docker-compose.yml

version: "3.7"
volumes:
  auth-vol:
  gateway-vol:
  postgres-vol:
  resource-recorder-vol:
  mongodb-vol:
networks:
  user-net:
    attachable: true
    ipam:
      driver: default
      config:
        - subnet: 10.99.0.0/16
  default:
    attachable: false
    ipam:
      driver: default
      config:
        - subnet: 10.100.0.0/16
services:
  auth:
    image: "${CONTAINER_REGISTRY}/auth:${AUTH_TAG}"
    depends_on:
      - permit-pdp
    ports:
      - 8008:8000
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==controller
    networks:
      default:
      user-net:
    volumes:
      - auth-vol:/var/lib/shuttle-auth
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    command:
      - "--db-connection-uri=${CONTROL_DB_POSTGRES_URI}"
      - "start"
      - "--address=0.0.0.0:8000"
      - "--stripe-secret-key=${STRIPE_SECRET_KEY}"
      - "--jwt-signing-private-key=${AUTH_JWTSIGNING_PRIVATE_KEY}"
      - "--permit-api-uri=https://api.eu-central-1.permit.io"
      - "--permit-pdp-uri=http://permit-pdp:7000"
      - "--permit-env=${SHUTTLE_ENV}"
      - "--permit-api-key=${PERMIT_API_KEY}"
    healthcheck:
      test: curl -f -s http://localhost:8000
      interval: 1m
      timeout: 10s
      retries: 5
      # These options are pending on an upgrade to Docker Engine version 25.0.
      # Using them will result in error because they are not handled gracefully.
      # start_period: 10s
      # start_interval: 2s
  gateway:
    image: "${CONTAINER_REGISTRY}/gateway:${GATEWAY_TAG}"
    depends_on:
      - provisioner
      - auth
      - permit-pdp
    ports:
      - 7999:7999
      - 8000:8000
      - 8001:8001
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==controller
    networks:
      user-net:
    volumes:
      - gateway-vol:/var/lib/shuttle
      # This image needs to run highly privileged in order to
      # orchestrate user runtimes safely
      - ${DOCKER_SOCK}:/var/run/docker.sock
      # We need to mount this directory to be able to read docker
      # stats from it. We mount it as read-only.
      # TODO: this directory will vary depending on the host OS,
      # we should make it more dynamic.
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    command:
      - "--state=/var/lib/shuttle"
      - "start"
      - "--control=0.0.0.0:8001"
      - "--user=0.0.0.0:8000"
      - "--bouncer=0.0.0.0:7999"
      - "--image=${CONTAINER_REGISTRY}/deployer:${DEPLOYER_TAG}"
      - "--prefix=shuttle_"
      - "--network-name=${STACK}_user-net"
      - "--docker-host=/var/run/docker.sock"
      - "--auth-uri=http://auth:8000"
      - "--deploys-api-key=${DEPLOYS_API_KEY}"
      - "--provisioner-uri=http://provisioner:8000"
      - "--proxy-fqdn=${APPS_FQDN}"
      - "--use-tls=${USE_TLS}"
      - "--cors-origin=${CORS_ORIGIN}"
      - "--admin-key=${GATEWAY_ADMIN_KEY}"
      - "--permit-api-uri=https://api.eu-central-1.permit.io"
      - "--permit-pdp-uri=http://permit-pdp:7000"
      - "--permit-env=${SHUTTLE_ENV}"
      - "--permit-api-key=${PERMIT_API_KEY}"
    healthcheck:
      test: curl -f -s http://localhost:8001
      interval: 1m
      timeout: 15s
      retries: 15
      #start_period: 30s
  logger:
    image: "${CONTAINER_REGISTRY}/logger:${LOGGER_TAG}"
    depends_on:
      - auth
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==controller
    networks:
      user-net:
      default:
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    command:
      - "--address=0.0.0.0:8000"
      - "--db-connection-uri=${LOGGER_POSTGRES_URI}"
      - "--auth-uri=http://auth:8000"
  provisioner:
    image: "${CONTAINER_REGISTRY}/provisioner:${PROVISIONER_TAG}"
    depends_on:
      - postgres
      - mongodb
      - auth
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    networks:
      user-net:
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==provisioner
    command:
      - "--ip=0.0.0.0"
      - "--port=8000"
      - "--shared-pg-uri=postgres://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres"
      - "--shared-mongodb-uri=mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongodb:27017/admin"
      - "--internal-mongodb-address=mongodb"
      - "--internal-pg-address=postgres"
      - "--fqdn=${DB_FQDN}"
      - "--auth-uri=http://auth:8000"
      - "--gateway-uri=http://gateway:8001"
      - "--resource-recorder-uri=http://resource-recorder:8000"
  resource-recorder:
    image: "${CONTAINER_REGISTRY}/resource-recorder:${RESOURCE_RECORDER_TAG}"
    depends_on:
      - auth
    environment:
      - RUST_LOG=${RUST_LOG}
      - SHUTTLE_ENV=${SHUTTLE_ENV}
    networks:
      user-net:
    volumes:
      - resource-recorder-vol:/var/lib/shuttle
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        order: start-first
        failure_action: rollback
        delay: 10s
      rollback_config:
        parallelism: 0
        order: stop-first
      placement:
        constraints:
          - node.hostname==controller
    command:
      - "--address=0.0.0.0:8000"
      - "--state=/var/lib/shuttle"
      - "--auth-uri=http://auth:8000"
  postgres:
    image: "${CONTAINER_REGISTRY}/postgres:${POSTGRES_TAG}"
    restart: always
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    networks:
      user-net:
    volumes:
      - postgres-vol:/var/lib/postgresql/data
    ports:
      - 8002:8000
      - 5432:5432
    deploy:
      placement:
        constraints:
          - node.hostname==postgres
  mongodb:
    image: docker.io/library/mongo:5.0.10
    restart: always
    networks:
      user-net:
    volumes:
      - mongodb-vol:/data/db
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD}
    deploy:
      placement:
        constraints:
          - node.hostname==postgres
  otel-collector:
    image: "${CONTAINER_REGISTRY}/otel:${OTEL_TAG}"
    volumes:
      # Pull docker stats
      - ${DOCKER_SOCK}:/var/run/docker.sock:ro
    restart: always
    networks:
      user-net:
    environment:
      - SHUTTLE_ENV=${SHUTTLE_ENV}
      - DD_API_KEY=${DD_API_KEY}
      - DD_ENV=${DD_ENV}
    deploy:
      placement:
        constraints:
          - node.hostname==controller
  permit-pdp:
    image: docker.io/permitio/pdp-v2:0.2.37
    restart: always
    environment:
      - PDP_CONTROL_PLANE=https://api.eu-central-1.permit.io
      - PDP_API_KEY=${PERMIT_API_KEY}
      # Querying users with lots of resource instances takes more than the default 1s
      - PDP_OPA_CLIENT_QUERY_TIMEOUT=10
    ports:
      - 7000:7000
    networks:
      user-net:
    deploy:
      placement:
        constraints:
          - node.hostname==controller
    healthcheck:
      test: curl -f -s http://localhost:7000
      interval: 1m
      timeout: 10s
      retries: 5