docker-compose/mayan-edms/docker-compose.yml

version: '3.9'

x-mayan-container:
  &mayan-container
  env_file: .env
  environment:
    MAYAN_CELERY_BROKER_URL: amqp://${MAYAN_RABBITMQ_USER:-mayan}:${MAYAN_RABBITMQ_PASSWORD:-mayanrabbitpass}@rabbitmq:5672/${MAYAN_RABBITMQ_VHOST:-mayan}
    MAYAN_CELERY_RESULT_BACKEND: redis://:${MAYAN_REDIS_PASSWORD:-mayanredispassword}@redis:6379/1
    MAYAN_DATABASES: "{'default':{'ENGINE':'django.db.backends.postgresql','NAME':'${MAYAN_DATABASE_NAME:-mayan}','PASSWORD':'${MAYAN_DATABASE_PASSWORD:-mayandbpass}','USER':'${MAYAN_DATABASE_USER:-mayan}','HOST':'${MAYAN_DATABASE_HOST:-postgresql}'} }"
    MAYAN_LOCK_MANAGER_BACKEND: mayan.apps.lock_manager.backends.redis_lock.RedisLock
    MAYAN_LOCK_MANAGER_BACKEND_ARGUMENTS: "{'redis_url':'redis://:${MAYAN_REDIS_PASSWORD:-mayanredispassword}@redis:6379/2'}"
  image: ${MAYAN_DOCKER_IMAGE_NAME:-mayanedms/mayanedms}:${MAYAN_DOCKER_IMAGE_TAG:-s4.4}
  networks:
    - mayan
  restart: unless-stopped
  volumes:
    - ${MAYAN_APP_VOLUME:-app}:/var/lib/mayan
    # Optional volumes to access external data like staging or watch folders
    # - /opt/staging_folder:/staging_folder
    # - /opt/watch_folder:/watch_folder

x-mayan-traefik-labels:
  &mayan-traefik-labels
  labels:
    - "traefik.enable=${MAYAN_TRAEFIK_FRONTEND_ENABLE:-false}"
    - "traefik.http.middlewares.mayan_frontend_http_redirect.redirectscheme.scheme=https"
    - "traefik.http.middlewares.mayan_frontend_http_redirect.redirectscheme.permanent=false"
    - "traefik.http.routers.mayan_frontend_http.entrypoints=http"
    - "traefik.http.routers.mayan_frontend_http.middlewares=mayan_frontend_http_redirect"
    - "traefik.http.routers.mayan_frontend_http.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)"
    - "traefik.http.routers.mayan_frontend_https.entrypoints=https"
    - "traefik.http.routers.mayan_frontend_https.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)"
    - "traefik.http.routers.mayan_frontend_https.service=mayan_frontend_http"
    - "traefik.http.routers.mayan_frontend_https.tls=true"
    - "traefik.http.routers.mayan_frontend_https.tls.certresolver=letsencrypt"
    - "traefik.http.services.mayan_frontend_http.loadbalancer.server.port=8000"

x-mayan-frontend-ports:
  &mayan-frontend-ports
  # Disable ports if using Traefik. Set to an empty list `[]`.
  ports:
    - "${MAYAN_FRONTEND_HTTP_PORT:-80}:8000"
    # []

networks:
  keycloak:
    driver: bridge
    # Change to true when using Traefik for increased security.
    internal: false
  mayan:
    driver: bridge
    # Change to true when using Traefik for increased security.
    internal: false
  traefik: {}

services:
  app:
    <<: [*mayan-container,*mayan-traefik-labels,*mayan-frontend-ports]
    profiles:
      - all_in_one

  elasticsearch:
    environment:
      - bootstrap.memory_lock=true
      - discovery.type=single-node
      - http.max_content_length=400mb
      - xpack.security.enabled=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - ELASTIC_PASSWORD=${MAYAN_ELASTICSEARCH_PASSWORD:-mayanespassword}
    image: ${MAYAN_DOCKER_ELASTICSEARCH_IMAGE:-elasticsearch}:${MAYAN_DOCKER_ELASTICSEARCH_TAG:-7.17.9}
    networks:
      - mayan
    # Enable to allow external access to the database.
    # ports:
    #  - "9200:9200"
    profiles:
      - elasticsearch
    restart: unless-stopped
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - ${MAYAN_ELASTICSEARCH_VOLUME:-elasticsearch}:/usr/share/elasticsearch/data

