compose.yml

name: cli-node-docker-atlas-lab

# Core infrastructure entrypoint for the local Atlas Lab stack.
x-lab-env: &lab-env
  TZ: ${TZ}

x-plane-db-env: &plane-db-env
  POSTGRES_USER: ${PLANE_POSTGRES_USER}
  POSTGRES_DB: ${PLANE_POSTGRES_DATABASE}
  POSTGRES_PASSWORD: ${PLANE_POSTGRES_PASSWORD}
  PGDATA: /var/lib/postgresql/data

x-plane-redis-env: &plane-redis-env
  REDIS_HOST: plane-redis
  REDIS_PORT: "6379"
  REDIS_URL: redis://plane-redis:6379/

x-plane-mq-env: &plane-mq-env
  RABBITMQ_HOST: plane-mq
  RABBITMQ_PORT: "5672"
  RABBITMQ_DEFAULT_USER: ${PLANE_RABBITMQ_USER}
  RABBITMQ_DEFAULT_PASS: ${PLANE_RABBITMQ_PASSWORD}
  RABBITMQ_DEFAULT_VHOST: ${PLANE_RABBITMQ_VHOST}
  RABBITMQ_VHOST: ${PLANE_RABBITMQ_VHOST}

x-plane-s3-env: &plane-s3-env
  AWS_REGION: ""
  AWS_ACCESS_KEY_ID: ${PLANE_AWS_ACCESS_KEY_ID}
  AWS_SECRET_ACCESS_KEY: ${PLANE_AWS_SECRET_ACCESS_KEY}
  AWS_S3_ENDPOINT_URL: http://plane-minio:9000
  AWS_S3_BUCKET_NAME: ${PLANE_AWS_S3_BUCKET_NAME}

x-plane-app-env: &plane-app-env
  WEB_URL: https://${LAB_PUBLIC_HOST}:${PLANE_HTTPS_PORT}
  DEBUG: "0"
  CORS_ALLOWED_ORIGINS: https://${LAB_PUBLIC_HOST}:${PLANE_HTTPS_PORT}
  GUNICORN_WORKERS: "1"
  USE_MINIO: "1"
  DATABASE_URL: postgresql://${PLANE_POSTGRES_USER}:${PLANE_POSTGRES_PASSWORD}@plane-db/${PLANE_POSTGRES_DATABASE}
  SECRET_KEY: ${PLANE_SECRET_KEY}
  AMQP_URL: amqp://${PLANE_RABBITMQ_USER}:${PLANE_RABBITMQ_PASSWORD}@plane-mq:5672/${PLANE_RABBITMQ_VHOST}
  API_KEY_RATE_LIMIT: 60/minute
  MINIO_ENDPOINT_SSL: "0"
  LIVE_SERVER_SECRET_KEY: ${PLANE_LIVE_SERVER_SECRET_KEY}

services:
  gateway:
    build:
      context: ../..
      dockerfile: infra/docker/images/gateway/Dockerfile
      args:
        CADDY_VERSION: ${CADDY_VERSION}
    restart: unless-stopped
    env_file:
      - ../../env/lab.env
    environment:
      ATLAS_AI_LLM_ENABLED: "false"
      ATLAS_WORKBENCH_ENABLED: "false"
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 $$LAB_HTTPS_PORT || exit 1"]
      interval: 2s
      timeout: 5s
      retries: 30
      start_period: 2s
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "${LAB_HTTPS_PORT}:${LAB_HTTPS_PORT}"
      - "${GITEA_HTTPS_PORT}:${GITEA_HTTPS_PORT}"
      - "${PLANE_HTTPS_PORT}:${PLANE_HTTPS_PORT}"
      - "${PENPOT_HTTPS_PORT}:${PENPOT_HTTPS_PORT}"
      - "${NEXTCLOUD_AIO_HTTPS_PORT}:${NEXTCLOUD_AIO_HTTPS_PORT}"
      - "${NEXTCLOUD_AIO_SETUP_HTTPS_PORT}:${NEXTCLOUD_AIO_SETUP_HTTPS_PORT}"
    volumes:
      - gateway-certs:/etc/caddy/certs
      - gateway-config:/etc/caddy/dynamic
      - gateway-site:/srv
      - gateway-data:/data
    depends_on:
      gitea:
        condition: service_healthy
      plane-proxy:
        condition: service_started
      penpot-frontend:
        condition: service_started
      nextcloud-aio-mastercontainer:
        condition: service_started
    networks:
      - edge-net
      - apps-net
      - plane-net
      - penpot-net

