docker-compose-api.annif.org.yml

version: "3.6"

services:

  annif_app:
    image: quay.io/natlibfi/annif:0.46.0
    command: ["gunicorn", "annif:create_app()", "--bind", "0.0.0.0:8000", "--timeout", "600"]
    volumes:
      - data:/annif-projects:ro
      - /etc/localtime:/etc/localtime:ro
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.environment == $NODE_LABELS_ENVIRONMENT
      update_config:
        order: start-first
    healthcheck:
      test: ["CMD", "curl", "--fail", "localhost:8000/v1/projects"]
      interval: 15s
      retries: 3
      start_period: 600s

  nginx:
    image: nginx:1.17-alpine
    volumes:
      - webdata:/webdata:ro
      - /etc/localtime:/etc/localtime:ro
      - logs:/tmp
    configs:
      - nginx.conf
    command: ["nginx", "-c", "/nginx.conf", "-g", "daemon off;"]
    networks:
      - default
      - traefik-net
    deploy:
      replicas: 1
      update_config:
        failure_action: rollback
        order: start-first
      placement:
        constraints:
          - node.labels.environment == $NODE_LABELS_ENVIRONMENT
      labels:
        - traefik.enable=true
        - traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80
        - traefik.http.routers.${STACK_NAME}-http.rule=Host(`${SERVICE_DOMAIN}`)
        - traefik.http.routers.${STACK_NAME}-http.entrypoints=http
        #- traefik.http.routers.${STACK_NAME}-http.middlewares=redirect@file
        - traefik.http.routers.${STACK_NAME}-https.rule=Host(`${SERVICE_DOMAIN}`)
        - traefik.http.routers.${STACK_NAME}-https.entrypoints=https
        - traefik.http.routers.${STACK_NAME}-https.tls=true

  mauiserver:
    image: quay.io/natlibfi/mauiserver:1.3.2
    volumes:
      - data:/annif-projects
      - /etc/localtime:/etc/localtime:ro
    environment:
      - MAUI_SERVER_DATA_DIR=/annif-projects/mauidata
      - JAVA_OPTS="-Duser.timezone=Europe/Helsinki"
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.environment == $NODE_LABELS_ENVIRONMENT

  modeldata_sync:
    image: quay.io/natlibfi/annif-rsync
    volumes:
      - data:/annif-projects
      - /etc/localtime:/etc/localtime:ro
    secrets:
      - source: annif-rsync-id-rsa
        target: /home/rsync-user/.ssh/id_rsa
        mode: 0400
        uid: '998'
        gid: '998'
      - source: annif-kk-ssh-host-rsa-key
        target: /home/rsync-user/.ssh/known_hosts
        mode: 0600
        uid: '998'
        gid: '998'
    command: rsync -avzLu --exclude '*omikuji-train.txt' annif@$ANNIF_KK:/srv/annif-data/$SERVICE_DOMAIN/* /annif-projects
    networks:
      - traefik-net
    deploy:
      replicas: 0
      restart_policy:
        condition: none
      placement:
        constraints:
          - node.labels.environment == $NODE_LABELS_ENVIRONMENT

  webdata_sync:
    image: quay.io/natlibfi/annif-svn
    volumes:
      - webdata:/tmp
      - /etc/localtime:/etc/localtime:ro
    command: svn checkout https://github.com/NatLibFi/Annif/branches/api-instances/$SERVICE_DOMAIN/ /tmp
    deploy:
      replicas: 0
      restart_policy:
        condition: on-failure
        max_attempts: 3
      placement:
        constraints:
          - node.labels.environment == $NODE_LABELS_ENVIRONMENT

  matomo_importer:
    image: quay.io/natlibfi/annif-logs-matomo-importer
    volumes:
      - logs:/tmp:ro
      - /etc/localtime:/etc/localtime:ro
    command: >
      sh -c "
      tail -f tmp/access.log | python2 import_logs.py --url=https://tilasto.lib.helsinki.fi --idsite=13 --token-auth $$(cat /run/secrets/matomo-token) --enable-http-errors --enable-http-redirects --enable-static --enable-bots --recorder-max-payload-size=10 -
      "
    secrets:
      - matomo-token
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        max_attempts: 3
      placement:
        constraints:
          - node.labels.environment == $NODE_LABELS_ENVIRONMENT

volumes:
  data:
  webdata:
  logs:

networks:
  traefik-net:
    external: true

configs:
  nginx.conf:
    external: true
    name: ${STACK_NAME}-nginx-proxy5

secrets:
  annif-rsync-id-rsa:
    external: true
  annif-kk-ssh-host-rsa-key:
    external: true
  matomo-token:
    external: true
    name: ${STACK_NAME}-matomo-token