docker-compose.yml

version: "3.7"
volumes:
  auth-vol:
  builder-store-vol:
  gateway-vol:
  postgres-vol:
  panamax-crates-vol:
  panamax-io-index-vol:
  resource-recorder-vol:
  mongodb-vol:
networks:
  user-net:
    attachable: true
    ipam:
      driver: default
      config:
        - subnet: 10.99.0.0/16
  default:
    attachable: false
    ipam:
      driver: default
      config:
        - subnet: 10.100.0.0/16
services:
  auth:
    image: "${CONTAINER_REGISTRY}/auth:${AUTH_TAG}"
    ports:
      - 8008:8000
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==controller
    networks:
      default:
      user-net:
    volumes:
      - auth-vol:/var/lib/shuttle-auth
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    command:
      - "--db-connection-uri=${CONTROL_DB_POSTGRES_URI}"
      - "start"
      - "--address=0.0.0.0:8000"
      - "--stripe-secret-key=${STRIPE_SECRET_KEY}"
      - "--jwt-signing-private-key=${AUTH_JWTSIGNING_PRIVATE_KEY}"
    healthcheck:
      test: curl --fail http://localhost:8000/ || exit 1
      interval: 1m
      timeout: 10s
      retries: 5
      # These options are pending on an upgrade to Docker Engine version 25.0.
      # Using them will result in error because they are not handled gracefully.
      # start_period: 10s
      # start_interval: 2s
  builder:
    image: "${CONTAINER_REGISTRY}/builder:${BUILDER_TAG}"
    depends_on:
      - auth
    ports:
      - 8009:8000
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==builder
    networks:
      user-net:
    volumes:
      - builder-store-vol:/nix/store
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    command:
      - "--address=0.0.0.0:8000"
      - "--auth-uri=http://auth:8000"
  gateway:
    image: "${CONTAINER_REGISTRY}/gateway:${GATEWAY_TAG}"
    depends_on:
      - provisioner
      - auth
    ports:
      - 7999:7999
      - 8000:8000
      - 8001:8001
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==controller
    networks:
      user-net:
    volumes:
      - gateway-vol:/var/lib/shuttle
      # This image needs to run highly privileged in order to
      # orchestrate user runtimes safely
      - ${DOCKER_SOCK}:/var/run/docker.sock
      # We need to mount this directory to be able to read docker
      # stats from it. We mount it as read-only.
      # TODO: this directory will vary depending on the host OS,
      # we should make it more dynamic.
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    command:
      - "--state=/var/lib/shuttle"
      - "start"
      - "--control=0.0.0.0:8001"
      - "--user=0.0.0.0:8000"
      - "--bouncer=0.0.0.0:7999"
      - "--image=${CONTAINER_REGISTRY}/deployer:${DEPLOYER_TAG}"
      - "--prefix=shuttle_"
      - "--network-name=${STACK}_user-net"
      - "--docker-host=/var/run/docker.sock"
      - "--auth-uri=http://auth:8000"
      - "--deploys-api-key=${DEPLOYS_API_KEY}"
      - "--provisioner-host=provisioner"
      - "--builder-host=builder"
      - "--proxy-fqdn=${APPS_FQDN}"
      - "--use-tls=${USE_TLS}"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8001"]
      interval: 1m
      timeout: 15s
      retries: 15
      #start_period: 30s
  logger:
    image: "${CONTAINER_REGISTRY}/logger:${LOGGER_TAG}"
    depends_on:
      - auth
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==controller
    networks:
      user-net:
      default:
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    command:
      - "--address=0.0.0.0:8000"
      - "--db-connection-uri=${LOGGER_POSTGRES_URI}"
      - "--auth-uri=http://auth:8000"
  provisioner:
    image: "${CONTAINER_REGISTRY}/provisioner:${PROVISIONER_TAG}"
    depends_on:
      - postgres
      - mongodb
      - auth
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    networks:
      user-net:
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==provisioner
    command:
      - "--ip=0.0.0.0"
      - "--port=8000"
      - "--shared-pg-uri=postgres://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres"
      - "--shared-mongodb-uri=mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongodb:27017/admin"
      - "--internal-mongodb-address=mongodb"
      - "--internal-pg-address=postgres"
      - "--fqdn=${DB_FQDN}"
      - "--auth-uri=http://auth:8000"
  resource-recorder:
    image: "${CONTAINER_REGISTRY}/resource-recorder:${RESOURCE_RECORDER_TAG}"
    depends_on:
      - auth
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    networks:
      user-net:
    volumes:
      - resource-recorder-vol:/var/lib/shuttle
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==controller
    command:
      - "--address=0.0.0.0:8000"
      - "--state=/var/lib/shuttle"
      - "--auth-uri=http://auth:8000"
  postgres:
    image: "${CONTAINER_REGISTRY}/postgres:${POSTGRES_TAG}"
    restart: always
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    networks:
      user-net:
    volumes:
      - postgres-vol:/var/lib/postgresql/data
    ports:
      - 8002:8000
      - 5432:5432
    deploy:
      placement:
        constraints:
          - node.hostname==postgres
  mongodb:
    image: docker.io/library/mongo:5.0.10
    restart: always
    networks:
      user-net:
    volumes:
      - mongodb-vol:/data/db
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD}
    deploy:
      placement:
        constraints:
          - node.hostname==postgres
  otel-collector:
    image: "${CONTAINER_REGISTRY}/otel:${OTEL_TAG}"
    volumes:
      # Pull docker stats
      - ${DOCKER_SOCK}:/var/run/docker.sock:ro
    restart: always
    networks:
      user-net:
    environment:
      - SHUTTLE_ENV=${SHUTTLE_ENV}
      - DD_API_KEY=${DD_API_KEY}
      - DD_ENV=${DD_ENV}
      - HONEYCOMB_API_KEY=${HONEYCOMB_API_KEY}
    deploy:
      placement:
        constraints:
          - node.hostname==controller
  panamax:
    image: "${CONTAINER_REGISTRY}/panamax:${PANAMAX_TAG}"
    restart: always
    networks:
      user-net:
    volumes:
      - panamax-crates-vol:/mirror/crates
      - panamax-io-index-vol:/mirror/crates.io-index
    labels:
      deck-chores.sync-mirror.command: panamax sync /mirror
      deck-chores.sync-mirror.interval: 5 minutes
      deck-chores.sync-mirror.max: 1
    deploy:
      placement:
        constraints:
          - node.hostname==controller
  deck-chores:
    image: docker.io/funkyfuture/deck-chores:1
    restart: unless-stopped
    environment:
      TIMEZONE: UTC
    volumes:
      - ${DOCKER_SOCK}:/var/run/docker.sock
    deploy:
      placement:
        constraints:
          - node.hostname==controller