docker-compose.yml

volumes:
  simple:
  packages:
  packages-archive:
  sponsorlogos:
  policies:
  caches:
  rstuf-metadata:

services:
  db:
    image: postgres:16.1
    ports:
      # 5432 may already in use by another PostgreSQL on host
      - "5433:5432"
    environment:
      POSTGRES_HOST_AUTH_METHOD: trust  # never do this in production!
      POSTGRES_INITDB_ARGS: '--no-sync --set fsync=off --set full_page_writes=off'
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "postgres", "-d", "postgres"]
      interval: 1s
      start_period: 10s
    volumes:
      - ./dev/db/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d:z
      - ./dev/example.sql.xz:/example.sql.xz:z
      - ./dev/db/post-migrations.sql:/post-migrations.sql:z
      - ./bin/wait-for-db:/usr/local/bin/wait-for-db:z

  stripe:
    image: stripe/stripe-mock:v0.162.0
    ports:
      - "12111:12111"

  redis:
    image: redis:7.0

  localstack:
    image: localstack/localstack:3.5
    stop_signal: SIGKILL
    environment:
      SERVICES: "sqs"
      LOCALSTACK_HOST: "localstack"
      LS_LOG: "error"
    ports:
      - "4566:4566"

  opensearch:
    build:
      context: ./dev/compose/opensearch
    init: true
    healthcheck:
        test: ["CMD-SHELL", "curl -u admin:gqYeDIzbEwTTYmB7 --silent --fail http://localhost:9200/_cluster/health || exit 1"]
        interval: 1s
        start_period: 10s
    environment:
      - discovery.type=single-node
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=gqYeDIzbEwTTYmB7
      - DISABLE_INSTALL_DEMO_CONFIG=true
      - DISABLE_SECURITY_PLUGIN=true
      - DISABLE_PERFORMANCE_ANALYZER_AGENT_CLI=true
    ulimits:
      nofile:
        soft: 65536
        hard: 65536

  camo:
    image: pypa/warehouse-camo:2.0.0
    command: "/bin/go-camo --listen=0.0.0.0:9000 --header 'Access-Control-Allow-Origin: http://localhost'"
    ports:
      - "9000:9000"
    environment:
      GOCAMO_HMAC: "insecurecamokey"
      GOCAMO_MAXSIZE: 10000
      GOCAMO_MAXSIZEREDIRECT: "https://warehouse-camo.ingress.cmh1.psfhosted.org/d1e139dd79d95783a48690c79813071314e45a69/68747470733a2f2f73746f726167652e676f6f676c65617069732e636f6d2f707970692d6173736574732f696d6167652d746f6f2d6c617267652d31306d622e706e67"

  base:
    build:
      context: .
      args:
        DEVEL: "yes"
        IPYTHON: "no"
    image: warehouse:docker-compose
    environment:
      # Runs as `nobody`, override the home directory
      - PIP_CACHE_DIR=/opt/warehouse/src/dev/.pip-cache
      - PIP_TOOLS_CACHE_DIR=/opt/warehouse/src/dev/.pip-tools-cache
    volumes: &base_volumes
      # We specify paths explicitly to only add what we need, and to avoid
      # adding the entire repository.
      # The :z option fixes permission issues with SELinux by setting a
      # permissive security context.
      - ./dev:/opt/warehouse/src/dev:z
      - ./docs:/opt/warehouse/src/docs:z
      - ./warehouse:/opt/warehouse/src/warehouse:z
      - ./tests:/opt/warehouse/src/tests:z
      - ./htmlcov:/opt/warehouse/src/htmlcov:z
      - ./setup.cfg:/opt/warehouse/src/setup.cfg:z
      - ./pyproject.toml:/opt/warehouse/src/pyproject.toml:z
      # Site customization shim to enable multiprocess coverage collection in tests.
      # See: https://coverage.readthedocs.io/en/latest/subprocess.html
      - ./sitecustomize.py:/opt/warehouse/src/sitecustomize.py:z
      - packages:/var/opt/warehouse/packages
      - packages-archive:/var/opt/warehouse/packages-archive
      - sponsorlogos:/var/opt/warehouse/sponsorlogos
      - policies:/var/opt/warehouse/policies
      - simple:/var/opt/warehouse/simple
      - ./bin:/opt/warehouse/src/bin:z
      - ./requirements:/opt/warehouse/src/requirements:z
      # Included to support linters during development
      - ./gunicorn-prod.conf.py:/opt/warehouse/src/gunicorn-prod.conf.py:z
      - ./gunicorn-uploads.conf.py:/opt/warehouse/src/gunicorn-uploads.conf.py:z

  web:
    image: warehouse:docker-compose
    command: gunicorn --reload --reload-extra-file=warehouse/api/openapi.yaml -b 0.0.0.0:8000 --access-logfile - --error-logfile - warehouse.wsgi:application
    env_file: dev/environment
    pull_policy: never
    volumes: *base_volumes
    ports:
      - "${WEB_PORT:-80}:8000"
    depends_on:
      db:
        condition: service_healthy
      opensearch:
        condition: service_started
      redis:
        condition: service_started
      stripe:
        condition: service_started

  tests:
    image: warehouse:docker-compose
    pull_policy: never
    environment:
      ENCODING: "C"
    volumes: *base_volumes
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
      stripe:
        condition: service_started

  files:
    image: warehouse:docker-compose
    pull_policy: never
    working_dir: /var/opt/warehouse
    command: python -m http.server 9001
    stop_signal: SIGINT
    volumes:
      - packages:/var/opt/warehouse/packages
      - packages-archive:/var/opt/warehouse/packages-archive
      - sponsorlogos:/var/opt/warehouse/sponsorlogos
      - simple:/var/opt/warehouse/simple
      - rstuf-metadata:/var/opt/warehouse/tuf-metadata
    ports:
      - "9001:9001"

  worker:
    image: warehouse:docker-compose
    pull_policy: never
    command: hupper --shutdown-interval 10 --reload-interval 10 -m celery -A warehouse worker --beat --scheduler redbeat.RedBeatScheduler -l info
    volumes:
      - ./warehouse:/opt/warehouse/src/warehouse:z
      - packages:/var/opt/warehouse/packages
      - packages-archive:/var/opt/warehouse/packages-archive
    env_file: dev/environment
    environment:
      C_FORCE_ROOT: "1"
      FILES_BACKEND: "warehouse.packaging.services.LocalFileStorage path=/var/opt/warehouse/packages/ url=http://files:9001/packages/{path}"
      ARCHIVE_FILES_BACKEND: "warehouse.packaging.services.LocalArchiveFileStorage path=/var/opt/warehouse/packages-archive/ url=http://files:9001/packages-archive/{path}"
      SIMPLE_BACKEND: "warehouse.packaging.services.LocalSimpleStorage path=/var/opt/warehouse/simple/ url=http://files:9001/simple/{path}"

  rstuf-api:
    image: ghcr.io/repository-service-tuf/repository-service-tuf-api:v0.12.0b1
    ports:
      - 8001:80
    stop_signal: SIGKILL
    environment:
      - RSTUF_BROKER_SERVER=redis://redis/1
      - RSTUF_REDIS_SERVER=redis://redis
      - RSTUF_REDIS_SERVER_DB_RESULT=1
      - RSTUF_REDIS_SERVER_DB_REPO_SETTINGS=2
    depends_on:
      redis:
        condition: service_started

  rstuf-worker:
    image: ghcr.io/repository-service-tuf/repository-service-tuf-worker:v0.14.0b1
    volumes:
      - rstuf-metadata:/var/opt/repository-service-tuf/storage
      - ./dev/rstuf/keys/online:/keyvault
    stop_signal: SIGKILL
    environment:
      - RSTUF_STORAGE_BACKEND=LocalStorage
      - RSTUF_ONLINE_KEY_DIR=/keyvault
      - RSTUF_LOCAL_STORAGE_BACKEND_PATH=/var/opt/repository-service-tuf/storage
      - RSTUF_BROKER_SERVER=redis://redis/1
      - RSTUF_REDIS_SERVER=redis://redis
      - RSTUF_REDIS_SERVER_DB_RESULT=1
      - RSTUF_REDIS_SERVER_DB_REPO_SETTINGS=2
      - RSTUF_SQL_SERVER=postgresql://postgres@db:5432/rstuf
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started

  static:
    build:
      context: .
      target: static-deps
    image: warehouse:docker-compose-static
    ports:
      - "35729:35729" # LiveReload
    environment:
      NODE_ENV: "development"
    command: ["npm", "run", "watch"]
    stop_signal: SIGKILL
    volumes:
      - ./warehouse:/opt/warehouse/src/warehouse:z
      - ./webpack.config.js:/opt/warehouse/src/webpack.config.js:z
      - ./babel.config.js:/opt/warehouse/src/babel.config.js:z
      - ./.stylelintrc.json:/opt/warehouse/src/.stylelintrc.json:z
      - ./tests/frontend:/opt/warehouse/src/tests/frontend:z
      - ./bin:/opt/warehouse/src/bin:z
      - ./package.json:/opt/warehouse/src/package.json:z
      - ./package-lock.json:/opt/warehouse/src/package-lock.json:z
      - caches:/opt/warehouse/src/.stylelintcache

  maildev:
    image: maildev/maildev:2.1.0
    ports:
      - "1080:1080"
      - "1025:1025"

  notdatadog:
    image: warehouse:docker-compose
    pull_policy: never
    command: python /opt/warehouse/dev/notdatadog.py 0.0.0.0:8125
    stop_signal: SIGINT
    environment:
      METRICS_OUTPUT: "false"
    ports:
      - "8125:8125/udp"
    volumes:
      - ./dev/notdatadog.py:/opt/warehouse/dev/notdatadog.py

  notgithub:
    image: ewjoachim/notgithub-token-scanning
    environment:
      NOTGITHUB_DEFAULT_URL: "http://web:8000/_/github/disclose-token"
    ports:
      - "8964:8000"

  dev-docs:
    build:
      context: .
      target: docs
    image: warehouse:docker-compose-docs
    command: sphinx-autobuild --host 0.0.0.0 "docs/dev/" "docs/dev/_build"
    volumes:
      - ./bin:/opt/warehouse/src/bin:z
      - ./docs:/opt/warehouse/src/docs:z
    ports:
      - "10002:8000"

  user-docs:
    image: warehouse:docker-compose-docs
    pull_policy: never
    command: mkdocs serve -a 0.0.0.0:8000 -f docs/mkdocs-user-docs.yml
    stop_signal: SIGINT
    volumes:
      - ./bin:/opt/warehouse/src/bin:z
      - ./docs/mkdocs-user-docs.yml:/opt/warehouse/src/docs/mkdocs-user-docs.yml:z
      - ./docs:/opt/warehouse/src/docs:z
    ports:
      - "10000:8000"

  blog:
    image: warehouse:docker-compose-docs
    pull_policy: never
    command: mkdocs serve -a 0.0.0.0:8000 -f docs/mkdocs-blog.yml
    stop_signal: SIGINT
    volumes:
      # we mount git because rss, thanks feed nerds
      - ./.git:/opt/warehouse/src/.git:ro
      - ./bin:/opt/warehouse/src/bin:z
      - ./docs:/opt/warehouse/src/docs:z
    ports:
      - "10001:8000"