docker-compose.yml

secrets:
  owner_cert_password:
    file: ./secrets/owner_cert_password.txt
  secretary_cert_password:
    file: ./secrets/secretary_cert_password.txt
  client_truststore_password:
    file: ./secrets/client_truststore_password.txt
  #google_client_id:
  #  file: ./secrets/google_client_id.txt
  #google_client_secret:
  #  file: ./secrets/google_client_secret.txt
services:
  nginx:
    image: nginx:1.23.3
    mem_limit: 128m
    command: /bin/sh -c "cp /etc/nginx/nginx.conf.template /etc/nginx/nginx.conf && sed -i 's|$${HTTPS_PORT}|'"$$HTTPS_PORT"'|g' /etc/nginx/nginx.conf && sed -i 's|$${UPSTREAM_SERVER}|'"$$UPSTREAM_SERVER"'|g' /etc/nginx/nginx.conf && sed -i 's|$${UPSTREAM_HTTP_PORT}|'"$$UPSTREAM_HTTP_PORT"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SERVER_NAME}|'"$$SERVER_NAME"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SERVER_HTTPS_PORT}|'"$$SERVER_HTTPS_PORT"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SERVER_HTTP_PORT}|'"$$SERVER_HTTP_PORT"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SERVER_CERT_FILE}|'"$$SERVER_CERT_FILE"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SERVER_KEY_FILE}|'"$$SERVER_KEY_FILE"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SSL_VERIFY_CLIENT}|'"$$SSL_VERIFY_CLIENT"'|g' /etc/nginx/nginx.conf && sed -i 's|$${MAX_BODY_SIZE}|'"$$MAX_BODY_SIZE"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SERVER_CLIENT_CERT_HTTPS_PORT}|'"$$SERVER_CLIENT_CERT_HTTPS_PORT"'|g' /etc/nginx/nginx.conf && nginx -g 'daemon off;'"
    depends_on:
      linkeddatahub:
        condition: service_healthy
    ports:
      - ${HTTP_PORT}:8080 # allow Tomcat to do HTTP to HTTPS redirect
      - ${HTTPS_PORT}:8443 # HTTPS
      - ${HTTPS_CLIENT_CERT_PORT:-5443}:9443 # HTTPS client cert
    environment:
      - HTTPS_PORT=${HTTPS_PORT}
      - UPSTREAM_SERVER=varnish-frontend
      - UPSTREAM_HTTP_PORT=6060
      - SERVER_NAME=${HOST}
      - SERVER_HTTPS_PORT=8443 # because of nginx-unprivileged
      - SERVER_HTTP_PORT=8080 # because of nginx-unprivileged
      - SERVER_CLIENT_CERT_HTTPS_PORT=9443 # 
      - SERVER_CERT_FILE=/etc/nginx/ssl/server.crt
      - SERVER_KEY_FILE=/etc/nginx/ssl/server.key
      - SSL_VERIFY_CLIENT=optional_no_ca
      - MAX_BODY_SIZE=2097152
    volumes:
      - ./platform/nginx-frontend.conf.template:/etc/nginx/nginx.conf.template:ro
      - ./ssl/server:/etc/nginx/ssl:ro
  linkeddatahub:
    user: root # otherwise the ldh user does not have permissions to the mounted folder which is owner by root
    build: .