  keycloak:
    command:
      - start
    environment:
      KEYCLOAK_ADMIN: ${MAYAN_KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${MAYAN_KEYCLOAK_ADMIN_PASSWORD:-admin}
      KC_DB: postgres
      KC_DB_PASSWORD: ${MAYAN_KEYCLOAK_DATABASE_PASSWORD:-keycloakdbpass}
      KC_DB_URL_DATABASE: ${MAYAN_KEYCLOAK_DATABASE_NAME:-keycloak}
      KC_DB_URL_HOST: keycloak-postgres
      KC_DB_USERNAME: ${MAYAN_DATABASE_KEYCLOAK_USER:-keycloak}
      KC_HOSTNAME_URL: http://127.0.0.1:8081/
      KC_HOSTNAME_STRICT: false
      KC_HTTP_ENABLED: true
    image: ${MAYAN_DOCKER_KEYCLOAK_IMAGE:-keycloak/keycloak}:${MAYAN_DOCKER_KEYCLOAK_TAG:-20.0.1}
    labels:
      - "traefik.enable=${MAYAN_TRAEFIK_KEYCLOAK_ENABLE:-false}"
      - "traefik.http.middlewares.keycloak_http_redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.keycloak_http_redirect.redirectscheme.permanent=false"
      - "traefik.http.routers.keycloak_http.entrypoints=http"
      - "traefik.http.routers.keycloak_http.middlewares=keycloak_http_redirect"
      - "traefik.http.routers.keycloak_http.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)"
      - "traefik.http.routers.keycloak_https.entrypoints=https"
      - "traefik.http.routers.keycloak_https.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)"
      - "traefik.http.routers.keycloak_https.service=keycloak_http"
      - "traefik.http.routers.keycloak_https.tls=true"
      - "traefik.http.routers.keycloak_https.tls.certresolver=letsencrypt"
      - "traefik.http.services.keycloak_http.loadbalancer.server.port=${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}"
    networks:
      - keycloak
      - mayan
    # Disable ports if using Traefik.
    ports:
      - "${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}:${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}"
    profiles:
      - keycloak
    restart: unless-stopped

  keycloak-postgres:
    environment:
      POSTGRES_DB: ${MAYAN_KEYCLOAK_DATABASE_NAME:-keycloak}
      POSTGRES_PASSWORD: ${MAYAN_KEYCLOAK_DATABASE_PASSWORD:-keycloakdbpass}
      POSTGRES_USER: ${MAYAN_DATABASE_KEYCLOAK_USER:-keycloak}
    image: postgres:${MAYAN_DOCKER_KEYCLOAK_POSTGRES_TAG:-13.8-alpine}
    networks:
      - keycloak
    profiles:
      - keycloak_postgresql
    restart: unless-stopped
    volumes:
      - ${MAYAN_KEYCLOAK_POSTGRES_VOLUME:-keycloak-postgres}:/var/lib/postgresql/data

  postgresql:
    command:
      - "postgres"
      - "-c"
      - "checkpoint_completion_target=0.6"
      - "-c"
      - "default_statistics_target=200"
      - "-c"
      - "maintenance_work_mem=128MB"
      - "-c"
      - "max_connections=150"
      - "-c"
      - "shared_buffers=256MB"
      - "-c"
      - "work_mem=8MB"
    environment:
      POSTGRES_DB: ${MAYAN_DATABASE_NAME:-mayan}
      POSTGRES_PASSWORD: ${MAYAN_DATABASE_PASSWORD:-mayandbpass}
      POSTGRES_USER: ${MAYAN_DATABASE_USER:-mayan}
    image: ${MAYAN_DOCKER_POSTGRES_IMAGE:-postgres}:${MAYAN_DOCKER_POSTGRES_TAG:-13.10-alpine}
    networks:
      - mayan
    # Enable to allow external access to the database.
    # ports:
    #  - "5432:5432"
    profiles:
      - postgresql
    restart: unless-stopped
    volumes:
      - ${MAYAN_POSTGRES_VOLUME:-postgres}:/var/lib/postgresql/data

