docker-compose.yml.sample

x-climweb-variables: &climweb-variables
  WAIT_TIMEOUT: 120
  GUNICORN_NUM_OF_WORKERS: ${CMS_NUM_OF_WORKERS:-4}
  GUNICORN_TIMEOUT: ${CMS_GUNICORN_TIMEOUT:-300}
  DEBUG: ${CMS_DEBUG}
  WAGTAIL_SITE_NAME: ${CMS_SITE_NAME}
  ADMIN_URL_PATH: ${CMS_ADMIN_URL_PATH}
  TIME_ZONE: ${TIME_ZONE}
  SECRET_KEY: ${SECRET_KEY}
  ALLOWED_HOSTS: ${ALLOWED_HOSTS}
  CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS}
  DATABASE_URL: postgis://${CMS_DB_USER}:${CMS_DB_PASSWORD}@climweb_pgbouncer:5432/${CMS_DB_NAME}
  DB_CONNECTION_MAX_AGE: ${DB_CONNECTION_MAX_AGE:-0}
  DB_CONN_HEALTH_CHECKS: ${DB_CONN_HEALTH_CHECKS:-False}
  DB_DISABLE_SERVER_SIDE_CURSORS: ${DB_DISABLE_SERVER_SIDE_CURSORS:-True}
  DB_SSL_REQUIRE: ${DB_SSL_REQUIRE:-False}
  REDIS_URL: redis://climweb_redis:6379/0
  EMAIL_HOST: ${SMTP_EMAIL_HOST}
  EMAIL_PORT: ${SMTP_EMAIL_PORT}
  EMAIL_USE_TLS: ${SMTP_EMAIL_USE_TLS}
  EMAIL_HOST_USER: ${SMTP_EMAIL_HOST_USER}
  EMAIL_HOST_PASSWORD: ${SMTP_EMAIL_HOST_PASSWORD}
  DJANGO_ADMINS: ${CMS_ADMINS}
  DEFAULT_FROM_EMAIL: ${DEFAULT_FROM_EMAIL}
  RECAPTCHA_PUBLIC_KEY: ${RECAPTCHA_PUBLIC_KEY}
  RECAPTCHA_PRIVATE_KEY: ${RECAPTCHA_PRIVATE_KEY}
  RECAPTCHA_DOMAIN: ${RECAPTCHA_DOMAIN:-www.google.com}
  RECAPTCHA_VERIFY_REQUEST_TIMEOUT: ${RECAPTCHA_VERIFY_REQUEST_TIMEOUT:-60}
  NEXTJS_SERVER_URL: http://climweb_mapviewer:3000
  CMS_UPGRADE_HOOK_URL: ${CMS_UPGRADE_HOOK_URL}
  CMS_PLUGIN_MANAGE_HOOK_URL: ${CMS_PLUGIN_MANAGE_HOOK_URL:-}
  WAGTAILADMIN_BASE_URL: ${CMS_BASE_URL}
  LANGUAGE_CODE: ${CMS_DEFAULT_LANGUAGE_CODE}
  CAP_CERT_PATH: ${CAP_CERT_PATH:-}
  CAP_PRIVATE_KEY_PATH: ${CAP_PRIVATE_KEY_PATH:-}
  CAP_SIGNATURE_METHOD: ${CAP_SIGNATURE_METHOD:-ECDSA_SHA256}
  CAP_MQTT_SECRET_KEY: ${CAP_MQTT_SECRET_KEY:-}
  CLIMWEB_ADDITIONAL_APPS: ${CLIMWEB_ADDITIONAL_APPS:-}
  # Must match the container-side path of the CLIMWEB_PLUGIN_VOLUME mount below.
  # Do NOT use /climweb/plugins: the image ships its plugin management scripts
  # (utils.sh, install_plugin.sh, list_plugins.sh) there, and a bind mount would
  # shadow them and break the entrypoint.
  CLIMWEB_PLUGIN_DIR: /climweb/user-plugins
  CLIMWEB_PLUGIN_GIT_REPOS: ${CLIMWEB_PLUGIN_GIT_REPOS:-}
  CLIMWEB_PLUGIN_URLS: ${CLIMWEB_PLUGIN_URLS:-}
  # Note the :-True default: an unset variable would otherwise be passed through
  # as an empty string, which django-environ parses as False.
  WAGTAIL_2FA_REQUIRED: ${WAGTAIL_2FA_REQUIRED:-True}
  CLIMWEB_ENABLE_OTEL:
  OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-http://climweb_otel_collector:4318}
  OTEL_RESOURCE_ATTRIBUTES:
  OTEL_TRACES_SAMPLER: ${OTEL_TRACES_SAMPLER:-traceidratio}
  OTEL_TRACES_SAMPLER_ARG: ${OTEL_TRACES_SAMPLER_ARG:-0.1}
  OTEL_PER_MODULE_SAMPLER_OVERRIDES: ${OTEL_PER_MODULE_SAMPLER_OVERRIDES:-opentelemetry.instrumentation.django=always_on}
  CLIMWEB_DEPLOYMENT_ENV: ${CLIMWEB_DEPLOYMENT_ENV:-production}
  MPLCONFIGDIR: /tmp/matplotlib
  IS_METEOROLOGICAL: ${IS_METEOROLOGICAL:-True}
  WAGTAIL_NEWSLETTER_MAILCHIMP_API_KEY: ${WAGTAIL_NEWSLETTER_MAILCHIMP_API_KEY:-}
  WAGTAIL_NEWSLETTER_FROM_NAME: ${WAGTAIL_NEWSLETTER_FROM_NAME:-}
  WAGTAIL_NEWSLETTER_REPLY_TO: ${WAGTAIL_NEWSLETTER_REPLY_TO:-}
  CLIMWEB_LOG_VIEWER_ENABLED: ${CLIMWEB_LOG_VIEWER_ENABLED:-True}
  CLIMWEB_DOCKER_HOST: ${CLIMWEB_DOCKER_HOST:-tcp://climweb_docker_proxy:2375}
  CLIMWEB_LOG_VIEWER_CONTAINERS: ${CLIMWEB_LOG_VIEWER_CONTAINERS:-}
  
services:
  climweb_db:
    container_name: climweb_db
    image: postgis/postgis:15-master
    platform: linux/x86_64
    restart: unless-stopped
    command: postgres -c max_connections=${POSTGRES_MAX_CONNECTIONS:-300} -c shared_buffers=${POSTGRES_SHARED_BUFFERS:-2GB}
    environment:
      - POSTGRES_USER=${CMS_DB_USER}
      - POSTGRES_DB=${CMS_DB_NAME}
      - POSTGRES_PASSWORD=${CMS_DB_PASSWORD}
    ports:
      - "5432"
    volumes:
      - ${CMS_DB_VOLUME}:/var/lib/postgresql/data/

  climweb_pgbouncer:
    image: edoburu/pgbouncer:v1.24.1-p1
    container_name: climweb_pgbouncer
    restart: unless-stopped
    environment:
      DB_HOST: climweb_db
      DB_USER: ${CMS_DB_USER}
      DB_PASSWORD: ${CMS_DB_PASSWORD}
      DB_NAME: ${CMS_DB_NAME}
      DB_PORT: 5432
      AUTH_TYPE: scram-sha-256
      POOL_MODE: transaction                
      MAX_CLIENT_CONN: 2000                
      DEFAULT_POOL_SIZE: 16
      RESERVE_POOL_SIZE: 10
      SERVER_RESET_QUERY: "DISCARD ALL"
      SERVER_RESET_QUERY_ALWAYS: 1 
      IGNORE_STARTUP_PARAMETERS: "extra_float_digits"
      QUERY_WAIT_TIMEOUT: 60000             # 60s
      SERVER_IDLE_TIMEOUT: 600
    depends_on:
      - climweb_db
    ports:
      - "5432"

  climweb_redis:
    image: redis:alpine
    container_name: climweb_redis
    restart: unless-stopped

  climweb:
    image: ghcr.io/wmo-raf/climweb:v${CLIMWEB_VERSION}
    user: "${UID}:${GID}"
    container_name: climweb
    platform: linux/x86_64
    shm_size: '256mb'
    restart: unless-stopped
    expose:
      - 8000
    environment:
      <<: *climweb-variables
      WAIT_HOSTS: climweb_pgbouncer:5432,climweb_redis:6379
    ports:
      - "8000"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - ${CMS_STATIC_VOLUME}:/climweb/web/src/climweb/static
      - ${CMS_MEDIA_VOLUME}:/climweb/web/src/climweb/media
      - ${BACKUP_VOLUME}:/climweb/web/src/climweb/backup
      - ${NPM_SSL_VOLUME:-./climweb/npm_ssl}:/npm/ssl
      - ${CLIMWEB_PLUGIN_VOLUME:-./climweb/plugins}:/climweb/user-plugins
      - type: tmpfs
        target: /climweb/container_markers
        tmpfs:
          mode: 0777

  climweb_celery_worker:
    image: ghcr.io/wmo-raf/climweb:v${CLIMWEB_VERSION}
    user: "${UID}:${GID}"
    container_name: climweb_celery_worker
    platform: linux/x86_64
    init: true
    command: celery-worker
    restart: unless-stopped
    environment:
      <<: *climweb-variables
      WAIT_HOSTS: climweb_pgbouncer:5432,climweb_redis:6379,climweb:8000
    volumes:
      - ${CMS_STATIC_VOLUME}:/climweb/web/src/climweb/static
      - ${CMS_MEDIA_VOLUME}:/climweb/web/src/climweb/media
      - ${BACKUP_VOLUME}:/climweb/web/src/climweb/backup
      - ${NPM_SSL_VOLUME:-./climweb/npm_ssl}:/npm/ssl
      - ${CLIMWEB_PLUGIN_VOLUME:-./climweb/plugins}:/climweb/user-plugins
      - type: tmpfs
        target: /climweb/container_markers
        tmpfs:
          mode: 0777

  climweb_celery_beat:
    image: ghcr.io/wmo-raf/climweb:v${CLIMWEB_VERSION}
    user: "${UID}:${GID}"
    container_name: climweb_celery_beat
    platform: linux/x86_64
    init: true
    command: celery-beat
    restart: unless-stopped
    environment:
      <<: *climweb-variables
      WAIT_HOSTS: climweb_pgbouncer:5432,climweb_redis:6379,climweb:8000
    volumes:
      - ${CMS_STATIC_VOLUME}:/climweb/web/src/climweb/static
      - ${CMS_MEDIA_VOLUME}:/climweb/web/src/climweb/media
      - ${BACKUP_VOLUME}:/climweb/web/src/climweb/backup
      - ${CLIMWEB_PLUGIN_VOLUME:-./climweb/plugins}:/climweb/user-plugins
      - type: tmpfs
        target: /climweb/container_markers
        tmpfs:
          mode: 0777

  climweb_mapviewer:
    container_name: climweb_mapviewer
    image: ghcr.io/wmo-raf/geomapviewer:latest
    restart: unless-stopped
    platform: linux/x86_64
    environment:
      CMS_API: ${MAPVIEWER_CMS_API}
      ANALYTICS_PROPERTY_ID: ${ANALYTICS_PROPERTY_ID}
      BASE_PATH: ${MAPVIEWER_BASE_PATH}
      DEBUG: ${CMS_DEBUG}
      BITLY_TOKEN: ${BITLY_TOKEN}
      GOOGLE_CUSTOM_SEARCH_CX: ${GOOGLE_CUSTOM_SEARCH_CX}
      GOOGLE_SEARCH_API_KEY: ${GOOGLE_SEARCH_API_KEY}
    volumes:
      - ${MAPVIEWER_NEXT_STATIC_VOLUME}:/app/nginx/.next/static
    ports:
      - "3000"
      

  climweb_nginx:
    container_name: climweb_nginx
    image: nginx:1.27.1-alpine
    restart: unless-stopped
    volumes:
      - ${CMS_STATIC_VOLUME}:/wagtail_static
      - ${CMS_MEDIA_VOLUME}:/wagtail_media
      - ${MAPVIEWER_NEXT_STATIC_VOLUME}:/mapviewer/static
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
    ports:
      - "80:80"

  climweb_otel_collector:
    image: otel/opentelemetry-collector:0.119.0
    container_name: climweb_otel_collector
    command: [ "--config=/etc/otel-collector-config.yaml" ]
    environment:
      HONEYCOMB_API_KEY:
      HONEYCOMB_LOGS_TRACES_DATASET: climweb-logs
      HONEYCOMB_METRICS_DATASET: climweb-metrics
    volumes:
      - ./otel/otel-collector-config.yaml:/etc/otel-collector-config.yaml
    ports:
      - "4318"

  # Read-only Docker API for the CMS admin log viewer (Settings -> Server logs).
  #
  # The socket is mounted here and *only* here: the CMS container talks to this
  # proxy over the internal network, so it can list containers and read their
  # logs but cannot start, stop, exec into or create anything. Nothing is
  # published to the host, so no new port or subdomain is exposed.
  #
  # Every capability defaults to off in this image; the two below are all the
  # log viewer needs. Do not add EXEC, POST or ALLOW_RESTARTS — those turn a log
  # reader into remote root on the host.
  climweb_docker_proxy:
    image: tecnativa/docker-socket-proxy:v0.4.2
    container_name: climweb_docker_proxy
    restart: unless-stopped
    environment:
      CONTAINERS: 1   # GET /containers/json and /containers/{id}/json
      LOGS: 1         # GET /containers/{id}/logs
      POST: 0         # block every mutating request
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    expose:
      - 2375

# The stack joins a pre-existing external network rather than letting Compose
# create a per-project one. This is required: nginx-proxy-manager (managed by a
# separate compose file) hard-codes `external: true, name: climweb` to reach the
# CMS. Leaving this commented out makes Compose create <project>_default instead,
# and any container it does not recreate stays on the old network -- the stack
# then half-splits across two networks and inter-container DNS fails.
networks:
  default:
    external: true
    name: ${DOCKER_NETWORK_NAME:-climweb}