    mem_limit: 2048m
    depends_on:
      - fuseki-admin
      - fuseki-end-user
    environment:
    #  - JPDA_ADDRESS=*:8000 # debugger host - performance hit when enabled
      - CATALINA_OPTS=-XX:+UseContainerSupport -XX:MaxRAMPercentage=75 --add-exports java.base/sun.security.tools.keytool=ALL-UNNAMED # heap will use up to 75% of container's RAM
      - TZ="Europe/Copenhagen"
      #- CATALINA_OPTS="-Duser.timezone=Europe/Copenhagen"
      - PROXY_HOST=nginx
      - PROXY_PORT=9443
      - PROTOCOL=${PROTOCOL}
      - HOST=${HOST}
      - ABS_PATH=${ABS_PATH}
      - HTTP_SCHEME=https
      - HTTP_PORT=7070
      - HTTP_PROXY_NAME=${HOST}
      - HTTP_PROXY_PORT=${HTTPS_PORT}
      - HTTP_REDIRECT_PORT=${HTTPS_PORT}
      - HTTPS_PROXY_PORT=${HTTPS_PORT}
      - HTTPS=false
      - SELF_SIGNED_CERT=true # only on localhost
      - SIGN_UP_CERT_VALIDITY=180
      - MAX_CONTENT_LENGTH=2097152
      - MAX_IMPORT_THREADS=1
      - NOTIFICATION_ADDRESS=LinkedDataHub <notifications@localhost>
      - MAIL_SMTP_HOST=email-server
      - MAIL_SMTP_PORT=25
      - MAIL_USER=linkeddatahub@localhost
      - OWNER_MBOX=${OWNER_MBOX}
      #- OWNER_URI=${OWNER_URI}
      - OWNER_GIVEN_NAME=${OWNER_GIVEN_NAME}
      - OWNER_FAMILY_NAME=${OWNER_FAMILY_NAME}
      - OWNER_ORG_UNIT=${OWNER_ORG_UNIT}
      - OWNER_ORGANIZATION=${OWNER_ORGANIZATION}
      - OWNER_LOCALITY=${OWNER_LOCALITY}
      - OWNER_STATE_OR_PROVINCE=${OWNER_STATE_OR_PROVINCE}
      - OWNER_COUNTRY_NAME=${OWNER_COUNTRY_NAME}
    secrets:
      - owner_cert_password
      - secretary_cert_password
      - client_truststore_password
      #- google_client_id
      #- google_client_secret
    volumes:
      - /var/linkeddatahub/oidc
      - ./ssl/server:/var/linkeddatahub/ssl/server:ro
      - ./ssl/owner:/var/linkeddatahub/ssl/owner
      - ./ssl/secretary:/var/linkeddatahub/ssl/secretary
      - ./datasets/owner:/var/linkeddatahub/datasets/owner
      - ./datasets/secretary:/var/linkeddatahub/datasets/secretary
      - ./uploads:/var/www/linkeddatahub/uploads
      - ./config/dev.log4j.properties:/usr/local/tomcat/webapps/ROOT/WEB-INF/classes/log4j.properties:ro
      - ./config/system-varnish.trig:/var/linkeddatahub/datasets/system.trig:ro
      - ./platform/datasets/admin.trig:/var/linkeddatahub/datasets/admin.trig:ro
      - ./platform/datasets/end-user.trig:/var/linkeddatahub/datasets/end-user.trig:ro
  fuseki-admin:
    image: atomgraph/fuseki:4.7.0
    user: root # otherwise fuseki user does not have permissions to the mounted folder which is owner by root
    expose:
      - 3030
    volumes:
      - ./config/fuseki/config.ttl:/fuseki/config.ttl:ro
      - ./data/admin:/fuseki/databases
    command: [ "--config", "/fuseki/config.ttl" ]
  fuseki-end-user:
    image: atomgraph/fuseki:4.7.0
    user: root # otherwise the fuseki user does not have permissions to the mounted folder which is owner by root
    expose:
      - 3030
    volumes:
      - ./config/fuseki/config.ttl:/fuseki/config.ttl:ro
      - ./data/end-user:/fuseki/databases
    command: [ "--config", "/fuseki/config.ttl" ]
  varnish-frontend:
    image: varnish:7.3.0
    user: root # otherwise varnish user does not have permissions to the mounted folder which is owner by root
    depends_on:
      - linkeddatahub
    tmpfs: /var/lib/varnish/varnishd:exec
    environment:
      - VARNISH_HTTP_PORT=6060
      - BACKEND_HOST=linkeddatahub
      - BACKEND_PORT=7070
      - CLIENT_HOST=localhost
      - VARNISH_SIZE=1G
