From 085c006d96ebaa56be6c1ec95086116ed5b41e3d Mon Sep 17 00:00:00 2001 From: thoralmighty Date: Mon, 19 Jun 2023 18:31:43 +0200 Subject: [PATCH] Added Mayan EDMS --- mayan-edms/docker-compose.yml | 373 ++++++++++++++++++++++++++++++++++ 1 file changed, 373 insertions(+) create mode 100644 mayan-edms/docker-compose.yml diff --git a/mayan-edms/docker-compose.yml b/mayan-edms/docker-compose.yml new file mode 100644 index 0000000..4e977a8 --- /dev/null +++ b/mayan-edms/docker-compose.yml @@ -0,0 +1,373 @@ +version: '3.9' + +x-mayan-container: + &mayan-container + env_file: .env + environment: + MAYAN_CELERY_BROKER_URL: amqp://${MAYAN_RABBITMQ_USER:-mayan}:${MAYAN_RABBITMQ_PASSWORD:-mayanrabbitpass}@rabbitmq:5672/${MAYAN_RABBITMQ_VHOST:-mayan} + MAYAN_CELERY_RESULT_BACKEND: redis://:${MAYAN_REDIS_PASSWORD:-mayanredispassword}@redis:6379/1 + MAYAN_DATABASES: "{'default':{'ENGINE':'django.db.backends.postgresql','NAME':'${MAYAN_DATABASE_NAME:-mayan}','PASSWORD':'${MAYAN_DATABASE_PASSWORD:-mayandbpass}','USER':'${MAYAN_DATABASE_USER:-mayan}','HOST':'${MAYAN_DATABASE_HOST:-postgresql}'} }" + MAYAN_LOCK_MANAGER_BACKEND: mayan.apps.lock_manager.backends.redis_lock.RedisLock + MAYAN_LOCK_MANAGER_BACKEND_ARGUMENTS: "{'redis_url':'redis://:${MAYAN_REDIS_PASSWORD:-mayanredispassword}@redis:6379/2'}" + image: ${MAYAN_DOCKER_IMAGE_NAME:-mayanedms/mayanedms}:${MAYAN_DOCKER_IMAGE_TAG:-s4.4} + networks: + - mayan + restart: unless-stopped + volumes: + - ${MAYAN_APP_VOLUME:-app}:/var/lib/mayan + # Optional volumes to access external data like staging or watch folders + # - /opt/staging_folder:/staging_folder + # - /opt/watch_folder:/watch_folder + +x-mayan-traefik-labels: + &mayan-traefik-labels + labels: + - "traefik.enable=${MAYAN_TRAEFIK_FRONTEND_ENABLE:-false}" + - "traefik.http.middlewares.mayan_frontend_http_redirect.redirectscheme.scheme=https" + - "traefik.http.middlewares.mayan_frontend_http_redirect.redirectscheme.permanent=false" + - "traefik.http.routers.mayan_frontend_http.entrypoints=http" + - "traefik.http.routers.mayan_frontend_http.middlewares=mayan_frontend_http_redirect" + - "traefik.http.routers.mayan_frontend_http.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)" + - "traefik.http.routers.mayan_frontend_https.entrypoints=https" + - "traefik.http.routers.mayan_frontend_https.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)" + - "traefik.http.routers.mayan_frontend_https.service=mayan_frontend_http" + - "traefik.http.routers.mayan_frontend_https.tls=true" + - "traefik.http.routers.mayan_frontend_https.tls.certresolver=letsencrypt" + - "traefik.http.services.mayan_frontend_http.loadbalancer.server.port=8000" + +x-mayan-frontend-ports: + &mayan-frontend-ports + # Disable ports if using Traefik. Set to an empty list `[]`. + ports: + - "${MAYAN_FRONTEND_HTTP_PORT:-80}:8000" + # [] + +networks: + keycloak: + driver: bridge + # Change to true when using Traefik for increased security. + internal: false + mayan: + driver: bridge + # Change to true when using Traefik for increased security. + internal: false + traefik: {} + +services: + app: + <<: [*mayan-container,*mayan-traefik-labels,*mayan-frontend-ports] + profiles: + - all_in_one + + elasticsearch: + environment: + - bootstrap.memory_lock=true + - discovery.type=single-node + - http.max_content_length=400mb + - xpack.security.enabled=true + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - ELASTIC_PASSWORD=${MAYAN_ELASTICSEARCH_PASSWORD:-mayanespassword} + image: ${MAYAN_DOCKER_ELASTICSEARCH_IMAGE:-elasticsearch}:${MAYAN_DOCKER_ELASTICSEARCH_TAG:-7.17.9} + networks: + - mayan + # Enable to allow external access to the database. + # ports: + # - "9200:9200" + profiles: + - elasticsearch + restart: unless-stopped + ulimits: + memlock: + soft: -1 + hard: -1 + volumes: + - ${MAYAN_ELASTICSEARCH_VOLUME:-elasticsearch}:/usr/share/elasticsearch/data + + keycloak: + command: + - start + environment: + KEYCLOAK_ADMIN: ${MAYAN_KEYCLOAK_ADMIN:-admin} + KEYCLOAK_ADMIN_PASSWORD: ${MAYAN_KEYCLOAK_ADMIN_PASSWORD:-admin} + KC_DB: postgres + KC_DB_PASSWORD: ${MAYAN_KEYCLOAK_DATABASE_PASSWORD:-keycloakdbpass} + KC_DB_URL_DATABASE: ${MAYAN_KEYCLOAK_DATABASE_NAME:-keycloak} + KC_DB_URL_HOST: keycloak-postgres + KC_DB_USERNAME: ${MAYAN_DATABASE_KEYCLOAK_USER:-keycloak} + KC_HOSTNAME_URL: http://127.0.0.1:8081/ + KC_HOSTNAME_STRICT: false + KC_HTTP_ENABLED: true + image: ${MAYAN_DOCKER_KEYCLOAK_IMAGE:-keycloak/keycloak}:${MAYAN_DOCKER_KEYCLOAK_TAG:-20.0.1} + labels: + - "traefik.enable=${MAYAN_TRAEFIK_KEYCLOAK_ENABLE:-false}" + - "traefik.http.middlewares.keycloak_http_redirect.redirectscheme.scheme=https" + - "traefik.http.middlewares.keycloak_http_redirect.redirectscheme.permanent=false" + - "traefik.http.routers.keycloak_http.entrypoints=http" + - "traefik.http.routers.keycloak_http.middlewares=keycloak_http_redirect" + - "traefik.http.routers.keycloak_http.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)" + - "traefik.http.routers.keycloak_https.entrypoints=https" + - "traefik.http.routers.keycloak_https.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)" + - "traefik.http.routers.keycloak_https.service=keycloak_http" + - "traefik.http.routers.keycloak_https.tls=true" + - "traefik.http.routers.keycloak_https.tls.certresolver=letsencrypt" + - "traefik.http.services.keycloak_http.loadbalancer.server.port=${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}" + networks: + - keycloak + - mayan + # Disable ports if using Traefik. + ports: + - "${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}:${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}" + profiles: + - keycloak + restart: unless-stopped + + keycloak-postgres: + environment: + POSTGRES_DB: ${MAYAN_KEYCLOAK_DATABASE_NAME:-keycloak} + POSTGRES_PASSWORD: ${MAYAN_KEYCLOAK_DATABASE_PASSWORD:-keycloakdbpass} + POSTGRES_USER: ${MAYAN_DATABASE_KEYCLOAK_USER:-keycloak} + image: postgres:${MAYAN_DOCKER_KEYCLOAK_POSTGRES_TAG:-13.8-alpine} + networks: + - keycloak + profiles: + - keycloak_postgresql + restart: unless-stopped + volumes: + - ${MAYAN_KEYCLOAK_POSTGRES_VOLUME:-keycloak-postgres}:/var/lib/postgresql/data + + postgresql: + command: + - "postgres" + - "-c" + - "checkpoint_completion_target=0.6" + - "-c" + - "default_statistics_target=200" + - "-c" + - "maintenance_work_mem=128MB" + - "-c" + - "max_connections=150" + - "-c" + - "shared_buffers=256MB" + - "-c" + - "work_mem=8MB" + environment: + POSTGRES_DB: ${MAYAN_DATABASE_NAME:-mayan} + POSTGRES_PASSWORD: ${MAYAN_DATABASE_PASSWORD:-mayandbpass} + POSTGRES_USER: ${MAYAN_DATABASE_USER:-mayan} + image: ${MAYAN_DOCKER_POSTGRES_IMAGE:-postgres}:${MAYAN_DOCKER_POSTGRES_TAG:-13.10-alpine} + networks: + - mayan + # Enable to allow external access to the database. + # ports: + # - "5432:5432" + profiles: + - postgresql + restart: unless-stopped + volumes: + - ${MAYAN_POSTGRES_VOLUME:-postgres}:/var/lib/postgresql/data + + redis: + command: + - redis-server + - --appendonly + - "no" + - --databases + - "3" + - --maxmemory + - "100mb" + - --maxclients + - "500" + - --maxmemory-policy + - "allkeys-lru" + - --save + - "" + - --tcp-backlog + - "256" + - --requirepass + - "${MAYAN_REDIS_PASSWORD:-mayanredispassword}" + image: ${MAYAN_DOCKER_REDIS_IMAGE:-redis}:${MAYAN_DOCKER_REDIS_TAG:-7.0.10-alpine} + networks: + - mayan + profiles: + - redis + restart: unless-stopped + volumes: + - ${MAYAN_REDIS_VOLUME:-redis}:/data + + # Run a frontend gunicorn container + frontend: + <<: [*mayan-container,*mayan-traefik-labels,*mayan-frontend-ports] + command: + - run_frontend + profiles: + - extra_frontend + + # Enable to run standalone workers + mountindex: + <<: *mayan-container + cap_add: + - SYS_ADMIN + devices: + - "/dev/fuse:/dev/fuse" + entrypoint: + - /bin/sh + - -c + - 'mkdir --parents /mnt/index && chown mayan:mayan /mnt/index && /usr/local/bin/entrypoint.sh run_command "mirroring_mount_index --allow-other creation_date /mnt/index"' # Replace "creation_date" with the index of your choice. + profiles: + - mountindex + security_opt: + - apparmor:unconfined + volumes: + - type: bind + source: /mnt/mayan_indexes/creation_date # Host location where the index will show up. + target: /mnt/index # Location inside the container where the index will be mounted. Must the same is in the "entrypoint" section. + bind: + propagation: shared + + # Run a separate class A worker + worker_a: + <<: *mayan-container + command: + - run_worker + - worker_a + - "--prefetch-multiplier=1" + profiles: + - extra_worker_a + + # Run a separate class B worker + worker_b: + <<: *mayan-container + command: + - run_worker + - worker_b + - "--prefetch-multiplier=1" + profiles: + - extra_worker_b + + # Run a separate class C worker + worker_c: + <<: *mayan-container + command: + - run_worker + - worker_c + - "--prefetch-multiplier=1" + profiles: + - extra_worker_c + + # Run a separate class D worker + worker_d: + <<: *mayan-container + command: + - run_worker + - worker_d + - "--concurrency=1 --prefetch-multiplier=1" + profiles: + - extra_worker_d + + worker_custom_queue: + <<: *mayan-container + command: + - /bin/sh + - -c + - 'MAYAN_QUEUE_LIST=${MAYAN_WORKER_CUSTOM_QUEUE_LIST} /usr/local/bin/run_worker.sh --prefetch-multiplier=1' + profiles: + - extra_worker_custom + + # Run a separate Celery beat container + celery_beat: + <<: *mayan-container + command: + - run_celery + - "beat --pidfile= --loglevel=ERROR" + profiles: + - extra_celery_beat + + setup_or_upgrade: + <<: *mayan-container + command: + - run_initial_setup_or_perform_upgrade + profiles: + - extra_setup_or_upgrade + restart: "no" + + rabbitmq: + image: ${MAYAN_DOCKER_RABBITMQ_IMAGE:-rabbitmq}:${MAYAN_DOCKER_RABBITMQ_TAG:-3.11.13-management-alpine} + environment: + RABBITMQ_DEFAULT_USER: ${MAYAN_RABBITMQ_USER:-mayan} + RABBITMQ_DEFAULT_PASS: ${MAYAN_RABBITMQ_PASSWORD:-mayanrabbitpass} + RABBITMQ_DEFAULT_VHOST: ${MAYAN_RABBITMQ_VHOST:-mayan} + labels: + - "traefik.enable=${MAYAN_TRAEFIK_RABBITMQ_ENABLE:-false}" + - "traefik.http.routers.rabbitmq_admin_http.entrypoints=rabbitmq_admin_http" + - "traefik.http.routers.rabbitmq_admin_http.