files:
    image: warehouse:docker-compose
    pull_policy: never
    working_dir: /var/opt/warehouse
    command: python -m http.server 9001
    volumes:
      - packages:/var/opt/warehouse/packages
      - packages-archive:/var/opt/warehouse/packages-archive
      - sponsorlogos:/var/opt/warehouse/sponsorlogos
      - simple:/var/opt/warehouse/simple
      - rstuf-metadata:/var/opt/warehouse/metadata
    ports:
      - "9001:9001"

  worker:
    image: warehouse:docker-compose
    pull_policy: never
    command: hupper -m celery -A warehouse worker -B -S redbeat.RedBeatScheduler -l info
    volumes:
      - ./warehouse:/opt/warehouse/src/warehouse:z
      - packages:/var/opt/warehouse/packages
      - packages-archive:/var/opt/warehouse/packages-archive
    env_file: dev/environment
    environment:
      C_FORCE_ROOT: "1"
      FILES_BACKEND: "warehouse.packaging.services.LocalFileStorage path=/var/opt/warehouse/packages/ url=http://files:9001/packages/{path}"
      ARCHIVE_FILES_BACKEND: "warehouse.packaging.services.LocalArchiveFileStorage path=/var/opt/warehouse/packages-archive/ url=http://files:9001/packages-archive/{path}"
      SIMPLE_BACKEND: "warehouse.packaging.services.LocalSimpleStorage path=/var/opt/warehouse/simple/ url=http://files:9001/simple/{path}"

  rstuf-worker01:
    image: ghcr.io/repository-service-tuf/repository-service-tuf-worker:latest
    volumes:
      - rstuf-worker-data:/data
      - ./dev/rstuf-workers-supervisor.conf:/opt/repository-service-tuf/supervisor.conf:z
      - rstuf-metadata:/var/opt/repository-service-tuf/storage
      - ./dev/tufkeys/online:/var/opt/repository-service-tuf/keystorage
    environment:
      - RSTUF_STORAGE_BACKEND=LocalStorage
      - RSTUF_LOCAL_STORAGE_BACKEND_PATH=/var/opt/repository-service-tuf/storage
      - RSTUF_KEYVAULT_BACKEND=LocalKeyVault
      - RSTUF_LOCAL_KEYVAULT_PATH=/var/opt/repository-service-tuf/keystorage
      - RSTUF_LOCAL_KEYVAULT_KEYS=online,an insecure private key password
      - RSTUF_BROKER_SERVER=redis://redis/1
      - RSTUF_REDIS_SERVER=redis://redis
      - RSTUF_REDIS_SERVER_DB_RESULT=1
      - RSTUF_REDIS_SERVER_DB_REPO_SETTINGS=2
      - RSTUF_SQL_SERVER=postgresql://postgres@db:5432/rstuf
    healthcheck:
      test: "exit 0"
    restart: always
    tty: true
    depends_on:
      db:
        condition: service_healthy

  rstuf-worker02:
    image: ghcr.io/repository-service-tuf/repository-service-tuf-worker:latest
    volumes:
      - rstuf-worker-data:/data
      - ./dev/rstuf-workers-supervisor.conf:/opt/repository-service-tuf/supervisor.conf:z
      - rstuf-metadata:/var/opt/repository-service-tuf/storage
      - ./dev/tufkeys/online:/var/opt/repository-service-tuf/keystorage
    environment:
      - RSTUF_STORAGE_BACKEND=LocalStorage
      - RSTUF_LOCAL_STORAGE_BACKEND_PATH=/var/opt/repository-service-tuf/storage
      - RSTUF_KEYVAULT_BACKEND=LocalKeyVault
      - RSTUF_LOCAL_KEYVAULT_PATH=/var/opt/repository-service-tuf/keystorage
      - RSTUF_LOCAL_KEYVAULT_KEYS=online,an insecure private key password
      - RSTUF_BROKER_SERVER=redis://redis/1
      - RSTUF_REDIS_SERVER=redis://redis
      - RSTUF_REDIS_SERVER_DB_RESULT=1
      - RSTUF_REDIS_SERVER_DB_REPO_SETTINGS=2
      - RSTUF_SQL_SERVER=postgresql://postgres@db:5432/rstuf
    healthcheck:
      test: "exit 0"
    restart: always
    tty: true
    depends_on:
      db:
        condition: service_healthy

  rstuf-api:
    image: ghcr.io/repository-service-tuf/repository-service-tuf-api:latest
    ports:
      - 8001:80
    environment:
      - RSTUF_BROKER_SERVER=redis://redis/1
      - RSTUF_REDIS_SERVER=redis://redis
      - RSTUF_REDIS_SERVER_DB_RESULT=1
      - RSTUF_REDIS_SERVER_DB_REPO_SETTINGS=2

  static:
    build:
      context: .
      target: static-deps
    image: warehouse:docker-compose-static
    ports:
      - "35729:35729" # LiveReload
    environment:
      NODE_ENV: "development"
    command: bash -c "npm run watch"
    volumes:
      - ./warehouse:/opt/warehouse/src/warehouse:z
      - ./webpack.config.js:/opt/warehouse/src/webpack.config.js:z
      - ./.babelrc:/opt/warehouse/src/.babelrc:z
      - ./.stylelintrc.json:/opt/warehouse/src/.stylelintrc.json:z
      - ./tests/frontend:/opt/warehouse/src/tests/frontend:z
      - ./bin:/opt/warehouse/src/bin:z
      - caches:/opt/warehouse/src/.stylelintcache

  maildev:
    image: maildev/maildev:2.0.2
    ports:
      - "1080:1080"
      - "1025:1025"

  notdatadog:
    image: warehouse:docker-compose
    pull_policy: never
    command: python /opt/warehouse/dev/notdatadog.py 0.0.0.0:8125
    environment:
      METRICS_OUTPUT: "false"
    ports:
      - "8125:8125/udp"
    volumes:
      - ./dev/notdatadog.py:/opt/warehouse/dev/notdatadog.py

  notgithub:
    image: ewjoachim/notgithub-token-scanning
    environment:
      NOTGITHUB_DEFAULT_URL: "http://web:8000/_/github/disclose-token"
    ports:
      - "8964:8000"

  dev-docs:
    build:
      context: .
      target: docs
    image: warehouse:docker-compose-docs
    volumes:
      - ./bin:/opt/warehouse/src/bin:z
      - ./docs:/opt/warehouse/src/docs:z

  user-docs:
    image: warehouse:docker-compose-docs
    pull_policy: never
    command: mkdocs serve -a 0.0.0.0:8000 -f docs/mkdocs-user-docs.yml
    volumes:
      - ./bin:/opt/warehouse/src/bin:z
      - ./docs/mkdocs-user-docs.yml:/opt/warehouse/src/docs/mkdocs-user-docs.yml:z
      - ./docs:/opt/warehouse/src/docs:z
    ports:
      - "10000:8000"

  blog:
    image: warehouse:docker-compose-docs
    pull_policy: never
    command: mkdocs serve -a 0.0.0.0:8000 -f docs/mkdocs-blog.yml
    volumes:
      # we mount git because rss, thanks feed nerds
      - ./.git:/opt/warehouse/src/.git:ro
      - ./bin:/opt/warehouse/src/bin:z
      - ./docs:/opt/warehouse/src/docs:z
    ports:
      - "10001:8000"