docker-compose.yml

volumes:
  # Volume used to store the certificates of dirac
  certs_data:
  # Volume used to store the config of diracx
  diracx-cs-store:
  # Volume used to store the pair of keys to sign the tokens
  diracx-key-store:
  # Volume used to store the jwks of the IAM service
  diracx-iam-key-store:

services:
  mysql:
    image: ${MYSQL_VER}
    container_name: mysql
    environment:
      - MYSQL_ROOT_PASSWORD=password
    ports:
      - 3306:3306
    healthcheck:
      test: ["CMD", "sh", "-c", "${MYSQL_ADMIN_COMMAND} ping -h localhost > /tmp/health.log 2>&1;"]
      timeout: 20s
      retries: 10
      start_period: 60s
    pull_policy: always

  opensearch:
    image: ${ES_VER}
    container_name: opensearch
    hostname: opensearch
    ports:
      - 9200:9200
    env_file: "${ES_VER}.env"
    healthcheck:
      test: ["CMD", "curl", "-f", "-u", "elastic:changeme", "http://localhost:9200"]
      interval: 5s
      timeout: 2s
      retries: 15
      start_period: 150s
    pull_policy: always

  iam-login-service:
    image: ${IAM_VER}
    container_name: iam-login-service
    hostname: iam-login-service
    ports:
      - 8080:8080
    env_file: "${IAM_VER}.env"
    volumes:
      - diracx-iam-key-store:/etc/indigo-iam/keystore
    depends_on:
      - iam-init-jwks
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/.well-known/openid-configuration"]
      interval: 5s
      timeout: 2s
      retries: 15
      start_period: 60s
    pull_policy: always

  iam-init-jwks:
    image: alpine:latest
    container_name: init-jwks
    volumes:
      - diracx-iam-key-store:/jwks
    command: >
      sh -c 'mkdir -p /jwks && echo "{
        \"keys\": [
          {
            \"p\": \"1vffpIvQ67Bp1XmnxuuNhgHGoS4iCEbEJN9kV2oh39xRMw2L1Fx6RrgHb0t04KAE4IT_48Y9grta7OHUty4dMQ\",
            \"kty\": \"RSA\",
            \"q\": \"v673PmzSoiClcZ6U8Rcb4GyB1H76jfY3dTdZNBT5cSVEPhPCnGNWXFKPUj5qeT4CGneR9tdGU7U-_vRNPJg9yw\",
            \"d\": \"XC1QH6W--Hh9fIsswXB2H0S44GvbrVD75XiJwrOgmrOhBK8MFR0X_eQ-9nBNPmZbAu9NKK5ixwIcE8J-OhQaOcDkepAf1DUo6iIlXgtbHvOtT3GHNgPHJ4C7XbnO9ieNDMrMr2tpmGnH2sebvXwLrzjKJCB09bS6yj71XGkyVKE\",
            \"e\": \"AQAB\",
            \"kid\": \"rsa1\",
            \"qi\": \"P8KH-16jsDjJygzggeLxlJwHYFYPoie3hgB__aajO03GiRzYJojD5dBKEiQuo9SxJ43U5csHWYQeukz9X01-zw\",
            \"dp\": \"VYF6_6RtkZI2RqeBSOpg_LCwJWSIPOqJEnGZI_wfRUAJPFljCTFPodmJe4d0EfUUe4nrjtpHlTyYyih5x_MbwQ\",
            \"dq\": \"sxzUTZG0dOjaj8PmWy4Dz361BpIsoDC9e5tfkGo0-AQhs3wVcrrkPNqsr-ZA6dAGeSLX0vcv8RJArk4sSf3cZw\",
            \"n\": \"oPXb81pZRmxmRJVHva49e5-NOToDdZ6XITpqt3RF-Ovehkd52Fm-t0FfKjJZxP7Q4d-nw1gk-r894uRJPAU9mx3yya9p7L5Xnr6rs8jmf_KF2buaYMUQ001wpsjJwznyGHWNqrBNB4_2-3U_uMGWyJB-C8Gy2-3aXjHRSQ-d0ts\"
          }
        ]
      }" > /jwks/iam-keystore.jwks'
    pull_policy: always

