docker-compose.yml

# This docker-compose file will stand up the entire stack including ingress and inventory.
version: "3"
services:
  kafka:
    image: docker.io/confluentinc/cp-kafka
    ports:
      - 29092:29092
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: 'CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT'
      KAFKA_ADVERTISED_LISTENERS: 'PLAINTEXT://kafka:29092,PLAINTEXT_HOST://localhost:9092'
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_PROCESS_ROLES: 'broker,controller'
      KAFKA_CONTROLLER_QUORUM_VOTERS: '1@kafka:29093'
      KAFKA_LISTENERS: 'PLAINTEXT://kafka:29092,CONTROLLER://kafka:29093,PLAINTEXT_HOST://0.0.0.0:9092'
      KAFKA_INTER_BROKER_LISTENER_NAME: 'PLAINTEXT'
      KAFKA_CONTROLLER_LISTENER_NAMES: 'CONTROLLER'
      CLUSTER_ID: OTQ3MmM2NDRhNjg3NDZhOG
  createtopics:
    image: docker.io/confluentinc/cp-kafka
    volumes:
      - ./xjoin-config:/xjoin-config:Z
    depends_on:
      - kafka
      - elasticsearch
      - debezium
      - xjoin
    links:
      - kafka
      - elasticsearch
      - debezium
    command: "bash -c 'echo Waiting for Kafka to be ready... && \
                       sleep 10 && \
                       kafka-topics --create --if-not-exists --topic platform.upload.announce --bootstrap-server kafka:29092 && \
                       kafka-topics --create --if-not-exists --topic platform.inventory.events --bootstrap-server kafka:29092 && \
                       /xjoin-config/configure-xjoin.sh'"
  puptoo:
    image: quay.io/cloudservices/insights-puptoo:latest
    environment:
      - REJECTION_TOPIC=platform.upload.validation
      - LOGLEVEL=INFO
      - PROMETHEUS_PORT=8001
    depends_on:
      - kafka
      - createtopics
    links:
      - kafka
  minio:
    image: quay.io/cloudservices/minio
    command: server /data
    volumes:
      - /data
    ports:
      - 9000:9000
    env_file: .env
  createbuckets:
    image: docker.io/minio/mc
    depends_on:
      - minio
    links:
      - minio
    entrypoint: /bin/sh
    command: -c '
      until /usr/bin/mc config host add myminio http://minio:9000 $MINIO_ACCESS_KEY $MINIO_SECRET_KEY >/dev/null; do sleep 1; done ;
      /usr/bin/mc mb myminio/insights-upload-perma;
      /usr/bin/mc mb myminio/insights-upload-rejected;
      /usr/bin/mc policy set download myminio/insights-upload-perma;
      /usr/bin/mc policy set download myminio/insights-upload-rejected;
      exit 0;'
    volumes:
      - /data
    env_file: .env
  ingress:
    image: quay.io/cloudservices/insights-ingress:latest
    environment:
      - AWS_ACCESS_KEY_ID=$MINIO_ACCESS_KEY
      - AWS_SECRET_ACCESS_KEY=$MINIO_SECRET_KEY
      - AWS_REGION=us-east-1
      - INGRESS_STAGEBUCKET=insights-upload-perma
      - INGRESS_REJECTBUCKET=insights-upload-rejected
      - INGRESS_VALIDTOPICS=testareno,advisor,buckit,compliance # if you test a different topic, add it here
      - INGRESS_INVENTORYURL=inventory-web:8081/api/inventory/v1/hosts
      - OPENSHIFT_BUILD_COMMIT=woopwoop
      - INGRESS_PORT=8080
      - INGRESS_WEBPORT=8080
      - INGRESS_METRICSPORT=3001
      - INGRESS_MINIODEV=true
      - INGRESS_MINIOACCESSKEY=$MINIO_ACCESS_KEY
      - INGRESS_MINIOSECRETKEY=$MINIO_SECRET_KEY
      - INGRESS_MINIOENDPOINT=minio:9000
      - INGRESS_MAXSIZE=104857600 # 100 MB
    env_file: .env
    ports:
      - 8080:8080
    depends_on:
      - kafka
    links:
      - kafka
  db:
    image: docker.io/debezium/postgres:15-alpine
    restart: always
    environment:
      POSTGRES_PASSWORD: insights
      POSTGRES_USER: insights
      POSTGRES_DB: insights
    ports:
      - 5432:5432
    volumes:
      - /var/lib/postgresql/data
  rbac:
    image: quay.io/cloudservices/rbac:latest
    restart: on-failure
    environment:
      - REDIS_PORT=6379
      - REDIS_HOST=redis
      - DATABASE_HOST=db
      - DATABASE_PORT=5432
      - DATABASE_NAME=insights
