From 02ee8373894f4d7e3eb50c470ff0634bd1c9cae2 Mon Sep 17 00:00:00 2001 From: Tobias McNulty Date: Thu, 16 Nov 2023 18:05:31 -0500 Subject: [PATCH] cleanup --- .github/workflows/docker-publish.yml | 8 +- docker-compose.nobuild.yml | 143 +++++++++++++++++++++++++++ docker-compose.yml | 19 +++- 3 files changed, 159 insertions(+), 11 deletions(-) create mode 100644 docker-compose.nobuild.yml diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index f2fdf05e..06ffd845 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -1,10 +1,5 @@ name: Docker -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - on: push: branches: [gh-images] @@ -23,6 +18,7 @@ jobs: build_args: [""] flavor: [""] include: + # Build additional OIDC flavor for nginx (tags will be suffixed with -oidc) - image: nginx flavor: | latest=true @@ -52,7 +48,7 @@ jobs: with: images: ${{ env.REGISTRY_WITH_PATH }}/central-${{ matrix.image }} flavor: ${{ matrix.flavor }} - # generate Docker tags based on the following events/attributes + # Generate Docker tags based on the following events/attributes tags: | type=ref,event=branch type=semver,pattern={{version}} diff --git a/docker-compose.nobuild.yml b/docker-compose.nobuild.yml new file mode 100644 index 00000000..f1d25f3a --- /dev/null +++ b/docker-compose.nobuild.yml @@ -0,0 +1,143 @@ +version: "3" +services: + postgres14: + build: + context: . + dockerfile: postgres14.dockerfile + volumes: + - postgres14:/var/lib/odk/postgresql/14 + environment: + POSTGRES_USER: odk + POSTGRES_PASSWORD: odk + POSTGRES_DATABASE: odk + restart: always + postgres: + # This service upgrades from postgres 9.6 to 14. + # The legacy name must be maintained to allow access to the anonymous volume. + build: + context: . + dockerfile: postgres-upgrade.dockerfile + volumes: + - /var/lib/postgresql/data + - postgres14:/var/lib/postgresql/14 + - ./files/postgres14/upgrade:/postgres14-upgrade + environment: + PGUSER: odk + POSTGRES_INITDB_ARGS: -U odk + POSTGRES_PASSWORD: odk + POSTGRES_DATABASE: odk + mail: + image: "ixdotai/smtp:v0.5.1" + volumes: + - ./files/mail/rsa.private:/etc/exim4/dkim.key.temp:ro + environment: + - MAILNAME=${DOMAIN} + - DKIM_KEY_PATH=/etc/exim4/dkim.key.temp + restart: always + service: + image: ghcr.io/caktus/central-service:latest + depends_on: + - secrets + - postgres14 + - mail + - pyxform + - enketo + volumes: + - secrets:/etc/secrets + - /data/transfer:/data/transfer + - ./files/service/config.json.template:/usr/share/odk/config.json.template + environment: + - DOMAIN=${DOMAIN} + - SYSADMIN_EMAIL=${SYSADMIN_EMAIL} + - HTTPS_PORT=${HTTPS_PORT:-443} + - NODE_OPTIONS=${SERVICE_NODE_OPTIONS:-} + - DB_HOST=${DB_HOST:-postgres14} + - DB_USER=${DB_USER:-odk} + - DB_PASSWORD=${DB_PASSWORD:-odk} + - DB_NAME=${DB_NAME:-odk} + - DB_SSL=${DB_SSL:-null} + - EMAIL_FROM=${EMAIL_FROM:-no-reply@$DOMAIN} + - EMAIL_HOST=${EMAIL_HOST:-mail} + - EMAIL_PORT=${EMAIL_PORT:-25} + - EMAIL_SECURE=${EMAIL_SECURE:-false} + - EMAIL_IGNORE_TLS=${EMAIL_IGNORE_TLS:-true} + - EMAIL_USER=${EMAIL_USER:-} + - EMAIL_PASSWORD=${EMAIL_PASSWORD:-} + - OIDC_ENABLED=${OIDC_ENABLED:-false} + - OIDC_ISSUER_URL=${OIDC_ISSUER_URL:-} + - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-} + - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-} + - SENTRY_ORG_SUBDOMAIN=${SENTRY_ORG_SUBDOMAIN:-o130137} + - SENTRY_KEY=${SENTRY_KEY:-3cf75f54983e473da6bd07daddf0d2ee} + - SENTRY_PROJECT=${SENTRY_PROJECT:-1298632} + command: [ "wait-for-it", "${DB_HOST:-postgres14}:5432", "--", "./start-odk.sh" ] + restart: always + logging: + driver: local + nginx: + image: ghcr.io/caktus/central-nginx:latest + depends_on: + - service + - enketo + environment: + - DOMAIN=${DOMAIN} + - CERTBOT_EMAIL=${SYSADMIN_EMAIL} + - SSL_TYPE=${SSL_TYPE:-letsencrypt} + - SENTRY_ORG_SUBDOMAIN=${SENTRY_ORG_SUBDOMAIN:-o130137} + - SENTRY_KEY=${SENTRY_KEY:-3cf75f54983e473da6bd07daddf0d2ee} + - SENTRY_PROJECT=${SENTRY_PROJECT:-1298632} + ports: + - "${HTTP_PORT:-80}:80" + - "${HTTPS_PORT:-443}:443" + healthcheck: + test: [ "CMD-SHELL", "nc -z localhost 80 || exit 1" ] + restart: always + logging: + driver: local + options: + max-file: "30" + pyxform: + image: 'ghcr.io/getodk/pyxform-http:v1.12.2' + restart: always + secrets: + image: ghcr.io/caktus/central-secrets:latest + volumes: + - secrets:/etc/secrets + command: './generate-secrets.sh' + enketo: + image: ghcr.io/caktus/central-enketo:latest + volumes: + - secrets:/etc/secrets + restart: always + depends_on: + - secrets + - enketo_redis_main + - enketo_redis_cache + environment: + - DOMAIN=${DOMAIN} + - SUPPORT_EMAIL=${SYSADMIN_EMAIL} + - HTTPS_PORT=${HTTPS_PORT:-443} + enketo_redis_main: + image: redis:7.2 + volumes: + - ./files/enketo/redis-enketo-main.conf:/usr/local/etc/redis/redis.conf:ro + - enketo_redis_main:/data + command: + - redis-server + - /usr/local/etc/redis/redis.conf + restart: always + enketo_redis_cache: + image: redis:7.2 + volumes: + - ./files/enketo/redis-enketo-cache.conf:/usr/local/etc/redis/redis.conf:ro + - enketo_redis_cache:/data + command: + - redis-server + - /usr/local/etc/redis/redis.conf + restart: always +volumes: + secrets: + transfer: + postgres14: + enketo_redis_main: + enketo_redis_cache: diff --git a/docker-compose.yml b/docker-compose.yml index fc0b49d1..2b176674 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -35,7 +35,9 @@ services: - DKIM_KEY_PATH=/etc/exim4/dkim.key.temp restart: always service: - image: ghcr.io/caktus/central-service:gh-images + build: + context: . + dockerfile: service.dockerfile depends_on: - secrets - postgres14 @@ -45,7 +47,6 @@ services: volumes: - secrets:/etc/secrets - /data/transfer:/data/transfer - - ./files/service/config.json.template:/usr/share/odk/config.json.template environment: - DOMAIN=${DOMAIN} - SYSADMIN_EMAIL=${SYSADMIN_EMAIL} @@ -75,7 +76,11 @@ services: logging: driver: local nginx: - image: ghcr.io/caktus/central-nginx:gh-images + build: + context: . + args: + - OIDC_ENABLED=${OIDC_ENABLED:-false} + dockerfile: nginx.dockerfile depends_on: - service - enketo @@ -100,14 +105,18 @@ services: image: 'ghcr.io/getodk/pyxform-http:v1.12.2' restart: always secrets: - image: ghcr.io/caktus/central-secrets:gh-images volumes: - secrets:/etc/secrets + build: + context: . + dockerfile: secrets.dockerfile command: './generate-secrets.sh' enketo: - image: ghcr.io/caktus/central-enketo:gh-images volumes: - secrets:/etc/secrets + build: + context: . + dockerfile: enketo.dockerfile restart: always depends_on: - secrets