docker-compose.yml

#================================================================================================
# NETWORK SETUP
#================================================================================================
networks:
  atlantis_net:
    name: atlantis_net
    driver: bridge
    ipam:
      config:
        - subnet: 172.149.0.0/16

#================================================================================================
# VOLUME SETUP
#================================================================================================
volumes:
  vol_atlantis:
    driver: ${VOLUMES_DRIVER:-local}
  vol_atlantis_aws:
    driver: ${VOLUMES_DRIVER:-local}
  vol_atlantis_src:
    driver: ${VOLUMES_DRIVER:-local}
  vol_atlantis_config:
    driver: ${VOLUMES_DRIVER:-local}
  vol_atlantis_data:
    driver: ${VOLUMES_DRIVER:-local}
  vol_atlantis_repos:
    driver: ${VOLUMES_DRIVER:-local}
  vol_atlantis_db:
    driver: ${VOLUMES_DRIVER:-local}

#================================================================================================
# SERVICES
#================================================================================================
services:
  #================================================================================================
  # POSTGRESQL DATABASE FOR ATLANTIS
  #================================================================================================
  atlantis-db:
    image: ${ATLANTIS_DB_IMAGE:-postgres:16-alpine}
    container_name: ${CONTAINER_ATLANTIS_DB:-dci_atlantis_db}
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${ATLANTIS_DB_USER:-atlantis}
      - POSTGRES_PASSWORD=${ATLANTIS_DB_PASSWORD:-atlantis_secure_password}
      - POSTGRES_DB=${ATLANTIS_DB_NAME:-atlantis}
      - PGDATA=/var/lib/postgresql/data/pgdata
    volumes:
      - /etc/localtime:/etc/localtime:ro          ## Do not use it in mac
      - /var/run/docker.sock:/var/run/docker.sock ## Do not use it in k8s
      - vol_atlantis_db:/var/lib/postgresql/data
    networks:
      atlantis_net:
        ipv4_address: ${CONTAINER_IP_ATLANTIS_DB:-172.149.149.4}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${ATLANTIS_DB_USER:-atlantis} -d ${ATLANTIS_DB_NAME:-atlantis}"]
      interval: 30s
      timeout: 10s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: '1.00'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M

  #================================================================================================
  # PORTAINER
  #================================================================================================
  portainer:
    image: portainer/portainer-ce:${PORTAINER_VERSION:-2.30.1-alpine}
    container_name: ${CONTAINER_PORTAINER:-dci_portainer}
    restart: unless-stopped
    ports:
      - "${PORT_PORTAINER:-5212}:9000"
    volumes:
      - /etc/localtime:/etc/localtime:ro          ## Do not use it in mac
      - /var/run/docker.sock:/var/run/docker.sock ## Do not use it in k8s
      - /opt/data/docker/portainer2.20:/data
    environment:
      - PORTAINER_TEMPLATE=generic
      - PORTAINER_VERSION=${PORTAINER_VERSION:-2.30.1-alpine}
    privileged: true
    networks:
      atlantis_net:
        ipv4_address: ${CONTAINER_IP_PORTAINER:-172.149.149.5}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://${CONTAINER_IP_PORTAINER:-172.149.149.5}:5212/api/status"]
      interval: 60s
      timeout: 5s
      retries: 5

  #================================================================================================
  # ATLANTIS TERRAFORM
  #================================================================================================
  atlantis:
    # build:
    #   context: .
    #   dockerfile: Dockerfile
    #   args:
    #     PYTHON_VERSION: 3.12
    # image: ${ATLANTIS_IMAGE:-YOUR_AWS_ACCOUNT.dkr.ecr.ap-southeast-3.amazonaws.com/devopscorner/devopscorner-atlantis}:${ATLANTIS_VERSION:-latest}
    image: ${ATLANTIS_IMAGE:-devopscorner/devopscorner-atlantis:debian}
    container_name: ${CONTAINER_ATLANTIS:-dci_atlantis}
    restart: unless-stopped
    ports:
      - "${PORT_ATLANTIS:-4141}:4141"
    volumes:
      # System mounts
      - /var/run/docker.sock:/var/run/docker.sock
      # Project data
      - vol_atlantis_src:/atlantis/src:ro
      # AWS credentials
      - ${DATA_ATLANTIS_AWS:-/opt/data/docker/atlantis/aws}/credentials:/home/atlantis/.aws/credentials:ro
      - ${DATA_ATLANTIS_AWS:-/opt/data/docker/atlantis/aws}/config:/home/atlantis/.aws/config:ro
      # Atlantis configuration
      - ${DATA_ATLANTIS_CONFIG:-/opt/data/docker/atlantis/config}/repo.yaml:/atlantis/repo.yaml:ro
      # Project configuration
      - ${DATA_ATLANTIS_CONFIG:-/opt/data/docker/atlantis/config}:/atlantis/config:ro
      # Persistent data volumes
      - ${DATA_ATLANTIS:-/opt/data/docker/atlantis}/data:/atlantis/data
      - ${DATA_ATLANTIS:-/opt/data/docker/atlantis}/repos:/home/atlantis/.atlantis/repos
      # Atlantis Template
      - ${DATA_ATLANTIS:-/opt/data/docker/atlantis}/template:/home/atlantis/.atlantis/repos/template
    environment:
      # GitHub Configuration
      - ATLANTIS_GH_HOSTNAME=github.com
      - ATLANTIS_GH_USER=${ATLANTIS_GH_USER:-devopscorner}
      - ATLANTIS_GH_TOKEN=${ATLANTIS_GH_TOKEN}
      - ATLANTIS_GH_WEBHOOK_SECRET=${ATLANTIS_GH_WEBHOOK_SECRET}
      # Git Configuration
      - GITHUB_USERNAME=${ATLANTIS_GH_USER:-devopscorner}
      - GITHUB_TOKEN=${ATLANTIS_GH_TOKEN}
      - GIT_USER_NAME=${GIT_USER_NAME:-devopscorner}
      - GIT_USER_EMAIL=${ATLANTIS_GH_EMAIL:-support@devopscorner.id}
      - CONFIG_PATH=${ATLANTIS_CONFIG_PATH:-/atlantis/config}
      # Web Configuration
      - ATLANTIS_WEB_HOSTNAME=${ATLANTIS_WEB_HOSTNAME:-atlantis.devopscorner.id}
      - ATLANTIS_PORT=${PORT_ATLANTIS:-4141}
      - ATLANTIS_ATLANTIS_URL=https://${ATLANTIS_WEB_HOSTNAME:-atlantis.devopscorner.id}
      - ATLANTIS_WEB_BASIC_AUTH=${ATLANTIS_WEB_BASIC_AUTH:-true}
      - ATLANTIS_WEB_USERNAME=${NGINX_BASIC_AUTH_USER:-dci-admin}
      - ATLANTIS_WEB_PASSWORD=${NGINX_BASIC_AUTH_PASSWORD:-Y0ur_B4s1c_4uth}
      # Database Configuration
      - ATLANTIS_DB_TYPE=postgres
      - ATLANTIS_DB_HOST=${CONTAINER_IP_ATLANTIS_DB:-172.149.149.4}
      - ATLANTIS_DB_PORT=5432
      - ATLANTIS_DB_NAME=${ATLANTIS_DB_NAME:-atlantis}
      - ATLANTIS_DB_USER=${ATLANTIS_DB_USER:-atlantis}
      - ATLANTIS_DB_PASSWORD=${ATLANTIS_DB_PASSWORD:-atlantis_secure_password}
      - ATLANTIS_DB_SSL_MODE=disable
      # Data Directory
      - ATLANTIS_DATA_DIR=/atlantis/data
      # AWS Configuration
      - AWS_REGION=${AWS_REGION:-ap-southeast-3}
      - AWS_SHARED_CREDENTIALS_FILE=/home/atlantis/.aws/credentials
      - AWS_CONFIG_FILE=/home/atlantis/.aws/config
      # Project Configuration
      - ATLANTIS_CONFIG=/atlantis/atlantis.yaml
      - ATLANTIS_CONFIG_PATH=/atlantis/config
      - ATLANTIS_ALLOW_COMMANDS=version,plan,apply,unlock,approve_policies
      - ATLANTIS_REPO_ALLOWLIST=${ATLANTIS_REPO_ALLOWLIST:-github.com/devopscorner/devopscorner-atlantis/*}
      - ATLANTIS_REPO_CONFIG=/atlantis/repo.yaml
      - ATLANTIS_AUTOMERGE=true
      - ATLANTIS_AUTODISCOVER_MODE=auto
      - ATLANTIS_DELETE_SOURCE_BRANCH_ON_MERGE=true
      - ATLANTIS_PARALLEL_PLAN=true
      - ATLANTIS_PARALLEL_APPLY=true
      - ATLANTIS_ABORT_ON_EXECUTION_ORDER_FAIL=true
      - ATLANTIS_CHECKOUT_STRATEGY=merge
      - ATLANTIS_CHECKOUT_DEPTH=10  # Number of commit hash
      # Organization Structure
      - DCI_MANAGEMENT_ACCOUNT=${DCI_MANAGEMENT_ACCOUNT:-112233445566}
      - DCI_SECURITY_ACCOUNT=${DCI_SECURITY_ACCOUNT:-111122223333}
      - DCI_LOGS_ACCOUNT=${DCI_LOGS_ACCOUNT:-123456789012}
      - DCI_BILLING_ACCOUNT=${DCI_BILLING_ACCOUNT:-444455556666}
      - DCI_DEV01_ACCOUNT=${DCI_DEV01_ACCOUNT:-098765432101}
      - DCI_DEV02_ACCOUNT=${DCI_DEV02_ACCOUNT:-555566667777}
      - DCI_UAT01_ACCOUNT=${DCI_UAT01_ACCOUNT:-888899990000}
      - DCI_UAT02_ACCOUNT=${DCI_UAT02_ACCOUNT:-123123123123}
      - DCI_PROD01_ACCOUNT=${DCI_PROD01_ACCOUNT:-456456456456}
      - DCI_PROD02_ACCOUNT=${DCI_PROD02_ACCOUNT:-789789789789}
      # Other Configuration
      - DEFAULT_CONFTEST_VERSION=${CONFTEST_VERSION:-0.56.0}
      - TZ=Asia/Jakarta
      - PYTHONPATH=/usr/local/lib/python3.12/site-packages
    user: "100:100" # atlantis:atlantis
    privileged: true
    depends_on:
      atlantis-db:
        condition: service_healthy
    networks:
      atlantis_net:
        ipv4_address: ${CONTAINER_IP_ATLANTIS:-172.149.149.6}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://${CONTAINER_IP_ATLANTIS:-172.149.149.6}:4141/healthz"]
      interval: 60s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: '2.50'
          memory: 10G
        reservations:
          cpus: '0.30'
          memory: 256M
    labels:
      app: atlantis
      env: staging
      team: devops

  #================================================================================================
  # NGINX ATLANTIS
  #================================================================================================
  nginx:
    image: nginx:1.25.3-alpine
    container_name: ${CONTAINER_NGINX:-dci_nginx}
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ${DATA_NGINX:-/opt/data/docker/nginx}/conf.d:/etc/nginx/conf.d
      - ${DATA_NGINX:-/opt/data/docker/nginx}/ssl:/etc/nginx/ssl
      - ${DATA_NGINX:-/opt/data/docker/nginx}/logs:/var/log/nginx
      - ${DATA_NGINX:-/opt/data/docker/nginx}/auth:/etc/nginx/auth
    environment:
      - NGINX_HOST=${ATLANTIS_WEB_HOSTNAME:-atlantis.devopscorner.id}
      - NGINX_PORT=80
      # Basic Auth Configuration
      - NGINX_BASIC_AUTH_USER=${NGINX_BASIC_AUTH_USER:-dci-admin}
      - NGINX_BASIC_AUTH_PASSWORD=${NGINX_BASIC_AUTH_PASSWORD:-Y0ur_B4s1c_4uth}
    depends_on:
      - atlantis
    networks:
      atlantis_net:
        ipv4_address: ${CONTAINER_IP_NGINX:-172.149.149.7}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://${CONTAINER_IP_NGINX:-172.149.149.7}/healthz"]
      interval: 60s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: '1.50'
          memory: 2G
        reservations:
          cpus: '0.10'
          memory: 128M
    labels:
      app: nginx
      env: staging
      team: devops