      - DATABASE_USER=insights
      - DATABASE_PASSWORD=insights
      - API_PATH_PREFIX=/api/rbac
      - DEVELOPMENT=False
      - BYPASS_BOP_VERIFICATION=True
      - IT_BYPASS_TOKEN_VALIDATION=True
    depends_on:
      - build-rbac-db
      - db
      - redis
    links:
      - db
      - redis
    ports:
      - 9002:8080
    volumes:
      - ./config/devel/rbac/definitions:/opt/rbac/rbac/management/role/definitions
      - ./config/devel/rbac/permissions:/opt/rbac/rbac/management/role/permissions
  build-rbac-db:
    image: quay.io/cloudservices/rbac:latest
    environment:
      - REDIS_PORT=6379
      - REDIS_HOST=redis
      - DATABASE_HOST=db
      - DATABASE_PORT=5432
      - DATABASE_NAME=insights
      - DATABASE_USER=insights
      - DATABASE_PASSWORD=insights
      - TENANT_PARALLEL_MIGRATION_MAX_PROCESSES=4
      - TENANT_PARALLEL_MIGRATION_CHUNKS=2
      - ACCESS_CACHE_CONNECT_SIGNALS=False
      - MAX_SEED_THREADS=2
    depends_on:
      - db
      - redis
    links:
      - db
      - redis
    volumes:
      - ./config/devel/rbac/definitions:/opt/rbac/rbac/management/role/definitions
      - ./config/devel/rbac/permissions:/opt/rbac/rbac/management/role/permissions
    entrypoint: /bin/sh
    command: -c './rbac/manage.py migrate ; ./rbac/manage.py seeds'
  inventory:
    image: quay.io/cloudservices/insights-inventory:latest
    command: bash -c 'sleep 10 && make upgrade_db && make run_inv_mq_service'
    entrypoint: ''
    environment:
      - INVENTORY_DB_HOST=db
      - KAFKA_BOOTSTRAP_SERVERS=kafka:29092
      - INVENTORY_LOG_LEVEL=ERROR
      - KAFKA_SECONDARY_TOPIC_ENABLED=True
      - XJOIN_GRAPHQL_URL=http://xjoin:4000/graphql
    depends_on:
      - db
      - kafka
    links:
      - db
      - kafka
    restart: on-failure
  inventory-web:
    image: quay.io/cloudservices/insights-inventory:latest
    command: bash -c 'sleep 10 && make upgrade_db && python run_gunicorn.py'
    entrypoint: ''
    environment:
      - INVENTORY_DB_HOST=db
      - KAFKA_BOOTSTRAP_SERVERS=kafka:29092
      - KAFKA_TOPIC=platform.system_profile
        KAFKA_GROUP=inventory
      - INVENTORY_LOG_LEVEL=DEBUG
      - KAFKA_SECONDARY_TOPIC_ENABLED=True
      - LISTEN_PORT=8081
      - XJOIN_GRAPHQL_URL=http://xjoin:4000/graphql
    ports:
      - 8081:8081
    depends_on:
      - db
      - kafka
      - xjoin
    links:
      - db
      - kafka
      - xjoin
  debezium:
    image: quay.io/cloudservices/xjoin-kafka-connect-strimzi
    restart: always
    entrypoint: /opt/kafka/kafka_connect_run.sh
    volumes:
      - ./xjoin-config/log4j.properties/:/opt/kafka/custom-config/log4j.properties:Z
    environment:
      - KAFKA_CONNECT_BOOTSTRAP_SERVERS=kafka:29092
      - KAFKA_CONNECT_METRICS_ENABLED=false
      - STRIMZI_KAFKA_GC_LOG_ENABLED=false
      - |
        KAFKA_CONNECT_CONFIGURATION=
        offset.storage.topic=connect-cluster-offsets
        value.converter=org.apache.kafka.connect.json.JsonConverter
        config.storage.topic=connect-cluster-configs
        key.converter=org.apache.kafka.connect.json.JsonConverter
        group.id=connect-cluster
        status.storage.topic=connect-cluster-status
        config.storage.replication.factor=1
        connector.client.config.override.policy=All
        offset.storage.replication.factor=1
        status.storage.replication.factor=1
    depends_on:
      - kafka
      - db
      - inventory
    ports:
      - 8083:8083
  elasticsearch:
    restart: always
    image: docker.io/library/elasticsearch:7.10.1
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      - xpack.security.enabled=false
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - cluster.routing.allocation.disk.threshold_enabled=false
  xjoin:
    image: quay.io/cloudservices/xjoin-search:latest
    restart: always
    environment:
      - LOG_LEVEL=debug
      - LOG_PRETTY=false
      - NODE_ENV=development
      - ES_NODES=http://elasticsearch:9200
      - HOSTS_INDEX=xjoin.inventory
    ports:
      - 4000:4000
    depends_on:
      - elasticsearch
      - debezium
  compliance-ssg:
    image: quay.io/cloudservices/compliance-ssg
    restart: on-failure
    environment:
      - NGINX_PORT=8088
    ports:
      - 8088:8088
  #
  # NOTE: The following two 'services' are only required for a new DB
  # Feel free to comment them out for subsequent use
  #
  build-rails-db:
    image: compliance-backend-rails
    entrypoint: ''
    command: sh -c '
      if bundle exec rake db:version 2> /dev/null; then
        bundle exec rake --trace db:migrate;
      else
        bundle exec rake --trace db:setup;
      fi;
      RAILS_ENV=test bundle exec rake --trace db:create;
      RAILS_ENV=test bundle exec rake --trace db:test:prepare;
      echo "Setting up Cyndi data in the development DB";
      bundle exec rails db -p < db/cyndi_setup_devel.sql;
      echo "Setting up Cyndi data in the test DB";
      RAILS_ENV=test bundle exec rails db -p < db/cyndi_setup_test.sql;
      '
    tmpfs:
      - /opt/app-root/src/log
      - /opt/app-root/src/tmp
    volumes:
      - .:/opt/app-root/src:z
    depends_on:
      - db
    links:
      - db
    environment:
      - POSTGRESQL_TEST_DATABASE=compliance_test
      - ACG_CONFIG=/opt/app-root/src/devel.json
  import-ssg:
    image: compliance-backend-rails
    entrypoint: ''
    command: 'bundle exec rake ssg:import_rhel_supported'
    restart: on-failure
    tmpfs:
      - /opt/app-root/src/log
      - /opt/app-root/src/tmp
    volumes:
      - .:/opt/app-root/src/:z
    depends_on:
      - db
      - compliance-ssg
      - build-rails-db
    links:
      - db
      - compliance-ssg
    environment:
      - POSTGRESQL_TEST_DATABASE=compliance_test
      - RAILS_LOG_TO_STDOUT=true
      - ACG_CONFIG=/opt/app-root/src/devel.json
  rails:
    env_file: .env
    build:
      context: .
      target: build
      args:
        - prod=false
        - extras=$EXTRA_PACKAGES
    image: compliance-backend-rails
    entrypoint: '/opt/app-root/src/devel.entrypoint.sh'
    command: 'bundle exec rails s -b 0.0.0.0'
    tty: true
    stdin_open: true
    restart: on-failure
    environment:
      - POSTGRESQL_TEST_DATABASE=compliance_test
      - DISABLE_DATABASE_ENVIRONMENT_CHECK=1
      - HOSTNAME=rails
      - ACG_CONFIG=/opt/app-root/src/devel.json
      - SWAGGER_DRY_RUN=0
    ports:
      - 3000:3000
    tmpfs:
      - /opt/app-root/src/log
      - /opt/app-root/src/tmp
    volumes:
      - .:/opt/app-root/src:z
    depends_on:
      - db
      - redis
      - rbac
      - compliance-ssg
      - import-ssg
    links:
      - db
      - redis
      - rbac
      - compliance-ssg
  inventory-consumer:
    image: compliance-backend-rails
    restart: on-failure
    entrypoint: ''
    command: 'bundle exec racecar -l log/inventory-consumer.log InventoryEventsConsumer'
    environment:
      - POSTGRESQL_TEST_DATABASE=compliance_test
      - DISABLE_DATABASE_ENVIRONMENT_CHECK=1
      - HOSTNAME=inventory-consumer
      - ACG_CONFIG=/opt/app-root/src/devel.json
    tmpfs:
      - /opt/app-root/src/log
      - /opt/app-root/src/tmp
    volumes:
      - .:/opt/app-root/src:z
    depends_on:
      - db
      - rbac
      - kafka
    links:
      - db
      - rbac
      - kafka
  sidekiq:
    image: compliance-backend-rails
    restart: on-failure
    tmpfs:
      - /opt/app-root/src/log
      - /opt/app-root/src/tmp
    volumes:
      - .:/opt/app-root/src:z
    depends_on:
      - redis
      - rbac
    links:
      - redis
      - rbac
    command: bundle exec sidekiq
    environment:
      - MALLOC_ARENA_MAX=2
      - POSTGRESQL_TEST_DATABASE=compliance_test
      - SIDEKIQ_CONCURRENCY=1
      - HOSTNAME=sidekiq
      - ACG_CONFIG=/opt/app-root/src/devel.json
  redis:
    image: quay.io/cloudservices/redis:latest
    ports:
      - 6379:6379