    entrypoint: /bin/sh -c "cp /etc/varnish/default.vcl.template /etc/varnish/default.vcl && sed -i 's|$${BACKEND_HOST}|'"$$BACKEND_HOST"'|g' /etc/varnish/default.vcl && sed -i 's|$${BACKEND_PORT}|'"$$BACKEND_PORT"'|g' /etc/varnish/default.vcl && sed -i 's|$${CLIENT_HOST}|'"$$CLIENT_HOST"'|g' /etc/varnish/default.vcl && /usr/local/bin/docker-varnish-entrypoint \"$$0\" \"$$@\""
    command: [ "-t", "86400" ] # time to live
    volumes:
      - ./platform/varnish-frontend.vcl.template:/etc/varnish/default.vcl.template:ro
  varnish-admin:
    image: varnish:7.3.0
    user: root # otherwise the varnish user does not have permissions to the mounted folder which is owner by root
    depends_on:
      - linkeddatahub
      - nginx-admin
    tmpfs: /var/lib/varnish/varnishd:exec
    environment:
      - BACKEND_HOST=nginx-admin
      - BACKEND_PORT=8080
      - CLIENT_HOST=linkeddatahub
      - VARNISH_SIZE=1G
    entrypoint: /bin/sh -c "cp /etc/varnish/default.vcl.template /etc/varnish/default.vcl && sed -i 's|$${BACKEND_HOST}|'"$$BACKEND_HOST"'|g' /etc/varnish/default.vcl && sed -i 's|$${BACKEND_PORT}|'"$$BACKEND_PORT"'|g' /etc/varnish/default.vcl && sed -i 's|$${CLIENT_HOST}|'"$$CLIENT_HOST"'|g' /etc/varnish/default.vcl && /usr/local/bin/docker-varnish-entrypoint \"$$0\" \"$$@\""
    command: [ "-t", "86400", "-p", "timeout_idle=60s" ] # time to live
    volumes:
      - ./platform/varnish-backend.vcl.template:/etc/varnish/default.vcl.template:ro
  varnish-end-user:
    image: varnish:7.3.0
    user: root # otherwise varnish user does not have permissions to the mounted folder which is owner by root
    depends_on:
      - linkeddatahub
      - nginx-end-user
    tmpfs: /var/lib/varnish/varnishd:exec
    environment:
      - BACKEND_HOST=nginx-end-user
      - BACKEND_PORT=8080
      - CLIENT_HOST=linkeddatahub
      - VARNISH_SIZE=1G
    entrypoint: /bin/sh -c "cp /etc/varnish/default.vcl.template /etc/varnish/default.vcl && sed -i 's|$${BACKEND_HOST}|'"$$BACKEND_HOST"'|g' /etc/varnish/default.vcl && sed -i 's|$${BACKEND_PORT}|'"$$BACKEND_PORT"'|g' /etc/varnish/default.vcl && sed -i 's|$${CLIENT_HOST}|'"$$CLIENT_HOST"'|g' /etc/varnish/default.vcl && /usr/local/bin/docker-varnish-entrypoint \"$$0\" \"$$@\""
    command: [ "-t", "86400", "-p", "timeout_idle=60s" ] # time to live
    volumes:
      - ./platform/varnish-backend.vcl.template:/etc/varnish/default.vcl.template:ro
  nginx-admin:
    image: nginx:1.23.3
    depends_on:
      - fuseki-admin
    command: /bin/sh -c "cp /etc/nginx/nginx.conf.template /etc/nginx/nginx.conf && sed -i 's|$${UPSTREAM_SERVER}|'"$$UPSTREAM_SERVER"'|g' /etc/nginx/nginx.conf && sed -i 's|$${UPSTREAM_HTTP_PORT}|'"$$UPSTREAM_HTTP_PORT"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SERVER_HTTP_PORT}|'"$$SERVER_HTTP_PORT"'|g' /etc/nginx/nginx.conf && nginx -g 'daemon off;'"
    environment:
      - UPSTREAM_SERVER=fuseki-admin
      - UPSTREAM_HTTP_PORT=3030
      - SERVER_HTTP_PORT=8080 # because of nginx-unprivileged
    volumes:
      - ./platform/nginx-backend.conf.template:/etc/nginx/nginx.conf.template:ro
  nginx-end-user:
    image: nginx:1.23.3
    depends_on:
      - fuseki-end-user
    command: /bin/sh -c "cp /etc/nginx/nginx.conf.template /etc/nginx/nginx.conf && sed -i 's|$${UPSTREAM_SERVER}|'"$$UPSTREAM_SERVER"'|g' /etc/nginx/nginx.conf && sed -i 's|$${UPSTREAM_HTTP_PORT}|'"$$UPSTREAM_HTTP_PORT"'|g' /etc/nginx/nginx.conf && sed -i 's|$${SERVER_HTTP_PORT}|'"$$SERVER_HTTP_PORT"'|g' /etc/nginx/nginx.conf && nginx -g 'daemon off;'"
    environment:
      - UPSTREAM_SERVER=fuseki-end-user
      - UPSTREAM_HTTP_PORT=3030
      - SERVER_HTTP_PORT=8080 # because of nginx-unprivileged
    volumes:
      - ./platform/nginx-backend.conf.template:/etc/nginx/nginx.conf.template:ro
  email-server:
    image: namshi/smtp
    environment:
      - DISABLE_IPV6=true