  gitea:
    image: gitea/gitea:${GITEA_VERSION}
    restart: unless-stopped
    depends_on:
      gitea-db:
        condition: service_healthy
    environment:
      <<: *lab-env
      USER_UID: ${GITEA_UID}
      USER_GID: ${GITEA_GID}
      GITEA__server__DOMAIN: ${LAB_PUBLIC_HOST}
      GITEA__server__ROOT_URL: ${GITEA_URL}
      GITEA__server__HTTP_PORT: "3000"
      GITEA__server__PROTOCOL: http
      GITEA__server__DISABLE_SSH: "true"
      GITEA__service__DISABLE_REGISTRATION: "true"
      GITEA__service__REQUIRE_SIGNIN_VIEW: "true"
      GITEA__security__INSTALL_LOCK: "true"
      GITEA__security__COOKIE_SECURE: "true"
      GITEA__database__DB_TYPE: mysql
      GITEA__database__HOST: gitea-db:3306
      GITEA__database__NAME: gitea
      GITEA__database__USER: gitea
      GITEA__database__PASSWD: ${GITEA_DB_PASSWORD}
      GITEA__database__SSL_MODE: disable
      GITEA__database__CHARSET: utf8mb4
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 3000 || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 6
      start_period: 20s
    volumes:
      - gitea-data:/data
    networks:
      apps-net:
      data-net:
      services-egress-net:
        gw_priority: 1

  gitea-db:
    image: mariadb:${GITEA_DB_VERSION}
    restart: unless-stopped
    command: ["--innodb_linux_aio=aio"]
    healthcheck:
      test: ["CMD-SHELL", "mariadb-admin ping -u root -p$$MARIADB_ROOT_PASSWORD"]
      interval: 5s
      timeout: 10s
      retries: 10
    environment:
      MARIADB_DATABASE: gitea
      MARIADB_USER: gitea
      MARIADB_PASSWORD: ${GITEA_DB_PASSWORD}
      MARIADB_ROOT_PASSWORD: ${GITEA_DB_ROOT_PASSWORD}
    volumes:
      - gitea-db:/var/lib/mysql
    networks:
      - data-net

  plane-web:
    image: makeplane/plane-frontend:${PLANE_APP_RELEASE}
    restart: unless-stopped
    depends_on:
      - plane-api
      - plane-worker
    networks:
      plane-net:
        aliases:
          - web
      services-egress-net:
        gw_priority: 1

  plane-admin:
    image: makeplane/plane-admin:${PLANE_APP_RELEASE}
    restart: unless-stopped
    depends_on:
      - plane-api
      - plane-web
    networks:
      plane-net:
        aliases:
          - admin
      services-egress-net:
        gw_priority: 1

  plane-space:
    image: makeplane/plane-space:${PLANE_APP_RELEASE}
    restart: unless-stopped
    depends_on:
      - plane-api
      - plane-worker
      - plane-web
    networks:
      plane-net:
        aliases:
          - space
      services-egress-net:
        gw_priority: 1

  plane-live:
    image: makeplane/plane-live:${PLANE_APP_RELEASE}
    restart: unless-stopped
    environment:
      API_BASE_URL: http://plane-api:8000
      LIVE_SERVER_SECRET_KEY: ${PLANE_LIVE_SERVER_SECRET_KEY}
      REDIS_HOST: plane-redis
      REDIS_PORT: "6379"
      REDIS_URL: redis://plane-redis:6379/
    depends_on:
      - plane-api
      - plane-web
    networks:
      plane-net:
        aliases:
          - live
      services-egress-net:
        gw_priority: 1

  plane-api:
    image: makeplane/plane-backend:${PLANE_APP_RELEASE}
    restart: unless-stopped
    command: ./bin/docker-entrypoint-api.sh
    environment:
      <<: [*plane-app-env, *plane-db-env, *plane-redis-env, *plane-mq-env, *plane-s3-env]
    depends_on:
      plane-db:
        condition: service_healthy
      plane-redis:
        condition: service_started
      plane-mq:
        condition: service_started
      plane-minio:
        condition: service_started
      plane-migrator:
        condition: service_completed_successfully
    volumes:
      - plane-api-logs:/code/plane/logs
    networks:
      plane-net:
        aliases:
          - api
      services-egress-net:
        gw_priority: 1

  plane-worker:
    image: makeplane/plane-backend:${PLANE_APP_RELEASE}
    restart: unless-stopped
    command: ./bin/docker-entrypoint-worker.sh
    environment:
      <<: [*plane-app-env, *plane-db-env, *plane-redis-env, *plane-mq-env, *plane-s3-env]
    depends_on:
      plane-api:
        condition: service_started
      plane-db:
        condition: service_healthy
      plane-redis:
        condition: service_started
      plane-mq:
        condition: service_started
      plane-minio:
        condition: service_started
      plane-migrator:
        condition: service_completed_successfully
    volumes:
      - plane-worker-logs:/code/plane/logs
    networks:
      plane-net:
      services-egress-net:
        gw_priority: 1

  plane-beat-worker:
    image: makeplane/plane-backend:${PLANE_APP_RELEASE}
    restart: unless-stopped
    command: ./bin/docker-entrypoint-beat.sh
    environment:
      <<: [*plane-app-env, *plane-db-env, *plane-redis-env, *plane-mq-env, *plane-s3-env]
    depends_on:
      plane-api:
        condition: service_started
      plane-db:
        condition: service_healthy
      plane-redis:
        condition: service_started
      plane-mq:
        condition: service_started
      plane-minio:
        condition: service_started
      plane-migrator:
        condition: service_completed_successfully
    volumes:
      - plane-beat-logs:/code/plane/logs
    networks:
      plane-net:
      services-egress-net:
        gw_priority: 1

  plane-migrator:
    image: makeplane/plane-backend:${PLANE_APP_RELEASE}
    restart: on-failure
    command: ./bin/docker-entrypoint-migrator.sh
    environment:
      <<: [*plane-app-env, *plane-db-env, *plane-redis-env, *plane-mq-env, *plane-s3-env]
    depends_on:
      plane-db:
        condition: service_healthy
      plane-redis:
        condition: service_started
    volumes:
      - plane-migrator-logs:/code/plane/logs
    networks:
      - plane-net

  plane-db:
    image: postgres:15.7-alpine
    restart: unless-stopped
    command: postgres -c 'max_connections=1000'
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
      interval: 5s
      timeout: 10s
      retries: 10
    environment:
      <<: *plane-db-env
    volumes:
      - plane-db:/var/lib/postgresql/data
    networks:
      - plane-net

  plane-redis:
    image: valkey/valkey:7.2.11-alpine
    restart: unless-stopped
    volumes:
      - plane-redis:/data
    networks:
      - plane-net

  plane-mq:
    image: rabbitmq:3.13.6-management-alpine
    restart: unless-stopped
    environment:
      <<: *plane-mq-env
    volumes:
      - plane-mq:/var/lib/rabbitmq
    networks:
      - plane-net

  plane-minio:
    image: minio/minio:latest
    restart: unless-stopped
    command: server /export --console-address ":9090"
    environment:
      MINIO_ROOT_USER: ${PLANE_AWS_ACCESS_KEY_ID}
      MINIO_ROOT_PASSWORD: ${PLANE_AWS_SECRET_ACCESS_KEY}
    volumes:
      - plane-minio:/export
    networks:
      plane-net:
      services-egress-net:
        gw_priority: 1

  plane-proxy:
    image: makeplane/plane-proxy:${PLANE_APP_RELEASE}
    restart: unless-stopped
    environment:
      APP_DOMAIN: ${LAB_PUBLIC_HOST}:${PLANE_HTTPS_PORT}
      FILE_SIZE_LIMIT: ${PLANE_FILE_SIZE_LIMIT}
      BUCKET_NAME: ${PLANE_AWS_S3_BUCKET_NAME}
      LISTEN_HTTP_PORT: "80"
      LISTEN_HTTPS_PORT: "443"
      SITE_ADDRESS: ":80"
      CERT_EMAIL: ""
      CERT_ACME_CA: https://acme-v02.api.letsencrypt.org/directory
      CERT_ACME_DNS: ""
    depends_on:
      - plane-web
      - plane-api
      - plane-space
      - plane-admin
      - plane-live
    networks:
      - plane-net

  penpot-frontend:
    image: penpotapp/frontend:${PENPOT_VERSION}
    restart: unless-stopped
    environment:
      PENPOT_FLAGS: disable-email-verification enable-prepl-server login-with-password registration
      PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 367001600
      PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE: 367001600
    depends_on:
      - penpot-backend
      - penpot-exporter
    volumes:
      - penpot-assets:/opt/data/assets
    networks:
      penpot-net:
      services-egress-net:
        gw_priority: 1