  # Mock of an S3 storage
  s3-direct:
    image: adobe/s3mock
    container_name: s3-direct
    hostname: s3-direct
    ports:
      - 9090
      - 9191
    environment:
      - initialBuckets=my-first-bucket
      - debug=true
    pull_policy: always

  diracx-wait-for-db:
    image: ${MYSQL_VER}
    container_name: diracx-wait-for-db
    depends_on:
      mysql:
        condition: service_healthy
    command: /home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/tests/CI/check_db_initialized.sh
    pull_policy: always

  dirac-init-certificates:
    image: ghcr.io/diracgrid/diracx/certificates-generation:latest
    container_name: dirac-init-certificates
    volumes:
      - certs_data:/ca/certs/
    entrypoint: |
      /entrypoint.sh
    pull_policy: always

  dirac-server:
    image: ${CI_REGISTRY_IMAGE}/${HOST_OS}-dirac
    container_name: server
    hostname: server
    user: "${DIRAC_UID}:${DIRAC_GID}"

    depends_on:
      mysql:
        condition: service_healthy
      opensearch:
        condition: service_healthy
      s3-direct:
        condition: service_started
      iam-login-service:
        condition: service_healthy
      dirac-init-certificates:
        condition: service_completed_successfully # Let the init container create the certificates
      diracx-init-key:
        condition: service_completed_successfully # Let the init container create the signing key
      diracx-init-cs:
        condition: service_completed_successfully # Let the init container create the cs
    ulimits:
      nofile: 8192
    volumes:
      - certs_data:/ca/certs
      - diracx-cs-store:/cs_store
      - diracx-key-store:/signing-key
    environment:
      - DIRACX_CONFIG_BACKEND_URL=git+file:///cs_store/initialRepo
      - DIRACX_SERVICE_AUTH_TOKEN_KEY=file:///signing-key/rs256.key
    command: ["sleep", "infinity"] # This is necessary because of the issue described in https://github.com/moby/moby/issues/42275. What is added here is a hack/workaround.
    pull_policy: always


  dirac-client:
    image: ${CI_REGISTRY_IMAGE}/${HOST_OS}-dirac
    container_name: client
    hostname: client
    user: "${DIRAC_UID}:${DIRAC_GID}"
    depends_on:
      - dirac-server
    ulimits:
      nofile: 8192
    volumes:
      - certs_data:/ca/certs
    command: ["sleep", "infinity"] # This is necessary because of the issue described in https://github.com/moby/moby/issues/42275. What is added here is a hack/workaround.
    pull_policy: always

  dirac-pilot:
    image: ${CI_REGISTRY_IMAGE}/${HOST_OS}-dirac
    container_name: pilot
    hostname: pilot
    user: "${DIRAC_UID}:${DIRAC_GID}"
    depends_on:
      - dirac-server
    volumes:
      - certs_data:/ca/certs
      - type: bind
        source: ${CVMFS_DIR}
        target: /cvmfs
        bind:
          propagation: rslave
    ulimits:
      nofile: 8192
    pull_policy: always
    healthcheck:
      test: ["CMD", "ls ${CVMFS_DIR} > /tmp/health.log 2>&1;"]
      timeout: 20s
      retries: 10
      start_period: 60s
    command: ["sleep", "infinity"] # This is necessary because of the issue described in https://github.com/moby/moby/issues/42275. What is added here is a hack/workaround.

  diracx-init-key:
    image: ghcr.io/diracgrid/diracx/secret-generation:latest
    container_name: diracx-init-key
    environment:
      - DIRACX_SERVICE_AUTH_TOKEN_KEY="file:///signing-key/rs256.key"
    volumes:
      - diracx-key-store:/signing-key/
      # As the diracx images don't run as root we need to change the permissions of the /cs_store/ directory as well
      - diracx-cs-store:/cs_store/
    # We need to allow everybody to read the private keys
    # Because the users are different between the DIRAC and DiracX containers
    entrypoint: |
      bash -xc "ssh-keygen -P '' -trsa -b4096 -mPEM -f/signing-key/rs256.key && chmod o+r /signing-key/rs256.* && chmod -R o=u /cs_store"
    pull_policy: always

