docker-compose.yml

version: "2.1"

volumes:
  cert-manager-data: null
  certs-data: null
  haproxy-data: null
  logshipper-data: null
  pki-data: null
  postgres-data: null
  redis-data: null
  resin-data: null
  s3-data: null

x-default-environment: &default-environment
  VERBOSE: "false"
  # https://github.com/balena-io-modules/open-balena-base/blob/master/src/configure-balena.sh
  DNS_TLD: ly.fish.local
  # https://github.com/balena-io/balena-mdns-publisher/blob/master/src/app.ts#L187-L190
  MDNS_TLD: ly.fish.local

services:
  jellyfish-tests:
    build:
      context: .
      dockerfile: apps/test-runner/Dockerfile
    # (TBC) https://www.flowdock.com/app/rulemotion/r-beginners/threads/uPPfzU-DGRehSDk-TkS-vZs7Q58
    # https://github.com/balena-io-modules/open-balena-base/blob/master/Dockerfile#L105
    entrypoint:
      - /bin/bash
      - "-c"
    command: /usr/src/jellyfish/apps/test-runner/start-jellyfish-test-runner.sh
    cap_add:
      - SYS_RESOURCE
      - SYS_ADMIN
    security_opt:
      - apparmor=unconfined
    tmpfs:
      - /run
      - /sys/fs/cgroup
    depends_on:
      - api
      - haproxy
      - ui
    restart: unless-stopped
    volumes:
      - resin-data:/balena
      - certs-data:/certs
    environment:
      <<: *default-environment
      HOSTS_CONFIG: "LIVECHAT_HOST:livechat"
      LOGLEVEL: crit
      NO_LOG_SUCCESS: 1
      NODE_ENV: test
      POSTGRES_DATABASE: jellyfish
      POSTGRES_HOST: postgres
      POSTGRES_PASSWORD: docker
      POSTGRES_USER: docker
      REDIS_HOST: redis
      SERVER_PORT: 443
      TOKENS_CONFIG: ","
      UI_PORT: 443

  api:
    entrypoint:
      - /bin/bash
      - "-c"
    command: /usr/src/jellyfish/apps/server/run.sh
    environment:
      <<: *default-environment
      # /etc/docker.env:API_HOST=api.{{balena_device_uuid}}.{{dns_tld}}
      HOSTS_CONFIG: API_HOST:api,UI_HOST:jel,OAUTH_REDIRECT_BASE_URL:jel
      # /etc/docker.env:RESET_PASSWORD_SECRET_TOKEN="$(openssl rand -hex 16)"
      TOKENS_CONFIG: RESET_PASSWORD_SECRET_TOKEN:hex,MONITOR_SECRET_TOKEN:hex
      NO_LOG_SUCCESS: 1
    healthcheck:
      interval: 15s
      retries: 3
      test: curl --fail http://localhost/health
      timeout: 5s
    depends_on:
      - postgres
      - redis
      - mdns
      # We want haproxy to restart first, so that it will be ready to process the change of IP that occurs during the handover of `api`
      - haproxy
    restart: unless-stopped
    labels:
      io.balena.features.supervisor-api: 1
      io.balena.features.balena-api: 1
      io.balena.update.strategy: hand-over
      # Note that this timer starts to run after the new node is started, so it needs to give enough time for
      # the new service to be ready to handle requests
      io.balena.update.handover-timeout: 45000
    volumes:
      - resin-data:/balena
      - certs-data:/certs
    build:
      context: .
      dockerfile: apps/server/Dockerfile

  ui:
    entrypoint:
      - /bin/bash
      - "-c"
    command: /usr/src/jellyfish/apps/ui/run.sh
    environment:
      <<: *default-environment
      HOSTS_CONFIG: API_HOST:api,UI_HOST:jel,OAUTH_REDIRECT_BASE_URL:jel
      SERVER_PORT: 443
      TOKENS_CONFIG: ","
      UI_PORT: 80
    volumes:
      - resin-data:/balena
      - certs-data:/certs
    depends_on:
      - api
    healthcheck:
      interval: 15s
      retries: 3
      test: curl --fail http://localhost/
      timeout: 5s
    restart: unless-stopped
    build:
      context: .
      dockerfile: apps/ui/Dockerfile

  # TODO Don't run on PROD
  # https://github.com/balena-io/open-balena-db
  postgres:
    image: postgres:15
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: docker
      POSTGRES_USER: docker
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U docker"]
      interval: 5s
      timeout: 5s
      retries: 5
    command:
      [
        "postgres",
        "-c",
        "fsync=off",
        "-c",
        "synchronous_commit=off",
        "-c",
        "full_page_writes=off",
      ]
    volumes:
      - postgres-data:/var/lib/postgresql/data

  # TODO Don't run on PROD
  # https://hub.docker.com/_/redis
  redis:
    image: redis:6-alpine
    restart: unless-stopped
    healthcheck:
      interval: 15s
      retries: 3
      test: echo INFO | redis-cli | grep redis_version
      timeout: 5s
    volumes:
      - redis-data:/data
    command: redis-server --appendonly yes

  # TODO Don't run on PROD
  # https://github.com/balena-io/open-balena-s3
  s3:
    image: balena/open-balena-s3:v2.18.0
    volumes:
      - s3-data:/export
      - certs-data:/certs
      - resin-data:/balena
    environment:
      <<: *default-environment
      BUCKETS: jellyfish
      # (TBC) MinIO/S3 untested
      # https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Config.html#s3ForcePathStyle-property
      HOSTS_CONFIG: AWS_S3_ENDPOINT:s3
      TOKENS_CONFIG: S3_MINIO_ACCESS_KEY:hex,S3_MINIO_SECRET_KEY:hex,AWS_ACCESS_KEY_ID:S3_MINIO_ACCESS_KEY,AWS_SECRET_ACCESS_KEY:S3_MINIO_SECRET_KEY
      # (TBC) MINIO_DOMAIN: https://docs.min.io/docs/minio-server-configuration-guide.html
      MINIO_DOMAIN: ly.fish.local
    healthcheck:
      test: /usr/src/app/docker-hc
      interval: 45s
      timeout: 15s
      retries: 3
    cap_add:
      - SYS_RESOURCE
      - SYS_ADMIN
    security_opt:
      - apparmor=unconfined
    tmpfs:
      - /run
      - /sys/fs/cgroup
    restart: unless-stopped

  # https://github.com/balena-io/balena-mdns-publisher
  mdns:
    image: balena/balena-mdns-publisher:v1.21.0
    network_mode: host
    cap_add:
      - SYS_RESOURCE
      - SYS_ADMIN
    security_opt:
      - apparmor=unconfined
    tmpfs:
      - /run
      - /sys/fs/cgroup
    volumes:
      - certs-data:/certs
      - resin-data:/balena
    labels:
      io.balena.features.dbus: 1
    restart: unless-stopped
    environment:
      <<: *default-environment
      MDNS_SUBDOMAINS: api,jel,livechat,postgres,redis,s3,stats,ui
      HOSTS_CONFIG: API_HOST:api,AWS_S3_ENDPOINT:s3,UI_HOST:jel
      TOKENS_CONFIG: ","
    healthcheck:
      test: /usr/src/app/docker-hc
      interval: 45s
      timeout: 15s
      retries: 3

  # https://github.com/balena-io/ca-private
  balena-ca:
    image: balena/ca-private:v0.0.10
    environment:
      <<: *default-environment
      ORG_UNIT: productOS
    healthcheck:
      interval: 45s
      retries: 3
      test: curl -I --fail http://localhost:8888
      timeout: 15s
    labels:
      io.balena.features.balena-api: "1"
    restart: unless-stopped
    volumes:
      - pki-data:/pki
      - certs-data:/certs

  # https://github.com/balena-io/cert-manager
  cert-manager:
    build: apps/cert-manager
    depends_on:
      - balena-ca
    environment:
      <<: *default-environment
      # wildcard certificate for reverse proxy and livechat subdomains
      SUBJECT_ALTERNATE_NAMES: "*,*.livechat"
      ORG_UNIT: productOS
      SSH_KEY_NAMES: "livechat,"
    entrypoint:
      - /bin/bash
      - "-c"
    command: /opt/run.sh
    healthcheck:
      interval: 45s
      retries: 3
      test: test -f /certs/.ready
      timeout: 15s
    labels:
      io.balena.features.balena-api: "1"
    restart: unless-stopped
    volumes:
      - cert-manager-data:/etc/letsencrypt
      - certs-data:/certs
      - resin-data:/balena

  # https://github.com/balena-io/open-balena-haproxy
  haproxy:
    build: apps/haproxy
    depends_on:
      - cert-manager
    healthcheck:
      test: /bin/sh -c 'ls -la /proc/*/exe | grep -q /usr/local/sbin/haproxy'
      interval: 60s
      timeout: 10s
      retries: 3
    ports:
      # haproxy/http
      - "80:80/tcp"
      # haproxy/tcp-router
      - "443:443/tcp"
      # haproxy/stats
      - "1936:1936/tcp"
    environment:
      <<: *default-environment
    volumes:
      - certs-data:/certs
    sysctls:
      net.ipv4.ip_unprivileged_port_start: 0
    restart: unless-stopped

  # dynamically configure Docker network aliases based on DNS_TLD and ALIAS list
  # allows DNS resolution from systemd-less images on the Docker network
  haproxy-sidecar:
    build: apps/haproxy-sidecar
    restart: unless-stopped
    entrypoint:
      - /bin/sh
      - "-c"
    command: /opt/run.sh
    environment:
      <<: *default-environment
      # resolved internally as {{service}}.{{tld-without-balena-device-uuid}}
      ALIASES: api,jel,livechat,postgres,redis,s3
    labels:
      io.balena.features.balena-socket: "1"
      io.balena.features.supervisor-api: "1"
  logshipper:
    image: bh.cr/balenablocks/logshipper/1.0.1:rev3
    environment:
      LOG: warn
    labels:
      io.balena.features.journal-logs: "1"
    restart: unless_stopped
    volumes:
      - "logshipper-data:/var/lib/logshipper"

  # only relevant when running in AWS/EC2
  tag-sidecar:
    build: apps/tag-sidecar
    restart: "no"
    entrypoint:
      - /usr/local/bin/bash
      - "-c"
    command: /opt/run.sh
    environment:
      <<: *default-environment
      ENABLED: "true"
    labels:
      io.balena.features.balena-api: "1"