# docker-compose version

version: '3.7'

services:

# NOTE: not used in stand-alone mode

# devdns:

# image: ${CONTAINER_REGISTRY}/ruudud/devdns

# container_name: devdns

# ports:

# - "127.0.0.1:53:53/udp"

# volumes:

# - /var/run/docker.sock:/var/run/docker.sock:ro

# environment:

# TZ: ${TZ}

# NOTE: we use a shared volume init helper container to make sure volumes

# are fully created and instantiated before we try to bind mount

# subdirs from e.g. the state volume in the service containers.

# NOTE: Even though no services are started then use network_mode: "host"

# to avoid creating virtual container networks.

# Lustre Networking (LNET) locks up if the network is changed

# while lustre is mounted.

migrid-volume-init:

container_name: migrid-volume-init

image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}

network_mode: "host"

extends:

file: docker-compose_shared.yml

service: migrid-shared

environment:

TZ: ${TZ}

# RUN_SERVICES specifies which daemons to launch

# Available target service names follow migrid init script and are:

# httpd script monitor sshmux events cron transfers

# openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy

RUN_SERVICES:

volumes:

- type: volume

source: httpd

target: /etc/httpd

- type: volume

source: mig

target: /home/mig/mig

- type: volume

source: certs

target: /etc/httpd/MiG-certificates

- type: volume

source: migrid-syslog

target: /var/log

- type: volume

source: state

target: /home/mig/state

env_file:

- migrid-httpd.env

# NOTE: public hosts should create users through sign up and run like this

command: /app/docker-entry.sh -V

# The migrid core services including httpd and tightly integrated services

# like job handling (grid script, monitor, sshmux, imnoty and vmproxy)

# NOTE: in order to test the publishing of container services on the host

# with standard ports on 1.2.3.x one can set up a local dummy device:

# sudo ip link add dummylan type dummy

# sudo ip addr add 1.2.3.1/24 dev dummylan

# sudo ip link set dummylan up

#

# Then use the local firewall to forward the standard low service ports

# to the exposed high ones.

migrid:

container_name: migrid

image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}

network_mode: "host"

extends:

file: docker-compose_shared.yml

service: migrid-shared

environment:

TZ: ${TZ}

# RUN_SERVICES specifies which daemons to launch

# Available target service names follow migrid init script and are:

# httpd script monitor sshmux events cron transfers

# openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy

RUN_SERVICES: httpd script monitor sshmux events cron transfers imnotify vmproxy notify crond rsyslogd

depends_on:

# IMPORTANT: finish volume init before migrid launch as explained above

migrid-volume-init:

condition: service_completed_successfully

volumes:

- type: volume

source: httpd

target: /etc/httpd

- type: volume

source: mig

target: /home/mig/mig

- type: volume

source: certs

target: /etc/httpd/MiG-certificates

- type: volume

source: migrid-syslog

target: /var/log

- type: volume

source: state

target: /home/mig/state

# NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount

- type: bind

source: ${VGRID_FILES_WRITABLE}

target: /home/mig/state/vgrid_files_readonly

read_only: true

# NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs

- type: bind

source: ${MIG_SYSTEM_RUN}

target: /home/mig/state/mig_system_run

# NOTE: openid_store is a volatile state for apache mod auth openid and

# gains scalability and performance from using a fast local tmpfs

- type: bind

source: ${OPENID_STORE}

target: /home/mig/state/openid_store

env_file:

- migrid-httpd.env

command: /app/docker-entry.sh -k -V

# Multiple containers with individual daemons not provided by base migrid

migrid-openid:

container_name: migrid-openid

image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}

network_mode: "host"

environment:

TZ: ${TZ}

# RUN_SERVICES specifies which daemons to launch

# Available target service names follow migrid init script and are:

# httpd script monitor sshmux events cron transfers

# openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy

RUN_SERVICES: openid rsyslogd

depends_on:

- migrid

#ports:

# # NOTE: expose the unique raw port(s) to host

# - "8443:8443"

volumes:

- type: volume

source: httpd

target: /etc/httpd

- type: volume

source: mig

target: /home/mig/mig

- type: volume

source: certs

target: /etc/httpd/MiG-certificates

- type: volume

source: migrid-openid-syslog

target: /var/log

- type: volume

source: state

target: /home/mig/state

# NOTE: we don't need read-only vgrids/workgroups in the openid container

# NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs

- type: bind

source: ${MIG_SYSTEM_RUN}

target: /home/mig/state/mig_system_run

command: /app/docker-entry.sh -k

migrid-sftp:

container_name: migrid-sftp

image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}

network_mode: "host"

# NOTE: sshd requires capability to write audit log on login attempts

cap_add:

- AUDIT_WRITE

environment:

TZ: ${TZ}

# RUN_SERVICES specifies which daemons to launch

# Available target service names follow migrid init script and are:

# httpd script monitor sshmux events cron transfers

# openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy

RUN_SERVICES: sftp sftpsubsys rsyslogd

depends_on:

- migrid

#ports:

# # NOTE: expose the unique raw port(s) to host

# - "2222:2222"

# - "22222:22222"

volumes:

- type: volume

source: httpd

target: /etc/httpd

- type: volume

source: mig

target: /home/mig/mig

- type: volume

source: certs

target: /etc/httpd/MiG-certificates

- type: volume

source: migrid-sftp-syslog

target: /var/log

- type: volume

source: state

target: /home/mig/state

# NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount

- type: bind

source: ${VGRID_FILES_WRITABLE}

target: /home/mig/state/vgrid_files_readonly

read_only: true

# NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs

- type: bind

source: ${MIG_SYSTEM_RUN}

target: /home/mig/state/mig_system_run

command: /app/docker-entry.sh -k

migrid-ftps:

container_name: migrid-ftps

image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}

network_mode: "host"

environment:

TZ: ${TZ}

# RUN_SERVICES specifies which daemons to launch

# Available target service names follow migrid init script and are:

# httpd script monitor sshmux events cron transfers

# openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy

RUN_SERVICES: ftps rsyslogd

depends_on:

- migrid

#ports:

# # NOTE: expose the unique raw port(s) to host

# - "8021:8021"

volumes:

- type: volume

source: httpd

target: /etc/httpd

- type: volume

source: mig

target: /home/mig/mig

- type: volume

source: certs

target: /etc/httpd/MiG-certificates

- type: volume

source: migrid-ftps-syslog

target: /var/log

- type: volume

source: state

target: /home/mig/state

# NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount

- type: bind

source: ${VGRID_FILES_WRITABLE}

target: /home/mig/state/vgrid_files_readonly

read_only: true

# NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs

- type: bind

source: ${MIG_SYSTEM_RUN}

target: /home/mig/state/mig_system_run

command: /app/docker-entry.sh -k

migrid-webdavs:

container_name: migrid-webdavs

image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}

network_mode: "host"

environment:

TZ: ${TZ}

# RUN_SERVICES specifies which daemons to launch

# Available target service names follow migrid init script and are:

# httpd script monitor sshmux events cron transfers

# openid sftp sftpsubsys webdavs ftps notify imnotify vmproxy

RUN_SERVICES: webdavs rsyslogd

depends_on:

- migrid

#ports:

# # NOTE: expose the unique raw port(s) to host

# - "4443:4443"

volumes:

- type: volume

source: httpd

target: /etc/httpd

- type: volume

source: mig

target: /home/mig/mig

- type: volume

source: certs

target: /etc/httpd/MiG-certificates

- type: volume

source: migrid-webdavs-syslog

target: /var/log

- type: volume

source: state

target: /home/mig/state

# NOTE: for read-only vgrids/workgroups we need a local 'ro' bind-mount

- type: bind

source: ${VGRID_FILES_WRITABLE}

target: /home/mig/state/vgrid_files_readonly

read_only: true

# NOTE: mig_system_run is a shared volatile cache which gains from using host tmpfs

- type: bind

source: ${MIG_SYSTEM_RUN}

target: /home/mig/state/mig_system_run

command: /app/docker-entry.sh -k

migrid-lustre-quota:

container_name: migrid-lustre-quota

image: ${CONTAINER_REGISTRY}/ucphhpc/migrid${CONTAINER_TAG}

network_mode: "host"

environment:

TZ: ${TZ}

depends_on:

- migrid

cap_add:

- SYS_ADMIN

volumes:

- type: bind

source: ${QUOTA_LUSTRE_BASE:-/dev/null}

target: /lustre/${DOMAIN}

- type: bind

source: ${QUOTA_GOCRYPTFS_XRAY:-/dev/null}

target: /usr/local/bin/gocryptfs-xray

- type: bind

source: ${QUOTA_GOCRYPTFS_SOCK:-/dev/null}

target: /var/run/gocryptfs.${DOMAIN}.sock

- type: volume

source: mig

target: /home/mig/mig

- type: volume

source: state

target: /home/mig/state

command: miglustrequota.py -c /home/mig/mig/server/MiGserver.conf

# NOTE: not used in stand-alone production mode

# nginx-proxy:

# image: ${CONTAINER_REGISTRY}/jwilder/nginx-proxy

# container_name: nginx-proxy

# network_mode: "host"

# # TODO: can we add an httpd health check and switch to wait for condition

# # service_healthy to avoid the storm of initial avoid nginx errors

# # from racing apache during start up? Apparently that will not work

# # with on-going jupyter integration due to swarm mode, however.

# depends_on:

# - migrid

# #ports:

# # # NOTE: expose the unique raw port(s) to host

# # - "80:80"

# # - "443:443"

# volumes:

# - /var/run/docker.sock:/tmp/docker.sock:ro

# - ./nginx-proxy-development.conf:/etc/nginx/conf.d/migrid.conf

# - ./nginx-harden-https.conf:/etc/nginx/harden-https.conf

# - ./certs/MiG/site/server.crt:/etc/nginx/certs/server.crt

# - ./certs/dhparams.pem:/etc/nginx/dhparam/dhparam.pem

volumes:

certs:

# Volume for generated certificates (provided by migrid)

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/certs

o: bind

httpd:

# Volume used for httpd config (provided by migrid)

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/httpd

o: bind

mig:

# Volume used to contain the migrid code and conf (provided by migrid at svn/git)

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/mig

o: bind

state:

# Volume used to contain the migrid state (provided by migrid)

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/state

o: bind

migrid-syslog:

# Volume used for exposing migrid container system log

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/log/migrid

o: bind

migrid-openid-syslog:

# Volume used for exposing migrid openid container system log

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/log/migrid-openid

o: bind

migrid-sftp-syslog:

# Volume used for exposing migrid sftp container system log

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/log/migrid-sftp

o: bind

migrid-webdavs-syslog:

# Volume used for exposing migrid webdavs container system log

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/log/migrid-webdavs

o: bind

migrid-ftps-syslog:

# Volume used for exposing migrid ftps container system log

driver: local

driver_opts:

type: none

device: ${DOCKER_MIGRID_ROOT}/log/migrid-ftps

o: bind