  diracx-init-cs:
    image: ghcr.io/diracgrid/diracx/client:dev
    container_name: diracx-init-cs
    depends_on:
      diracx-init-key:
        condition: service_completed_successfully # Let the init container set the permission on /cs_store/
    environment:
      - DIRACX_CONFIG_BACKEND_URL=git+file:///cs_store/initialRepo
      - DIRACX_SERVICE_AUTH_TOKEN_KEY=file:///signing-key/rs256.key
    volumes:
      - diracx-cs-store:/cs_store/
      - diracx-key-store:/signing-key/
    entrypoint: |
      /entrypoint.sh bash -xc 'dirac internal generate-cs /cs_store/initialRepo'
    pull_policy: always

  diracx-init-db:
    image: ghcr.io/diracgrid/diracx/services:dev
    container_name: diracx-init-db
    depends_on:
      mysql:
        condition: service_healthy
    environment:
      - DIRACX_DB_URL_AUTHDB=mysql+aiomysql://Dirac:Dirac@mysql/DiracXAuthDB
    entrypoint: |
      /entrypoint.sh bash -xc 'micromamba install --yes -c conda-forge mysql-client && mysql -h mysql -u root --password=password -e "CREATE DATABASE DiracXAuthDB" && mysql -h mysql -u root --password=password -e "GRANT SELECT,INSERT,LOCK TABLES,UPDATE,DELETE,CREATE,DROP,ALTER,REFERENCES,CREATE VIEW,SHOW VIEW,INDEX,TRIGGER,ALTER ROUTINE,CREATE ROUTINE ON DiracXAuthDB.* TO Dirac@'"'"'%'"'"'" && python -m diracx.db init-sql && python -m diracx.db init-os'
    pull_policy: always

  diracx:
    image: ghcr.io/diracgrid/diracx/services:dev
    container_name: diracx
    environment:
      - DIRACX_CONFIG_BACKEND_URL=git+file:///cs_store/initialRepo
      - DIRACX_DB_URL_AUTHDB=mysql+aiomysql://Dirac:Dirac@mysql/DiracXAuthDB
      - DIRACX_DB_URL_JOBDB=mysql+aiomysql://Dirac:Dirac@mysql/JobDB
      - DIRACX_DB_URL_JOBLOGGINGDB=mysql+aiomysql://Dirac:Dirac@mysql/JobLoggingDB
      - DIRACX_DB_URL_SANDBOXMETADATADB=mysql+aiomysql://Dirac:Dirac@mysql/SandboxMetadataDB
      - DIRACX_DB_URL_PILOTAGENTSDB=mysql+aiomysql://Dirac:Dirac@mysql/PilotAgentsDB
      - 'DIRACX_OS_DB_PILOTLOGSDB={"sqlalchemy_dsn": "mysql+aiomysql://Dirac:Dirac@mysql/PilotLogsDB"}'
      - DIRACX_SERVICE_AUTH_TOKEN_KEY=file:///signing-key/rs256.key
      - DIRACX_SERVICE_AUTH_ALLOWED_REDIRECTS=["http://diracx:8000/docs/oauth2-redirect"]
      # Obtained with head -c 32 /dev/urandom | base64
      - DIRACX_SERVICE_AUTH_STATE_KEY=uSNPPtZ1EbC5np13zOwmWJ84Duix753Hejzk/u/MQE4=
      # Obtained with echo 'InsecureChangeMe' | base64 -d | openssl sha256
      - DIRACX_LEGACY_EXCHANGE_HASHED_API_KEY=07cddf6948d316ac9d186544dc3120c4c6697d8f994619665985c0a5bf76265a
      - DIRACX_SERVICE_JOBS_ENABLED=false
    ports:
      - 8000:8000
    depends_on:
      diracx-init-db:
        condition: service_completed_successfully
      diracx-wait-for-db:
        condition: service_completed_successfully
    volumes:
      - diracx-cs-store:/cs_store/
      - diracx-key-store:/signing-key/
    entrypoint: |
      /entrypoint.sh bash -xc 'uvicorn --factory diracx.routers:create_app --host=0.0.0.0'

    healthcheck:
      test: ["CMD", "/entrypoint.sh", "curl", "-f", "http://localhost:8000/.well-known/openid-configuration"]
      interval: 5s
      timeout: 2s
      retries: 15
      start_period: 60s
    pull_policy: always