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)" + - "traefik.http.routers.rabbitmq_admin_http.service=rabbitmq_admin_http" + - "traefik.http.routers.rabbitmq_admin_http.tls=true" + - "traefik.http.routers.rabbitmq_admin_http.tls.certresolver=letsencrypt" + - "traefik.http.services.rabbitmq_admin_http.loadbalancer.server.port=15672" + networks: + - mayan + # Enable to allow access to the administration interface. + # ports: + # - "${MAYAN_RABBITMQ_ADMIN_PORT:-15672}:15672" + profiles: + - rabbitmq + restart: unless-stopped + volumes: + - ${MAYAN_RABBITMQ_VOLUME:-rabbitmq}:/var/lib/rabbitmq + + traefik: + container_name: "traefik" + command: + # - "--log.level=DEBUG" + - "--api.dashboard=true" + - "--api.insecure=${MAYAN_TRAEFIK_API_INSECURE:-false}" + - "--certificatesresolvers.letsencrypt.acme.caserver=${MAYAN_TRAEFIK_LETS_ENCRYPT_SERVER:-https://acme-staging-v02.api.letsencrypt.org/directory}" + - "--certificatesresolvers.letsencrypt.acme.dnschallenge=${MAYAN_TRAEFIK_LETS_ENCRYPT_DNS_CHALLENGE:-false}" + - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=${MAYAN_TRAEFIK_LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER}" + - "--certificatesresolvers.letsencrypt.acme.email=${MAYAN_TRAEFIK_LETS_ENCRYPT_EMAIL}" + - "--certificatesresolvers.letsencrypt.acme.storage=/traefik-certificates-letsencrypt/acme.json" + - "--certificatesresolvers.letsencrypt.acme.tlschallenge=${MAYAN_TRAEFIK_LETS_ENCRYPT_TLS_CHALLENGE:-false}" + - "--entrypoints.http.address=:80" + - "--entrypoints.https.address=:443" + - "--entrypoints.keycloak_http.address=:${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}" + - "--entrypoints.rabbitmq_admin_http.address=:15672" + - "--entrypoints.traefik_dashboard_http.address=:8080" + - "--providers.docker=true" + - "--providers.docker.exposedbydefault=false" + # - Add DNS provider variables (https://doc.traefik.io/traefik/https/acme/#providers) + # environment: + image: ${MAYAN_DOCKER_TRAEFIK_IMAGE:-traefik}:${MAYAN_DOCKER_TRAEFIK_TAG:-v2.5} + labels: + - "traefik.enable=${MAYAN_TRAEFIK_DASHBOARD_ENABLE:-false}" + - "traefik.http.middlewares.basic-auth-global.basicauth.users=${MAYAN_TRAEFIK_DASHBOARD_AUTHENTICATION}" + - "traefik.http.routers.traefik_https.entrypoints=traefik_dashboard_http" + - "traefik.http.routers.traefik_https.middlewares=basic-auth-global" + - "traefik.http.routers.traefik_https.rule=Host(`${MAYAN_TRAEFIK_EXTERNAL_DOMAIN}`)" + - "traefik.http.routers.traefik_https.service=api@internal" + - "traefik.http.routers.traefik_https.tls=true" + - "traefik.http.routers.traefik_https.tls.certresolver=letsencrypt" + networks: + - mayan + - traefik + ports: + - "${MAYAN_RABBITMQ_ADMIN_HTTP_PORT:-15672}:15672" + - "${MAYAN_TRAEFIK_DASHBOARD_HTTP_PORT:-8080}:8080" + - "${MAYAN_TRAEFIK_KEYCLOAK_HTTP_PORT:-8081}:8081" + - "${MAYAN_TRAEFIK_HTTP_PORT:-80}:80" + - "${MAYAN_TRAEFIK_HTTPS_PORT:-443}:443" + profiles: + - traefik + restart: unless-stopped + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + - ${MAYAN_TRAEFIK_LETSENCRYPT_VOLUME:-traefik-certificates-letsencrypt}:/traefik-certificates-letsencrypt + +volumes: + app: + elasticsearch: + keycloak-postgres: + postgres: + mountindex: + rabbitmq: + redis: + traefik-certificates-letsencrypt: