docker-compose.yml

services:
  backend:
    image: ${DATASPACE_IMAGE:-dataspace-backend:local}
    build: .
    env_file: .env
    container_name: "DataSpace"
    volumes:
      # User-uploaded media (MEDIA_ROOT = BASE_DIR/files/public). This is
      # persistent data, not code -- it lives on the host and cannot be
      # baked into the image. Dropping the old `.:/code` bind mount for the
      # image-based deploy removed the app's only access to it, so every
      # file field lookup (e.g. an organization logo's `size`) raised
      # FileNotFoundError and errored the GraphQL queries the dashboard
      # depends on. Mount only this subtree, never the whole tree -- a
      # full `.:/code` mount would shadow the deployed image.
      - ./files:/code/files
    ports:
      - "8000:8000"
    depends_on:
      backend_db:
        condition: service_healthy
      elasticsearch:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    logging:
      options:
        max-size: "10m"
        max-file: "3"
    # On prod-cds, backend_db/elasticsearch/redis below are NOT what's
    # actually running -- ci-deploy.sh deliberately skips starting them
    # when same-named containers already exist under the `dataexchange`
    # superproject (see its own comment), which lives on a DIFFERENT
    # default network (dataexchange_default) than this project's own
    # (dataexbackend_default, this compose file's implicit default).
    # Confirmed live: the currently-running DataSpace container only
    # reaches them because of an undocumented `docker network connect
    # dataexchange_default DataSpace` done by hand on the host at some
    # point -- never captured here, and would NOT survive a fresh
    # --force-recreate (confirmed: a real deploy's `release` container hit
    # "could not translate host name backend_db" on a fresh network-less
    # container). Joining both networks here covers both cases: a genuinely
    # fresh host (where this file's own backend_db/elasticsearch/redis come
    # up on `default`) and prod-cds (where the real ones live on
    # dataexchange_default).
    networks:
      - default
      - dataexchange_default

  # One-off management commands (migrations, etc.) against the deployed
  # image, without touching the running `backend` container. No
  # container_name, so `docker compose run` can spin up a fresh instance
  # even while `backend` is up. Never starts on a plain `up`.
  release:
    image: ${DATASPACE_IMAGE:-dataspace-backend:local}
    build: .
    env_file: .env
    profiles: ["release"]
    volumes:
      # Same media mount as `backend` -- management commands run here too
      # and some of them touch uploaded files.
      - ./files:/code/files
    depends_on:
      backend_db:
        condition: service_healthy
    entrypoint: ["python", "manage.py"]
    command: ["migrate", "--noinput"]
    # See `backend`'s identical networks: block above for why both are needed.
    networks:
      - default
      - dataexchange_default

  backend_db:
    image: "postgres:14.4"
    env_file: .env
    restart: always
    container_name: "DataExBackendDb"
    environment:
      - POSTGRES_NAME=postgres
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
    ports:
      - "54321:5432"
    volumes:
      - backend_db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    logging:
      options:
        max-size: "10m"
        max-file: "3"

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.12.2
    restart: always
    container_name: "DataExBackendElastic"
    env_file: .env
    environment:
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms1024m -Xmx1024m"
      - ELASTIC_PASSWORD=changeme
      - xpack.security.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    cap_add:
      - IPC_LOCK
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"
      - "9300:9300"
    healthcheck:
      test: ["CMD-SHELL", "curl -s http://localhost:9200/_cluster/health | grep -vq '\"status\":\"red\"'"]
      interval: 20s
      timeout: 10s
      retries: 3
      start_period: 40s
    logging:
      options:
        max-size: "10m"
        max-file: "3"

  redis:
    image: "redis:alpine"
    restart: always
    command: redis-server
    container_name: "DataExBackendRedis"
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep -q 'PONG'"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    logging:
      options:
        max-size: "10m"
        max-file: "3"

  telemetry_elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.16.2
    container_name: telemetry_elasticsearch
    restart: always
    profiles: ["telemetry"]
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    environment:
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms1024m -Xmx1024m"
      - ELASTIC_PASSWORD=changeme
      - xpack.security.enabled=true
    volumes:
      - tele-elasticsearch-data:/usr/share/elasticsearch/data
    healthcheck:
      interval: 10s
      retries: 12
      test:
        curl -s http://localhost:9200/_cluster/health | grep -vq
        '"status":"red"'
    logging:
      options:
        max-size: "10m"
        max-file: "3"

  kibana:
    image: docker.elastic.co/kibana/kibana:7.16.2
    container_name: kibana
    profiles: ["telemetry"]
    environment:
      ELASTICSEARCH_URL: "http://telemetry_elasticsearch:9200"
      ELASTICSEARCH_HOSTS: '["http://telemetry_elasticsearch:9200"]'
      ELASTICSEARCH_USERNAME: elastic
      ELASTICSEARCH_PASSWORD: changeme
    restart: always
    depends_on:
      telemetry_elasticsearch:
        condition: service_healthy
    ports:
      - "5601:5601"

  apm-server:
    image: docker.elastic.co/apm/apm-server:7.16.2
    container_name: apm-server
    profiles: ["telemetry"]
    user: apm-server
    restart: always
    command:
      [
        "--strict.perms=false",
        "-e",
        "-E",
        "apm-server.host=0.0.0.0:8200",
        "-E",
        "apm-server.kibana.enabled=true",
        "-E",
        "apm-server.kibana.host=kibana:5601",
        "-E",
        "apm-server.kibana.username=elastic",
        "-E",
        "apm-server.kibana.password=changeme",
        "-E",
        "output.elasticsearch.hosts=['telemetry_elasticsearch:9200']",
        "-E",
        "output.elasticsearch.enabled=true",
        "-E",
        "output.elasticsearch.username=elastic",
        "-E",
        "output.elasticsearch.password=changeme",
      ]
    depends_on:
      telemetry_elasticsearch:
        condition: service_healthy
    cap_add: [ "CHOWN", "DAC_OVERRIDE", "SETGID", "SETUID" ]
    cap_drop: [ "ALL" ]
    healthcheck:
      interval: 10s
      retries: 12
      test:
        curl --write-out 'HTTP %{http_code}' --fail --silent --output /dev/null
        http://localhost:8200/
    logging:
      options:
        max-size: "10m"
        max-file: "3"

  otel-collector:
    image: otel/opentelemetry-collector:latest
    container_name: otel-collector
    profiles: ["telemetry"]
    restart: always
    command: "--config=/etc/otel-collector-config.yaml"
    volumes:
      - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro
    depends_on:
      apm-server:
        condition: service_healthy
    ports:
      - "4317:4317"
    logging:
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  backend_db_data:
    name: backend_db_data
  elasticsearch-data:
    driver: local
  tele-elasticsearch-data:
    driver: local
  redis-data:
    driver: local

networks:
  # The dataexchange superproject's default network on prod-cds -- external
  # because this compose project doesn't own it. See the comment on
  # `backend`'s networks: block above.
  dataexchange_default:
    external: true