docker-compose.yml

version: '3.3'

services:

  # TSD simulation
  tsd:
    image: uiobmi/tsd-stub:latest
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - CERT_PASSWORD=${SERVER_CERT_PASSWORD}
    secrets:
      - source: rootCA.pem
        target: /etc/ega/ssl/CA.cert
      - source: server.p12
        target: /etc/ega/ssl/server.cert
    volumes:
      - tsd:/tsd/p11/data/durable/file-import/

  db:
    image: neicnordic/sda-db:latest
    ports:
      - 5432:5432
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - DB_LEGA_IN_PASSWORD
      - DB_LEGA_OUT_PASSWORD
      - PGDATA=/ega/data
      - PG_SERVER_CERT=/etc/ega/pg.cert
      - PG_SERVER_KEY=/etc/ega/pg.key
      - PG_CA=/etc/ega/CA.cert
      - PG_VERIFY_PEER=1
    secrets:
      - source: server.pem
        target: /etc/ega/pg.cert
        uid: '70'
        gid: '70'
        mode: 0600
      - source: server-key.pem
        target: /etc/ega/pg.key
        uid: '70'
        gid: '70'
        mode: 0600
      - source: rootCA.pem
        target: /etc/ega/CA.cert
        uid: '70'
        gid: '70'
        mode: 0600
    volumes:
      - db:/ega

  # Public stack
  proxy:
    image: uiobmi/localega-tsd-proxy:latest
    ports:
      - 443:8080
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - ROOT_CERT_PASSWORD
      - SERVER_CERT_PASSWORD
      - CLIENT_CERT_PASSWORD
      - CLIENT_ID=test
      - CLIENT_SECRET=test
      - CEGA_USERNAME
      - CEGA_PASSWORD
      - TSD_HOST
      - TSD_ACCESS_KEY
    secrets:
      - source: rootCA.p12
        target: /etc/ega/ssl/CA.cert
      - source: server.p12
        target: /etc/ega/ssl/server.cert
      - source: client.p12
        target: /etc/ega/ssl/client.cert
      - source: jwt.pub.pem
        target: /etc/ega/jwt/passport.pem
      - source: jwt.pub.pem
        target: /etc/ega/jwt/visa.pem

  public-mq:
    image: uiobmi/localega-broker-public:latest
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - USER_NAME=${PRIVATE_BROKER_USER}
      - PASSWORD_HASH=${PRIVATE_BROKER_HASH}
      - PRIVATE_CONNECTION
      - CEGA_CONNECTION
    secrets:
      - source: server.pem
        target: /etc/rabbitmq/ssl.cert
      - source: server-key.pem
        target: /etc/rabbitmq/ssl.key
      - source: rootCA.pem
        target: /etc/rabbitmq/CA.cert
      - source: client.pem
        target: /etc/ega/ssl.cert
      - source: client-key.pem
        target: /etc/ega/ssl.key

  # Private stack
  private-mq:
    image: uiobmi/localega-broker-private:latest
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - USER_NAME=${PRIVATE_BROKER_USER}
      - PASSWORD_HASH=${PRIVATE_BROKER_HASH}
    secrets:
      - source: server.pem
        target: /etc/rabbitmq/ssl.cert
      - source: server-key.pem
        target: /etc/rabbitmq/ssl.key
      - source: rootCA.pem
        target: /etc/rabbitmq/CA.cert

  vault:
    image: minio/minio:latest
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - MINIO_ACCESS_KEY
      - MINIO_SECRET_KEY
    secrets:
      - source: server.pem
        target: /root/.minio/certs/public.crt
      - source: server-key.pem
        target: /root/.minio/certs/private.key
      - source: rootCA.pem
        target: /root/.minio/CAs/LocalEGA.crt
    volumes:
      - vault:/data
    command: server /data

  ingest:
    image: neicnordic/sda-base:latest
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    secrets:
      - source: conf.ini
        target: /etc/ega/conf.ini
      - source: client.pem
        target: /etc/ega/ssl.cert
      - source: client-key.pem
        target: /etc/ega/ssl.key
        uid: '1000'
        gid: '1000'
        mode: 0600
      - source: rootCA.pem
        target: /etc/ega/CA.cert
      - source: logstash-logger.yaml
        target: /etc/ega/logstash-logger.yaml
    volumes:
      - tsd:/ega/inbox
    user: lega
    entrypoint: ["ega-ingest"]