  redis:
    command:
      - redis-server
      - --appendonly
      - "no"
      - --databases
      - "3"
      - --maxmemory
      - "100mb"
      - --maxclients
      - "500"
      - --maxmemory-policy
      - "allkeys-lru"
      - --save
      - ""
      - --tcp-backlog
      - "256"
      - --requirepass
      - "${MAYAN_REDIS_PASSWORD:-mayanredispassword}"
    image: ${MAYAN_DOCKER_REDIS_IMAGE:-redis}:${MAYAN_DOCKER_REDIS_TAG:-7.0.10-alpine}
    networks:
      - mayan
    profiles:
      - redis
    restart: unless-stopped
    volumes:
      - ${MAYAN_REDIS_VOLUME:-redis}:/data

  # Run a frontend gunicorn container
  frontend:
    <<: [*mayan-container,*mayan-traefik-labels,*mayan-frontend-ports]
    command:
      - run_frontend
    profiles:
      - extra_frontend

  # Enable to run standalone workers
  mountindex:
    <<: *mayan-container
    cap_add:
      - SYS_ADMIN
    devices:
      - "/dev/fuse:/dev/fuse"
    entrypoint:
      - /bin/sh
      - -c
      - 'mkdir --parents /mnt/index && chown mayan:mayan /mnt/index && /usr/local/bin/entrypoint.sh run_command "mirroring_mount_index --allow-other creation_date /mnt/index"'  # Replace "creation_date" with the index of your choice.
    profiles:
      - mountindex
    security_opt:
      - apparmor:unconfined
    volumes:
      - type: bind
        source: /mnt/mayan_indexes/creation_date  # Host location where the index will show up.
        target: /mnt/index  # Location inside the container where the index will be mounted. Must the same is in the "entrypoint" section.
        bind:
          propagation: shared

  # Run a separate class A worker
  worker_a:
    <<: *mayan-container
    command:
      - run_worker
      - worker_a
      - "--prefetch-multiplier=1"
    profiles:
      - extra_worker_a

  # Run a separate class B worker
  worker_b:
    <<: *mayan-container
    command:
      - run_worker
      - worker_b
      - "--prefetch-multiplier=1"
    profiles:
      - extra_worker_b

  # Run a separate class C worker
  worker_c:
    <<: *mayan-container
    command:
      - run_worker
      - worker_c
      - "--prefetch-multiplier=1"
    profiles:
      - extra_worker_c

  # Run a separate class D worker
  worker_d:
    <<: *mayan-container
    command:
      - run_worker
      - worker_d
      - "--concurrency=1 --prefetch-multiplier=1"
    profiles:
      - extra_worker_d

  worker_custom_queue:
    <<: *mayan-container
    command:
      - /bin/sh
      - -c
      - 'MAYAN_QUEUE_LIST=${MAYAN_WORKER_CUSTOM_QUEUE_LIST} /usr/local/bin/run_worker.sh --prefetch-multiplier=1'
    profiles:
      - extra_worker_custom

  # Run a separate Celery beat container
  celery_beat:
    <<: *mayan-container
    command:
      - run_celery
      - "beat --pidfile= --loglevel=ERROR"
    profiles:
      - extra_celery_beat

  setup_or_upgrade:
    <<: *mayan-container
    command:
      - run_initial_setup_or_perform_upgrade
    profiles:
      - extra_setup_or_upgrade
    restart: "no"

  rabbitmq:
    image: ${MAYAN_DOCKER_RABBITMQ_IMAGE:-rabbitmq}:${MAYAN_DOCKER_RABBITMQ_TAG:-3.11.13-management-alpine}
    environment:
      RABBITMQ_DEFAULT_USER: ${MAYAN_RABBITMQ_USER:-mayan}
      RABBITMQ_DEFAULT_PASS: ${MAYAN_RABBITMQ_PASSWORD:-mayanrabbitpass}
      RABBITMQ_DEFAULT_VHOST: ${MAYAN_RABBITMQ_VHOST:-mayan}
    labels:
      - "traefik.enable=${MAYAN_TRAEFIK_RABBITMQ_ENABLE:-false}"
      - "traefik.http.routers.rabbitmq_admin_http.entrypoints=rabbitmq_admin_http"
      - "traefik.http.routers.rabbitmq_admin_http.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)"
      - "traefik.http.routers.rabbitmq_admin_http.service=rabbitmq_admin_http"
      - "traefik.http.routers.rabbitmq_admin_http.tls=true"
      - "traefik.http.routers.rabbitmq_admin_http.tls.certresolver=letsencrypt"
      - "traefik.http.services.rabbitmq_admin_http.loadbalancer.server.port=15672"
    networks:
      - mayan
    # Enable to allow access to the administration interface.
    # ports:
    #   - "${MAYAN_RABBITMQ_ADMIN_PORT:-15672}:15672"
    profiles:
      - rabbitmq
    restart: unless-stopped
    volumes:
      - ${MAYAN_RABBITMQ_VOLUME:-rabbitmq}:/var/lib/rabbitmq

  traefik:
    container_name: "traefik"
    command:
      # - "--log.level=DEBUG"
      - "--api.dashboard=true"
      - "--api.insecure=${MAYAN_TRAEFIK_API_INSECURE:-false}"
      - "--certificatesresolvers.letsencrypt.acme.caserver=${MAYAN_TRAEFIK_LETS_ENCRYPT_SERVER:-https://acme-staging-v02.api.letsencrypt.org/directory}"
      - "--certificatesresolvers.letsencrypt.acme.dnschallenge=${MAYAN_TRAEFIK_LETS_ENCRYPT_DNS_CHALLENGE:-false}"
      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=${MAYAN_TRAEFIK_LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER}"
      - "--certificatesresolvers.letsencrypt.acme.email=${MAYAN_TRAEFIK_LETS_ENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/traefik-certificates-letsencrypt/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=${MAYAN_TRAEFIK_LETS_ENCRYPT_TLS_CHALLENGE:-false}"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.https.address=:443"
      - "--entrypoints.keycloak_http.address=:${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}"
      - "--entrypoints.rabbitmq_admin_http.address=:15672"
      - "--entrypoints.traefik_dashboard_http.address=:8080"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
    # - Add DNS provider variables (https://doc.traefik.io/traefik/https/acme/#providers)
    # environment:
    image: ${MAYAN_DOCKER_TRAEFIK_IMAGE:-traefik}:${MAYAN_DOCKER_TRAEFIK_TAG:-v2.5}
    labels:
      - "traefik.enable=${MAYAN_TRAEFIK_DASHBOARD_ENABLE:-false}"
      - "traefik.http.middlewares.basic-auth-global.basicauth.users=${MAYAN_TRAEFIK_DASHBOARD_AUTHENTICATION}"
      - "traefik.http.routers.traefik_https.entrypoints=traefik_dashboard_http"
      - "traefik.http.routers.traefik_https.middlewares=basic-auth-global"
      - "traefik.http.routers.traefik_https.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)"
      - "traefik.http.routers.traefik_https.service=api@internal"
      - "traefik.http.routers.traefik_https.tls=true"
      - "traefik.http.routers.traefik_https.tls.certresolver=letsencrypt"
    networks:
      - mayan
      - traefik
    ports:
      - "${MAYAN_RABBITMQ_ADMIN_HTTP_PORT:-15672}:15672"
      - "${MAYAN_TRAEFIK_DASHBOARD_HTTP_PORT:-8080}:8080"
      - "${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}:8081"
      - "${MAYAN_TRAEFIK_HTTP_PORT:-80}:80"
      - "${MAYAN_TRAEFIK_HTTPS_PORT:-443}:443"
    profiles:
      - traefik
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${MAYAN_TRAEFIK_LETSENCRYPT_VOLUME:-traefik-certificates-letsencrypt}:/traefik-certificates-letsencrypt

volumes:
  app:
  elasticsearch:
  keycloak-postgres:
  postgres:
  mountindex:
  rabbitmq:
  redis:
  traefik-certificates-letsencrypt: