docker-compose.yml

---
version: "3.7"

x-environment: &py-enviroment
  DEBUG: "False"
  NODE_ENV: "production"
  DEV_ENV: "True" # necessary to have nginx connect to web container
  SECRET_KEY: local_unsafe_key # pragma: allowlist secret
  DATABASE_URL: postgres://postgres:postgres@db:5432/postgres # pragma: allowlist secret
  OCW_STUDIO_SECURE_SSL_REDIRECT: "False"
  OCW_STUDIO_DB_DISABLE_SSL: "True"
  CELERY_TASK_ALWAYS_EAGER: "False"
  CELERY_BROKER_URL: redis://redis:6379/4
  CELERY_RESULT_BACKEND: redis://redis:6379/4
  DOCKER_HOST: ${DOCKER_HOST:-missing}
  WEBPACK_DEV_SERVER_HOST: ${WEBPACK_DEV_SERVER_HOST:-localhost}
  DJANGO_SETTINGS_MODULE: "main.settings"
  PYTHONPATH: "."

networks:
  default-network:
    driver: bridge
  concourse-network:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: "10.1.0.0/24"
services:
  db:
    image: postgres:16.3
    ports:
    - "5431:5432"
    environment:
      POSTGRES_PASSWORD: postgres # pragma: allowlist secret
    networks:
      default-network:
      concourse-network:
        ipv4_address: 10.1.0.103

  redis:
    image: redis:6.2.14
    ports:
    - "6379"
    networks:
    - default-network
    - concourse-network

  nginx:
    image: nginx:1.27.0
    environment:
      AWS_PREVIEW_BUCKET_NAME: $AWS_PREVIEW_BUCKET_NAME
      AWS_PUBLISH_BUCKET_NAME: $AWS_PUBLISH_BUCKET_NAME
      AWS_TEST_BUCKET_NAME: $AWS_TEST_BUCKET_NAME
    ports:
    - "8043:8043"
    - "8044:8044"
    - "8045:8045"
    - "8046:8046"
    links:
    - web
    - s3
    networks:
      default-network:
      concourse-network:
        ipv4_address: 10.1.0.102
    volumes:
    - ./config/nginx.conf:/etc/nginx/templates/web.conf.template
    - ./:/src

  web:
    build:
      context: .
      dockerfile: Dockerfile
    command: >
      /bin/bash -c '
      sleep 3 &&
      python3 manage.py collectstatic --noinput &&
      python3 manage.py migrate --noinput &&
      uwsgi uwsgi.ini --honour-stdin'
    stdin_open: true
    tty: true
    ports:
    - "8041:8041"
    environment:
      <<: *py-enviroment
      PORT: 8041
      DEBUG: "True"
      NODE_ENV: "development"
      WEBPACK_USE_DEV_SERVER: "True"
      WEBPACK_DEV_SERVER_PORT: 8042
    env_file: .env
    links:
    - db
    - redis
    networks:
    - default-network
    - concourse-network
    volumes:
    - .:/src
    - django_media:/var/media

  watch:
    image: node:20.18.0
    working_dir: /src
    command: >
      /bin/bash -c './webpack_dev_server.sh --install'
    ports:
    - "8042:8042"
    environment:
      NODE_ENV: "development"
      DOCKER_HOST: ${DOCKER_HOST:-missing}
      CONTAINER_NAME: "watch"
    env_file: .env
    networks:
    - default-network
    volumes:
    - .:/src
    - yarn-cache:/home/mitodl/.cache/yarn

  celery:
    build:
      context: .
      dockerfile: Dockerfile
    environment:
      <<: *py-enviroment
      DEBUG: "True"
      NODE_ENV: "development"
      WEBPACK_USE_DEV_SERVER: "True"
      WEBPACK_DEV_SERVER_PORT: 8042
    env_file: .env
    command: >
      /bin/bash -c '
      sleep 3;
      celery -A main.celery:app worker -Q publish,batch,default, -B -l ${OCW_STUDIO_LOG_LEVEL:-INFO}'
    links:
    - db
    - redis
    networks:
    - default-network
    - concourse-network
    volumes:
    - .:/src
    - django_media:/var/media

  concourse-db:
    image: postgres:latest
    environment:
      POSTGRES_DB: concourse
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres # pragma: allowlist secret
      PGDATA: /database
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
    - default-network

  concourse-keys:
    image: gotechnies/alpine-ssh
    entrypoint: /scripts/keys.sh
    healthcheck:
      test: "exit 0"
    volumes:
    - ./scripts/concourse:/scripts
    - concourse-keys:/concourse-keys

  concourse:
    image: concourse/concourse:7.11
    command: web
    privileged: true
    depends_on:
      concourse-db:
        condition: service_healthy
      concourse-keys:
        condition: service_completed_successfully
    ports:
    - "8080:8080"
    - "2222:2222"
    stdin_open: true
    tty: true
    environment:
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      CONCOURSE_SESSION_SIGNING_KEY: /concourse-keys/session_signing_key
      CONCOURSE_TSA_AUTHORIZED_KEYS: /concourse-keys/authorized_worker_keys
      CONCOURSE_TSA_HOST_KEY: /concourse-keys/tsa_host_key
      CONCOURSE_POSTGRES_HOST: concourse-db
      CONCOURSE_POSTGRES_USER: postgres
      CONCOURSE_POSTGRES_PASSWORD: postgres # pragma: allowlist secret
      CONCOURSE_POSTGRES_DATABASE: concourse
      CONCOURSE_EXTERNAL_URL: ${CONCOURSE_URL:-http://concourse:8080}
      CONCOURSE_ADD_LOCAL_USER: ${CONCOURSE_USER_NAME:-test}:${CONCOURSE_PASSWORD:-test} # pragma: allowlist secret
      CONCOURSE_MAIN_TEAM_LOCAL_USER: ${CONCOURSE_USER_NAME:-test}
      CONCOURSE_WORKER_BAGGAGECLAIM_DRIVER: overlay
      CONCOURSE_X_FRAME_OPTIONS: allow
      CONCOURSE_CONTENT_SECURITY_POLICY: "*"
      CONCOURSE_CLUSTER_NAME: ocw
      CONCOURSE_WORKER_RUNTIME: "containerd"
      CONCOURSE_ENABLE_PIPELINE_INSTANCES: "true"
      CONCOURSE_ENABLE_ACROSS_STEP: "true"
      CONCOURSE_GC_ONE_OFF_GRACE_PERIOD: "5m"
      CONCOURSE_GC_FAILED_GRACE_PERIOD: "5m"
      CONCOURSE_GC_MISSING_GRACE_PERIOD: "5m"
      CONCOURSE_GC_HIJACK_GRACE_PERIOD: "5m"
    links:
    - web
    - nginx
    - s3
    volumes:
    - concourse-keys:/concourse-keys
    networks:
      default-network:
      concourse-network:
        ipv4_address: 10.1.0.101

  concourse-worker:
    image: concourse/concourse:7.11
    command: worker
    privileged: true
    depends_on:
      concourse-db:
        condition: service_healthy
      concourse-keys:
        condition: service_completed_successfully
    links: [concourse]
    stop_signal: SIGUSR2
    environment:
      CONCOURSE_TSA_HOST: concourse:2222
      CONCOURSE_TSA_PUBLIC_KEY: /concourse-keys/tsa_host_key.pub
      CONCOURSE_TSA_WORKER_PRIVATE_KEY: /concourse-keys/worker_key
      CONCOURSE_RUNTIME: "containerd"
      CONCOURSE_CONTAINERD_MAX_CONTAINERS: 0
      CONCOURSE_CONTAINERD_ALLOW_HOST_ACCESS: "true"
      CONCOURSE_CONTAINERD_DNS_PROXY_ENABLE: "true"
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    volumes:
    - concourse-keys:/concourse-keys
    networks:
      default-network:
      concourse-network:
        ipv4_address: 10.1.0.104

  s3:
    image: minio/minio
    ports:
    - "9000:9000"
    - "9001:9001"
    volumes:
    - ./s3:/data
    environment:
      MINIO_ROOT_USER: $MINIO_ROOT_USER
      MINIO_ROOT_PASSWORD: $MINIO_ROOT_PASSWORD
    command: server --address 0.0.0.0:9000 --console-address 0.0.0.0:9001 /data
    healthcheck:
      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9000' || exit 1
      interval: 5s
      retries: 1
      start_period: 5s
      timeout: 5s
    networks:
      default-network:
      concourse-network:
        ipv4_address: 10.1.0.100
  create-buckets:
    image: minio/mc
    depends_on:
      s3:
        condition: service_healthy
    environment:
      MINIO_ROOT_USER: $MINIO_ROOT_USER
      MINIO_ROOT_PASSWORD: $MINIO_ROOT_PASSWORD
      AWS_STORAGE_BUCKET_NAME: $AWS_STORAGE_BUCKET_NAME
      AWS_PREVIEW_BUCKET_NAME: $AWS_PREVIEW_BUCKET_NAME
      AWS_PUBLISH_BUCKET_NAME: $AWS_PUBLISH_BUCKET_NAME
      AWS_OFFLINE_PREVIEW_BUCKET_NAME: $AWS_OFFLINE_PREVIEW_BUCKET_NAME
      AWS_OFFLINE_PUBLISH_BUCKET_NAME: $AWS_OFFLINE_PUBLISH_BUCKET_NAME
      AWS_ARTIFACTS_BUCKET_NAME: $AWS_ARTIFACTS_BUCKET_NAME
    restart: on-failure
    entrypoint: >
      /bin/sh -c "
      /usr/bin/mc alias set minio http://10.1.0.100:9000 $MINIO_ROOT_USER $MINIO_ROOT_PASSWORD;
      /usr/bin/mc mb minio/$AWS_STORAGE_BUCKET_NAME;
      /usr/bin/mc anonymous set public minio/$AWS_STORAGE_BUCKET_NAME;
      /usr/bin/mc mb minio/$AWS_PREVIEW_BUCKET_NAME;
      /usr/bin/mc anonymous set public minio/$AWS_PREVIEW_BUCKET_NAME;
      /usr/bin/mc mb minio/$AWS_PUBLISH_BUCKET_NAME;
      /usr/bin/mc anonymous set public minio/$AWS_PUBLISH_BUCKET_NAME;
      /usr/bin/mc mb minio/$AWS_TEST_BUCKET_NAME;
      /usr/bin/mc anonymous set public minio/$AWS_TEST_BUCKET_NAME;
      /usr/bin/mc mb minio/$AWS_OFFLINE_PREVIEW_BUCKET_NAME;
      /usr/bin/mc anonymous set public minio/$AWS_OFFLINE_PREVIEW_BUCKET_NAME;
      /usr/bin/mc mb minio/$AWS_OFFLINE_PUBLISH_BUCKET_NAME;
      /usr/bin/mc anonymous set public minio/$AWS_OFFLINE_PUBLISH_BUCKET_NAME;
      /usr/bin/mc mb minio/$AWS_OFFLINE_TEST_BUCKET_NAME;
      /usr/bin/mc anonymous set public minio/$AWS_OFFLINE_TEST_BUCKET_NAME;
      /usr/bin/mc mb minio/$AWS_ARTIFACTS_BUCKET_NAME;
      /usr/bin/mc anonymous set public minio/$AWS_ARTIFACTS_BUCKET_NAME;
      /usr/bin/mc version enable minio/$AWS_ARTIFACTS_BUCKET_NAME;
      "
    networks:
    - concourse-network

volumes:
  django_media: {}
  yarn-cache: {}
  concourse-keys: {}