  verify:
    image: neicnordic/sda-base:latest
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - S3_ACCESS_KEY=${MINIO_ACCESS_KEY}
      - S3_SECRET_KEY=${MINIO_SECRET_KEY}
    secrets:
      - source: conf.ini
        target: /etc/ega/conf.ini
      - source: ega.sec.pem
        target: /etc/ega/ega.sec
        uid: '1000'
        gid: '1000'
        mode: 0600
      - source: client.pem
        target: /etc/ega/ssl.cert
      - source: client-key.pem
        target: /etc/ega/ssl.key
        uid: '1000'
        gid: '1000'
        mode: 0600
      - source: rootCA.pem
        target: /etc/ega/CA.cert
      - source: logstash-logger.yaml
        target: /etc/ega/logstash-logger.yaml
    user: lega
    entrypoint: ["ega-verify"]

  finalize:
    image: neicnordic/sda-base:latest
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    secrets:
      - source: conf.ini
        target: /etc/ega/conf.ini
      - source: client.pem
        target: /etc/ega/ssl.cert
      - source: client-key.pem
        target: /etc/ega/ssl.key
        uid: '1000'
        gid: '1000'
        mode: 0600
      - source: rootCA.pem
        target: /etc/ega/CA.cert
      - source: logstash-logger.yaml
        target: /etc/ega/logstash-logger.yaml
    user: lega
    entrypoint: ["ega-finalize"]

  doa:
    image: neicnordic/sda-doa:latest
    ports:
      - 8080:8080
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - S3_PORT
      - KEYSTORE_PASSWORD=${SERVER_CERT_PASSWORD}
      - DB_INSTANCE=${DB_HOST}
      - POSTGRES_DB=${DB_DATABASE_NAME}
      - POSTGRES_PASSWORD=${DB_LEGA_OUT_PASSWORD}
      - S3_ACCESS_KEY=${MINIO_ACCESS_KEY}
      - S3_SECRET_KEY=${MINIO_SECRET_KEY}
      - LOGSTASH_HOST
      - LOGSTASH_PORT
    secrets:
      - source: rootCA.pem
        target: /etc/ega/ssl/CA.cert
      - source: rootCA.pem
        target: /etc/ssl/certs/ca-certificates.crt
      - source: server.p12
        target: /etc/ega/ssl/server.cert
      - source: client.pem
        target: /etc/ega/ssl/client.cert
      - source: client-key.der
        target: /etc/ega/ssl/client.key
      - source: jwt.pub.pem
        target: /etc/ega/jwt/passport.pem
      - source: jwt.pub.pem
        target: /etc/ega/jwt/visa.pem
      - source: ega.sec.pem
        target: /etc/ega/crypt4gh/key.pem
      - source: ega.sec.pass
        target: /etc/ega/crypt4gh/key.pass

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.1
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - ELASTIC_PASSWORD
      - ES_JAVA_OPTS=-Xmx512m -Xms512m
      - discovery.type=single-node
    secrets:
      - source: rootCA.pem
        target: /usr/share/elasticsearch/config/CA.cert
      - source: server.pem
        target: /usr/share/elasticsearch/config/server.cert
      - source: server-key.pem
        target: /usr/share/elasticsearch/config/server.key
      - source: elasticsearch.yml
        target: /usr/share/elasticsearch/config/elasticsearch.yml
    volumes:
      - es:/usr/share/elasticsearch/data

  logstash:
    image: docker.elastic.co/logstash/logstash:7.5.1
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    environment:
      - LS_JAVA_OPTS=-Xmx512m -Xms512m
    secrets:
      - source: rootCA.pem
        target: /etc/ega/ssl/CA.cert
      - source: logstash.yml
        target: /usr/share/logstash/config/logstash.yml
      - source: logstash.conf
        target: /usr/share/logstash/pipeline/logstash.conf

  kibana:
    image: docker.elastic.co/kibana/kibana:7.5.1
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        window: 120s
    ports:
      - 5601:5601
    secrets:
      - source: rootCA.pem
        target: /etc/ega/ssl/CA.cert
      - source: server.pem
        target: /etc/ega/ssl/server.cert
      - source: server-key.pem
        target: /etc/ega/ssl/server.key
      - source: client.pem
        target: /etc/ega/ssl/client.cert
      - source: client-key.pem
        target: /etc/ega/ssl/client.key
      - source: kibana.yml
        target: /usr/share/kibana/config/kibana.yml

volumes:
  tsd:
  db:
  vault:
  es:

secrets:
  conf.ini:
    external: true
  rootCA.pem:
    external: true
  rootCA.p12:
    external: true
  server.pem:
    external: true
  server-key.pem:
    external: true
  server.p12:
    external: true
  client.pem:
    external: true
  client-key.pem:
    external: true
  client-key.der:
    external: true
  client.p12:
    external: true
  ega.sec.pem:
    external: true
  ega.sec.pass:
    external: true
  ega.pub.pem:
    external: true
  jwt.pub.pem:
    external: true
  kibana.yml:
    external: true
  elasticsearch.yml:
    external: true
  logstash.yml:
    external: true
  logstash.conf:
    external: true
  logstash-logger.yaml:
    external: true