compose.yml

name: pems

services:
  app:
    build:
      context: .
      dockerfile: appcontainer/Dockerfile
    image: caltrans/pems:app
    env_file: .env
    ports:
      - "${DJANGO_LOCAL_PORT:-8000}:8000"

  dev:
    build:
      context: .
      dockerfile: .devcontainer/Dockerfile
    image: caltrans/pems:dev
    env_file: .env
    # https://code.visualstudio.com/docs/remote/create-dev-container#_use-docker-compose
    entrypoint: sleep infinity
    volumes:
      - ./:/caltrans/app

  docs:
    image: caltrans/pems:dev
    entrypoint: mkdocs
    command: serve --dev-addr "0.0.0.0:8000"
    ports:
      - "8000"
    volumes:
      - ./:/caltrans/app

  esconfig:
    profiles: ["elasticstack"]
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_STACK_VERSION}
    user: "0"
    command: ["bash", "/.local/config/setup.sh"]
    env_file:
      - .env
    volumes:
      - certs:/usr/share/elasticsearch/config/certs
      - ./elasticstack/esconfig:/.local/config
    healthcheck:
      test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
      interval: 1s
      timeout: 5s
      retries: 120

  es01:
    profiles: ["elasticstack"]
    depends_on:
      esconfig:
        condition: service_healthy
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_STACK_VERSION}
    labels:
      co.elastic.logs/module: elasticsearch
    volumes:
      - certs:/usr/share/elasticsearch/config/certs
      - esdata01:/usr/share/elasticsearch/data
    ports:
      - "9200"
    environment:
      - node.name=es01
      - cluster.name=${ELASTIC_CLUSTER}
      - discovery.type=single-node
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - bootstrap.memory_lock=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/es01/es01.key
      - xpack.security.http.ssl.certificate=certs/es01/es01.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/es01/es01.key
      - xpack.security.transport.ssl.certificate=certs/es01/es01.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.license.self_generated.type=${ELASTIC_LICENSE}
    mem_limit: ${ELASTIC_MEM_LIMIT}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120

  kibana:
    profiles: ["elasticstack"]
    depends_on:
      es01:
        condition: service_healthy
    image: docker.elastic.co/kibana/kibana:${ELASTIC_STACK_VERSION}
    labels:
      co.elastic.logs/module: kibana
    volumes:
      - certs:/usr/share/kibana/config/certs
      - kibanadata:/usr/share/kibana/data
      - ./elasticstack/kibana:/usr/share/kibana/config
    ports:
      - "5601"
    environment:
      - SERVERNAME=kibana
      - ELASTICSEARCH_HOSTS=https://es01:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
      - XPACK_SECURITY_ENCRYPTIONKEY=${ELASTIC_ENCRYPTION_KEY}
      - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=${ELASTIC_ENCRYPTION_KEY}
      - XPACK_REPORTING_ENCRYPTIONKEY=${ELASTIC_ENCRYPTION_KEY}
    mem_limit: ${KIBANA_MEM_LIMIT}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120

  metricbeat01:
    profiles: ["elasticstack"]
    depends_on:
      es01:
        condition: service_healthy
      kibana:
        condition: service_healthy
    image: caltrans/pems:metricbeat01
    build:
      context: .
      dockerfile: ./elasticstack/metricbeat01/Dockerfile
      args:
        - ELASTIC_STACK_VERSION=${ELASTIC_STACK_VERSION}
    volumes:
      - certs:/usr/share/metricbeat/certs
      - metricbeatdata01:/usr/share/metricbeat/data
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
      - "/proc:/hostfs/proc:ro"
      - "/:/hostfs:ro"
    environment:
      - ELASTIC_USER=elastic
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - ELASTIC_HOSTS=https://es01:9200
      - KIBANA_HOSTS=http://kibana:5601
      - LOGSTASH_HOSTS=http://logstash01:9600
    command:
      - --strict.perms=false

  filebeat01:
    profiles: ["elasticstack"]
    depends_on:
      es01:
        condition: service_healthy
    image: caltrans/pems:filebeat01
    build:
      context: .
      dockerfile: ./elasticstack/filebeat01/Dockerfile
      args:
        - ELASTIC_STACK_VERSION=${ELASTIC_STACK_VERSION}
    volumes:
      - certs:/usr/share/filebeat/certs
      - filebeatdata01:/usr/share/filebeat/data
      - "/var/lib/docker/containers:/var/lib/docker/containers:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    environment:
      - ELASTIC_USER=elastic
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - ELASTIC_HOSTS=https://es01:9200
      - KIBANA_HOSTS=http://kibana:5601
      - LOGSTASH_HOSTS=http://logstash01:9600
    command:
      - --strict.perms=false

  logstash01:
    profiles: ["elasticstack"]
    depends_on:
      es01:
        condition: service_healthy
      kibana:
        condition: service_healthy
    image: caltrans/pems:logstash01
    build:
      context: .
      dockerfile: ./elasticstack/logstash01/Dockerfile
      args:
        - ELASTIC_STACK_VERSION=${ELASTIC_STACK_VERSION}
    labels:
      co.elastic.logs/module: logstash
    volumes:
      - certs:/usr/share/logstash/certs
      - logstashdata01:/usr/share/logstash/data
      - ./elasticstack/logstash01:/tmp/logstash01
    environment:
      - xpack.monitoring.enabled=false
      - ELASTIC_USER=elastic
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - ELASTIC_HOSTS=https://es01:9200

volumes:
  certs:
    driver: local
  esdata01:
    driver: local
  kibanadata:
    driver: local
  metricbeatdata01:
    driver: local
  filebeatdata01:
    driver: local
  logstashdata01:
    driver: local