docker-compose.yml

# Production / evaluation configuration for SODAR
version: "3.8"

# Default configuration for SODAR
x-sodar: &default-sodar
  image: ghcr.io/bihealth/sodar-server:${SODAR_SERVER_VERSION}
  environment: &default-sodar-environment
    WAIT_HOSTS: "postgres:5432, redis:6379"
    LC_ALL: en_US.UTF-8
    DJANGO_ALLOWED_HOSTS: "*"
    DJANGO_SECRET_KEY: ${SODAR_DJANGO_SECRET_KEY}
    DJANGO_SETTINGS_MODULE: config.settings.production
    CELERY_BROKER_URL: redis://redis:6379/0
    CELERY_CHDIR: /usr/src/app
    CELERY_CREATE_DIRS: "1"
    REDIS_URL: redis://redis:6379/0
    DATABASE_URL: postgresql://${POSTGRES_USERNAME}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}/sodar
    CONN_MAX_AGE: "0"
    LOGGING_LEVEL: ${SODAR_LOGGING_LEVEL}
    LOGGING_FILE_PATH: /var/log/sodar.log
    ENABLED_BACKEND_PLUGINS: ${SODAR_ENABLED_BACKEND_PLUGINS}
    SITE_INSTANCE_TITLE: ${SODAR_SITE_INSTANCE_TITLE}
    SITE_SUBTITLE: ${SODAR_SITE_SUBTITLE}
    ADMINS: ${SODAR_ADMINS}
    PROJECTROLES_SEND_EMAIL: ${SODAR_PROJECTROLES_SEND_EMAIL}
    EMAIL_SENDER: ${SODAR_EMAIL_SENDER}
    EMAIL_SUBJECT_PREFIX: ${SODAR_EMAIL_SUBJECT_PREFIX}
    EMAIL_URL: ${SODAR_EMAIL_URL}
    SODAR_API_DEFAULT_HOST: ${SODAR_API_DEFAULT_HOST}
    PROJECTROLES_EMAIL_HEADER: ${SODAR_PROJECTROLES_EMAIL_HEADER}
    PROJECTROLES_EMAIL_FOOTER: ${SODAR_PROJECTROLES_EMAIL_FOOTER}
    PROJECTROLES_DEFAULT_ADMIN: ${SODAR_PROJECTROLES_DEFAULT_ADMIN}
    PROJECTROLES_ALLOW_LOCAL_USERS: ${SODAR_PROJECTROLES_ALLOW_LOCAL_USERS}
    PROJECTROLES_ALLOW_ANONYMOUS: ${SODAR_PROJECTROLES_ALLOW_ANONYMOUS}
    PROJECTROLES_DISABLE_CDN_INCLUDES: "1"
    PROJECTROLES_CUSTOM_JS_INCLUDES: /static/local/js/jquery-3.5.1.min.js,/static/local/js/bootstrap.bundle.min.js,/static/local/js/tether.js,/static/local/js/shepherd.min.js,/static/local/js/clipboard.min.js
    PROJECTROLES_CUSTOM_CSS_INCLUDES: /static/local/css/bootstrap.min.css
    CUSTOM_STATIC_DIR: /usr/src/app/local-static
    ENABLE_LDAP: ${SODAR_ENABLE_LDAP}
    LDAP_DEBUG: ${SODAR_LDAP_DEBUG}
    AUTH_LDAP_SERVER_URI: ${SODAR_AUTH_LDAP_SERVER_URI}
    AUTH_LDAP_BIND_PASSWORD: ${SODAR_AUTH_LDAP_BIND_PASSWORD}
    AUTH_LDAP_BIND_DN: ${SODAR_AUTH_LDAP_BIND_DN}
    AUTH_LDAP_USER_SEARCH_BASE: ${SODAR_AUTH_LDAP_USER_SEARCH_BASE}
    AUTH_LDAP_USERNAME_DOMAIN: ${SODAR_AUTH_LDAP_USERNAME_DOMAIN}
    AUTH_LDAP_DOMAIN_PRINTABLE: ${SODAR_AUTH_LDAP_DOMAIN_PRINTABLE}
    AUTH_LDAP_START_TLS: ${SODAR_AUTH_LDAP_START_TLS}
    AUTH_LDAP_CA_CERT_FILE: ${SODAR_AUTH_LDAP_CA_CERT_FILE}
    AUTH_LDAP_USER_FILTER: ${SODAR_AUTH_LDAP_USER_FILTER}
    ENABLE_LDAP_SECONDARY: ${SODAR_ENABLE_LDAP_SECONDARY}
    AUTH_LDAP2_SERVER_URI: ${SODAR_AUTH_LDAP2_SERVER_URI}
    AUTH_LDAP2_BIND_PASSWORD: ${SODAR_AUTH_LDAP2_BIND_PASSWORD}
    AUTH_LDAP2_BIND_DN: ${SODAR_AUTH_LDAP2_BIND_DN}
    AUTH_LDAP2_USER_SEARCH_BASE: ${SODAR_AUTH_LDAP2_USER_SEARCH_BASE}
    AUTH_LDAP2_USERNAME_DOMAIN: ${SODAR_AUTH_LDAP2_USERNAME_DOMAIN}
    AUTH_LDAP2_DOMAIN_PRINTABLE: ${SODAR_AUTH_LDAP2_DOMAIN_PRINTABLE}
    AUTH_LDAP2_START_TLS: ${SODAR_AUTH_LDAP2_START_TLS}
    AUTH_LDAP2_CA_CERT_FILE: ${SODAR_AUTH_LDAP2_CA_CERT_FILE}
    AUTH_LDAP2_USER_FILTER: ${SODAR_AUTH_LDAP2_USER_FILTER}
    LDAP_ALT_DOMAINS: ${SODAR_LDAP_ALT_DOMAINS}
    ENABLE_IRODS: ${SODAR_ENABLE_IRODS}
    IRODS_HOST: ${IRODS_HOST}
    IRODS_HOST_FQDN: ${IRODS_HOST_FQDN}
    IRODS_PORT: ${IRODS_PORT}
    IRODS_USER: ${IRODS_USER}
    IRODS_PASS: ${IRODS_PASS}
    IRODS_ZONE: ${IRODS_ZONE}
    IRODS_ROOT_PATH: ${IRODS_ROOT_PATH}
    IRODS_ENV_BACKEND: ${IRODS_ENV_BACKEND}
    IRODS_ENV_CLIENT: ${IRODS_ENV_CLIENT}
    IRODS_CERT_PATH: ${IRODS_CERT_PATH}
    IRODS_WEBDAV_ENABLED: ${SODAR_IRODS_WEBDAV_ENABLED}
    IRODS_WEBDAV_URL: ${SODAR_IRODS_WEBDAV_URL}
    IRODS_WEBDAV_URL_ANON: ${SODAR_IRODS_WEBDAV_URL_ANON}
    IRODS_WEBDAV_USER_ANON: ${SODAR_IRODS_WEBDAV_USER_ANON}
    IRODS_WEBDAV_IGV_PROXY: ${SODAR_IRODS_WEBDAV_IGV_PROXY}
    IRODS_SODAR_AUTH: ${IRODS_SODAR_AUTH}
    BASICAUTH_REALM: ${SODAR_BASICAUTH_REALM}
    SHEETS_IGV_OMIT_BAM: ${SODAR_SHEETS_IGV_OMIT_BAM}
    SHEETS_IGV_OMIT_VCF: ${SODAR_SHEETS_IGV_OMIT_VCF}
    LANDINGZONES_DISABLE_FOR_USERS: ${SODAR_LANDINGZONES_DISABLE_FOR_USERS}
    ISATEMPLATES_ENABLE_CUBI_TEMPLATES: ${SODAR_ISATEMPLATES_ENABLE_CUBI_TEMPLATES}
    TASKFLOW_LOCK_RETRY_COUNT: ${TASKFLOW_LOCK_RETRY_COUNT}
    TASKFLOW_LOCK_RETRY_INTERVAL: ${TASKFLOW_LOCK_RETRY_INTERVAL}
    TASKFLOW_IRODS_CONN_TIMEOUT: ${TASKFLOW_IRODS_CONN_TIMEOUT}
    ENABLE_SENTRY: ${SODAR_ENABLE_SENTRY}
    SENTRY_DSN: ${SODAR_SENTRY_DSN}

  networks:
    - sodar
  restart: unless-stopped

services:
  traefik:
    image: traefik:v2.3.1
    ports:
      - "80:80"
      - "443:443"
    networks:
      - sodar
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
    volumes:
      - type: bind
        source: ./volumes/traefik/letsencrypt
        target: /letsencrypt
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: true

  postgres:
    image: postgres:11
    shm_size: 512mb
    environment:
      POSTGRES_USER: ${POSTGRES_USERNAME}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: sodar
    networks:
      - sodar
    restart: unless-stopped
    volumes:
      - type: bind
        source: ./volumes/postgres/data
        target: /var/lib/postgresql/data

  redis:
    image: redis:6
    networks:
      - sodar
    restart: unless-stopped
    volumes:
      - type: bind
        source: ./volumes/redis/data
        target: /data

  sodar-web:
    <<: *default-sodar
    networks:
      - sodar
    restart: unless-stopped
    depends_on:
      - postgres
      - redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.xforward.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.sodar-web.entrypoints=websecure"
      - "traefik.http.routers.sodar-web.middlewares=xforward"
      - "traefik.http.routers.sodar-web.rule=HostRegexp(`{catchall:.+}`)"
      - "traefik.http.services.sodar-web.loadbalancer.server.port=8080"
      - "traefik.http.routers.sodar-web.tls=true"
    volumes:
      - type: bind  # Template include dir
        source: ./config/sodar/templates
        target: /usr/src/app/sodar/templates/include
      - type: bind  # Samplesheets config dir
        source: ./config/sodar/samplesheets
        target: /usr/src/app/samplesheets/config
      - type: bind  # Traefik configuration for shared certs
        source: ./config/traefik/tls
        target: /etc/traefik/tls
      - type: bind  # LDAP CA certificate
        source: ./config/ldap/ldap_ca_cert.pem
        target: /etc/ssl/certs/ldap_ca_cert.pem

  sodar-celerybeat:
    <<: *default-sodar
    command: ["celerybeat"]
    networks:
      - sodar
    depends_on:
      - sodar-web
    restart: unless-stopped

  sodar-celeryd-default:
    <<: *default-sodar
    command: ["celeryd"]
    environment:
      <<: *default-sodar-environment
      CELERY_QUEUES: default
      CELERY_WORKERS: 16
    depends_on:
      - sodar-web
    networks:
      - sodar
    restart: unless-stopped
    volumes:
      - type: bind
        source: ./config/sodar
        target: /etc/sodar

networks:
  sodar:
    driver_opts:
      com.docker.network.bridge.name: ${NETWORK_BRIDGE_NAME:-br-sodar}