  penpot-backend:
    image: penpotapp/backend:${PENPOT_VERSION}
    restart: unless-stopped
    environment:
      PENPOT_FLAGS: disable-email-verification enable-prepl-server login-with-password registration
      PENPOT_PUBLIC_URI: https://${LAB_PUBLIC_HOST}:${PENPOT_HTTPS_PORT}
      PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 367001600
      PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE: 367001600
      PENPOT_SECRET_KEY: ${PENPOT_SECRET_KEY}
      PENPOT_DATABASE_URI: postgresql://penpot-postgres/penpot
      PENPOT_DATABASE_USERNAME: penpot
      PENPOT_DATABASE_PASSWORD: ${PENPOT_POSTGRES_PASSWORD}
      PENPOT_REDIS_URI: redis://penpot-valkey/0
      PENPOT_OBJECTS_STORAGE_BACKEND: fs
      PENPOT_OBJECTS_STORAGE_FS_DIRECTORY: /opt/data/assets
      PENPOT_TELEMETRY_ENABLED: "true"
      PENPOT_TELEMETRY_REFERER: atlas-lab
      PENPOT_SMTP_DEFAULT_FROM: no-reply@penpot.local
      PENPOT_SMTP_DEFAULT_REPLY_TO: no-reply@penpot.local
      PENPOT_SMTP_HOST: penpot-mailcatch
      PENPOT_SMTP_PORT: "1025"
      PENPOT_SMTP_TLS: "false"
      PENPOT_SMTP_SSL: "false"
    depends_on:
      penpot-postgres:
        condition: service_healthy
      penpot-valkey:
        condition: service_healthy
    volumes:
      - penpot-assets:/opt/data/assets
    networks:
      penpot-net:
      services-egress-net:
        gw_priority: 1

  penpot-exporter:
    image: penpotapp/exporter:${PENPOT_VERSION}
    restart: unless-stopped
    environment:
      PENPOT_SECRET_KEY: ${PENPOT_SECRET_KEY}
      PENPOT_PUBLIC_URI: http://penpot-frontend:8080
      PENPOT_REDIS_URI: redis://penpot-valkey/0
    depends_on:
      penpot-valkey:
        condition: service_healthy
    networks:
      penpot-net:
      services-egress-net:
        gw_priority: 1

  penpot-postgres:
    image: postgres:15
    restart: unless-stopped
    stop_signal: SIGINT
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U penpot"]
      interval: 5s
      timeout: 10s
      retries: 10
      start_period: 20s
    environment:
      POSTGRES_INITDB_ARGS: --data-checksums
      POSTGRES_DB: penpot
      POSTGRES_USER: penpot
      POSTGRES_PASSWORD: ${PENPOT_POSTGRES_PASSWORD}
    volumes:
      - penpot-postgres:/var/lib/postgresql/data
    networks:
      - penpot-net

  penpot-valkey:
    image: valkey/valkey:8.1
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
      interval: 1s
      timeout: 3s
      retries: 5
      start_period: 3s
    environment:
      VALKEY_EXTRA_FLAGS: --maxmemory 128mb --maxmemory-policy volatile-lfu
    networks:
      - penpot-net

  penpot-mailcatch:
    image: sj26/mailcatcher:latest
    restart: unless-stopped
    expose:
      - "1025"
    networks:
      - penpot-net

  nextcloud-aio-mastercontainer:
    image: ghcr.io/nextcloud-releases/all-in-one:${NEXTCLOUD_AIO_VERSION}
    container_name: nextcloud-aio-mastercontainer
    init: true
    restart: always
    network_mode: bridge
    ports:
      - "${NEXTCLOUD_AIO_MASTER_PORT}:8080"
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      APACHE_PORT: ${NEXTCLOUD_AIO_APACHE_PORT}
      APACHE_IP_BINDING: 0.0.0.0
      APACHE_ADDITIONAL_NETWORK: ""
      SKIP_DOMAIN_VALIDATION: "true"

networks:
  edge-net:
    name: cli-node-docker-atlas-lab_edge
  services-egress-net:
    name: cli-node-docker-atlas-lab_services_egress
  apps-net:
    name: cli-node-docker-atlas-lab_apps
    internal: true
  plane-net:
    name: cli-node-docker-atlas-lab_plane
    internal: true
  penpot-net:
    name: cli-node-docker-atlas-lab_penpot
    internal: true
  data-net:
    name: cli-node-docker-atlas-lab_data
    internal: true

volumes:
  gateway-certs:
  gateway-config:
  gateway-site:
  gateway-data:
  gitea-data:
  gitea-db:
  plane-db:
  plane-redis:
  plane-mq:
  plane-minio:
  plane-api-logs:
  plane-worker-logs:
  plane-beat-logs:
  plane-migrator-logs:
  penpot-assets:
  penpot-postgres:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer