-
Notifications
You must be signed in to change notification settings - Fork 14
/
Copy pathdocker-compose.yml
1375 lines (1312 loc) · 43.9 KB
/
docker-compose.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
version: "3.9"
# This docker compose uses profiles - see https://docs.docker.com/compose/profiles/
#
# DOCKER IMAGES
#
# 13-3.1 is the first pg version with FORCE_SSL support
# needed to force clients to use SSL
x-postgres-image: &postgres-image kartoza/postgis:13-3.1
x-osm-update-image: &osm-update-image kartoza/docker-osm:osmupdate-latest
x-imposm-image: &imposm-image kartoza/docker-osm:imposm-latest
x-osmenrich-image: &osm-enrich-image kartoza/docker-osm:osmenrich-latest
# Special build of the kartoza geoserver image which includes the
# plugins etc. GeoNode needs to communicate with GeoServer
x-geoserver-image: &geoserver-image kartoza/geoserver:2.18.2
x-mergin-db-sync-image: &mergin-db-sync-image lutraconsulting/mergin-db-sync
x-mergin-server-image: &mergin-server-image kartoza/mergin:0.0.1
# alpine spin needed for bcrypt support
x-nginx-image: &nginx-image nginx:alpine
x-certbot-image: &certbot-image certbot/certbot
x-qgis-server-image: &qgis-server-image openquake/qgis-server:stable
x-qgis-desktop-image: &qgis-desktop-image tswetnam/xpra-qgis:bionic
x-mapproxy-image: &mapproxy-image kartoza/mapproxy
x-postgrest-image: &postgrest-image postgrest/postgrest
x-swagger-image: &swagger-image swaggerapi/swagger-ui
x-odm-image: &odm-image opendronemap/odm
x-gdal-image: &gdal-image geodata/gdal
x-mergin-client-image: &mergin-client-image kartoza/mergin-client:latest
x-lizmap-image: &lizmap-image 3liz/lizmap-web-client:3.4
# Auto builds on the main branch are tagged with :main
x-hugo-image: &hugo-image kartoza/hugo-watcher:main
#x-hugo-image: &hugo-image kartoza/hugo-watcher:main
x-node-red-image: &node-red-image nodered/node-red:latest
x-mosquitto-image: &mosquitto-image eclipse-mosquitto:openssl
x-file-browser-image: &file-browser-image filebrowser/filebrowser
x-metabase-image: &metabase-image metabase/metabase:latest
x-watchtower-image: &watchtower-image containrrr/watchtower
#
# VOLUMES
#
# Generally we are using docker volumes for all volumes
# except conf files which are host mounted volumes out
# of our git repo.
#
volumes:
import_done:
import_queue:
postgis_data:
geoserver_data:
mapproxy_cache_data:
mergin_sync_data:
osm_import_done:
osm_import_queue:
osm_cache:
odm_cutline:
odm_datasets:
mergin-projects:
# used by lizmap and mergin web server and perhaps others
redis_data:
cache:
# Mounted in to geoserver for a file store
geoserver_user_data:
# Mounted in to QGIS Server for serving QGIS projects
qgis_projects:
# Mounted in to QGIS Server for serving QGIS fonts
qgis_fonts:
# Mounted in to QGIS Server for serving QGIS svgs
qgis_svg:
# Mounted in to Hugo for content (markdown)
# If empty will be initially populated by hugo-watcher
# adding the hugo-clarity sample site by default
hugo_site:
# Mounted in to Hugo for themes
# If empty will be initially populated by hugo-watcher
# adding the hugo-clarity theme by default
hugo_themes:
# The public site generated by hugo
generated_hugo_site:
# Mounted in to ODM for processing uploaded images
odm_data:
# Mounted in SCP only for data sharing
general_data:
# Mounted in Jupyter for data sharing
jupyter_data:
# Lizmap related volumes
lizmap-theme-config:
lizmap-config:
lizmap-db:
lizmap-www:
lizmap-log:
# For node red
node-red-data:
mosquitto-data:
jupyter-data:
#
# SERVICES
#
services:
############################################################
#
# First we define all default services that are run if
# you do not specify a profile. These are currently
# nginx, hugo watcher, filebrowser, postgres and others
#
############################################################
# Keep all our containers up to date
# see
watchtower:
image: *watchtower-image
volumes:
- /var/run/docker.sock:/var/run/docker.sock
restart: unless-stopped
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
# Nginx with ssl
nginx:
image: *nginx-image
volumes:
- ./conf/nginx_conf/nginx.conf:/etc/nginx/nginx.conf
# You must manually create this file before running
# by running either
# make configure-ssl-self-signed
# or
# make configure-letsencrypt-ssl
- ./conf/nginx_conf/servername.conf:/etc/nginx/servername.conf
- ./conf/nginx_conf/upstreams:/etc/nginx/upstreams
- ./conf/nginx_conf/ssl:/etc/nginx/ssl
- ./conf/nginx_conf/locations:/etc/nginx/locations
- ./conf/nginx_conf/htpasswd:/etc/nginx/.htpasswd
# If you are running with a self signed certificate
# then make sure the following folder contains these files
# nginx-selfsigned.crt
# nginx-selfsigned.key
# You can generate them (or a proper letsencrypt cert)
# by running either
# make configure-ssl-self-signed
# or
# make configure-letsencrypt-ssl
- ./certbot/certbot/conf:/etc/letsencrypt
- ./certbot/certbot/www:/var/www/certbot
# Mount the mergin db sync data into nginx so we can access
# images etc.
# Ideally we should only be mounting the image subfolders to
# avoid leaking our geopackage etc.
# To do that the mergin project needs to be set up accordingly
# - TODO for the future
- mergin_sync_data:/mergin-data
# mount the hugo site folder so that we can serve the static site
- generated_hugo_site:/hugo
# General sharing of files to the web
- general_data:/files
# mount the docs folder as /docs and make it available
# at /docs in the web site
# Run make docs to generate latest help
# You also need to do make enable-docs for the docs to show on your site
- ./docs:/docs
# This makes nginx reload its configuration (and certificates)
# every six hours in the background and launches nginx in the
# foreground.
# See
# https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71
command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
# For debugging config issues
#command: "sleep 3000"
ports:
- "80:80"
- "443:443"
networks:
- os-gis-stack
restart: unless-stopped
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
# file uploader
file-browser:
image: *file-browser-image
profiles: ["all","file-browser"]
volumes:
- ./conf/file_browser/filebrowser.json:/.filebrowser.json
- ./conf/file_browser:/conf
# General sharing of files to the web
- general_data:/files/public
- qgis_projects:/files/qgis_projects
- qgis_fonts:/files/qgis_fonts
- qgis_svg:/files/qgis_svg
# Mounted in SCP, file-browser and to Hugo for content (markdown)
# If empty will be initially populated by hugo-watcher
# adding the hugo-clarity sample site by default
- hugo_site:/files/hugo_site
# Mounted in SCP, file-browser and to Hugo for themes
# If empty will be initially populated by hugo-watcher
# adding the hugo-clarity theme by default
- hugo_themes:/files/hugo_themes
- jupyter_data:/files/jupyter_data
- geoserver_user_data:/files/geoserver_user_data
# Mapproxy configs
- mapproxy_cache_data/:/files/mapproxy_cache
- ./conf/mapproxy_conf/:/files/mapproxy_config
# Node red data
- node-red-data:/files/node_red_data
# PG Service file - take care of permissions to not expose passwords to
# all file browser users!
- ./conf/pg_conf/:/files/pg_conf
# QGIS qgis-auth.db file and qgis-auth-pwd.txt file
- ./conf/qgis_conf/auth-db/:/files/qgis_conf/auth-db
user: 1000:1000
networks:
- os-gis-stack
restart: unless-stopped
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
depends_on:
- nginx
certbot:
image: *certbot-image
profiles: ["all","certbot-init"]
# This checks every 12 hours if our cert is up for renewal and
# refreshes it if needed
# See https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
depends_on:
- nginx
volumes:
- ./certbot/certbot/conf:/etc/letsencrypt
- ./certbot/certbot/www:/var/www/certbot
# This is only intended to be used during the initial setup of
# certbot, thereafter use the nginx service
# See the makefile for how this is orchestrated
nginx-certbot-init:
image: *nginx-image
profiles:
- certbot-init
ports:
- "80:80"
- "443:443"
volumes:
- ./conf/nginx_certbot_init_conf/nginx.conf:/etc/nginx/nginx.conf
- ./certbot/certbot/conf:/etc/letsencrypt
- ./certbot/certbot/www:/var/www/certbot
hugo-watcher:
# This service watches for changes in the static content
# source files of the hugo site and rebuilds the site
# whenever a source file is changed.
image: *hugo-image
# No profiles specified, automatically started by nginx
environment:
- DOMAIN=https://${DOMAIN}
# See notes in the site_template volume section below and
# https://github.com/kartoza/hugo-watcher#environment-variables
- SITE_TEMPLATE_PATH=/site_template
# If you comment out theme it will default to hugo-clarity
#- THEME=elephants
volumes:
# This is non user editable, generated static html
# will be placed here.
- generated_hugo_site:/public
# Mounted in SCP, file-browser and to Hugo for themes
# If empty will be initially populated by hugo-watcher
# adding the hugo-clarity theme by default
# Place hugo themes here
- hugo_themes:/themes
# Site template path. When you start with an empty /src directory,
# The contents from this folder will be automatically copied into
# the src folder to create your initial site. You should go into
# the various config files then to configure your site.
- ./conf/hugo_conf/site_template:/site_template
# Mounted in SCP, file-browser and to Hugo for content (markdown)
# If empty will be initially populated by hugo-watcher
# adding the hugo-clarity sample site by default
# Only raw markdown should be put in here, hugo will generate
# the site from that.
- hugo_site:/src
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
depends_on:
- nginx
############################################################
# END OF DEFAULT SERVICES - everything after this
# needs to be explicitly started by passing a docker-compose
# profile as parameter.
############################################################
db:
image: *postgres-image
# Allocate more then the default 64mb to postgresql
shm_size: 1g
profiles:
- db
- postgres
- postgrest
- osm
- qgis-server
- qgis-desktop
- mergin
- mergin-server
- dev
- jupyter
- metabase
volumes:
# Persistent storage of the database cluster
- postgis_data:/var/lib/postgresql
# So we can use SSL certs for pg too
# Currently NOT WORKING - eventually we can set this and then
# Enable full CA based encryption
- ./certbot/certbot/conf:/etc/letsencrypt
env_file: .env
environment:
# You can define multiple databases by providing a comma
# separated list here.
# gis - for general purpose gis projects
# mergin-server - for mergin server flask app
# mergin - for mergin-db-sync
- POSTGRES_DB=gis,mergin-server,mergin,metabase
- POSTGRES_USER=${POSTGRES_USER}
- POSTGRES_PASS=${POSTGRES_PASSWORD}
# Read the notes at
# https://github.com/kartoza/docker-postgis#postgres-ssl-setup
# Certificate from letsencrypt doesn't currently work
#- SSL_CERT_FILE=/etc/letsencrypt/live/${DOMAIN}/cert.pems
#- SSL_KEY_FILE=/etc/letsencrypt/live/${DOMAIN}/privkey.pem
#- SSL_CA_FILE=/your/own/ssl_ca_file.pem
# Force clients to connect with SSL - will add hostssl
# instead of host to lines in pg_hba.conf
- FORCE_SSL=TRUE
# When connecting using your client, set SSL mode to 'Require'
# If you want force using a certificate, use PASSWORD_AUTHENTICATION=cert
# But then you also need to deploy certificates (again see the docs above)
- ALLOW_IP_RANGE=0.0.0.0/0
- PASSWORD_AUTHENTICATION=scram-sha-256
# You can pass as many extensions as you need.
- POSTGRES_MULTIPLE_EXTENSIONS=postgis,hstore,postgis_topology,postgis_raster,pgrouting
# Some extensions need to be registered in the postgresql.conf as
# shared_preload_libraries. pg_cron should always be added because the
# extension is installed with the image.
- SHARED_PRELOAD_LIBRARIES=pg_cron
- DEFAULT_ENCODING="UTF8"
- DEFAULT_COLLATION="en_US.UTF-8"
- DEFAULT_CTYPE="en_US.UTF-8"
- POSTGRES_TEMPLATE_EXTENSIONS=true
networks:
- os-gis-stack
ports:
- ${POSTGRES_PUBLIC_PORT}:${POSTGRES_PRIVATE_PORT}
restart: unless-stopped
healthcheck:
test: "exit 0"
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
metabase:
image: *metabase-image
env_file: .env
profiles:
- metabase
environment:
- MB_DB_TYPE=postgres
- MB_DB_DBNAME=metabase
- MB_DB_PORT=5432
- MB_DB_USER=${POSTGRES_USER}
- MB_DB_PASS=${POSTGRES_PASSWORD}
- MB_DB_HOST=db
- MUID=1000
- MGID=1000
- JAVA_TIMEZONE=${TIMEZONE}
volumes:
- /dev/urandom:/dev/random:ro
ports:
- 3000
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
networks:
- os-gis-stack
depends_on:
- db
lizmap:
# This is not WORKING YET!
# Need to resolve an issue with lizmap home still......
image: *lizmap-image
profiles:
- lizmap
command:
- php-fpm
env_file: .env
environment:
LIZMAP_WPS_URL: https://${DOMAIN}/lizmap/ # see nginx.conf
LIZMAP_CACHESTORAGETYPE: redis
LIZMAP_CACHEREDISDB: '1'
LIZMAP_USER: '1010'
LIZMAP_WMSSERVERURL: https://${DOMAIN}/lizmap/ows/
LIZMAP_CACHEREDISHOST: redis
LIZMAP_HOME: /srv/lizmap/
volumes:
- qgis_projects:/srv/projects
- lizmap-theme-config:/www/lizmap/var/lizmap-theme-config
- lizmap-config:/www/lizmap/var/config
- lizmap-db:/www/lizmap/var/db
- lizmap-www:/www/lizmap/www
- lizmap-log:/www/lizmap/var/log
- ./lizmap:/srv/lizmap
networks:
- os-gis-stack
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
# used by lizmap and mergin web server and perhaps others
redis:
image: redis:5-alpine
profiles:
- lizmap
- mergin-server
volumes:
- redis_data:/data
ports:
- 6379
networks:
- os-gis-stack
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
# Geoserver backend specifically supporting GeoNode
# that includes the GeoNode plugins
# deployed in the Kartoza GeoServer image
geoserver:
image: *geoserver-image
profiles:
- geoserver
healthcheck:
test: "curl --fail --silent --write-out 'HTTP CODE : %{http_code}\n' --output /dev/null http://127.0.0.1:8080/geoserver"
interval: 60s
timeout: 10s
retries: 1
start_period: 60s
user: 1000:1000
depends_on:
- nginx
env_file:
# Editable configs (will be edited by make configure or by user)
- .env
environment:
- ADMIN_USERNAME=${GEOSERVER_ADMIN_USER}
- ADMIN_PASSWORD=${GEOSERVER_ADMIN_PASSWORD}
- INITIAL_MEMORY=${INITIAL_MEMORY}
- MAXIMUM_MEMORY=${MAXIMUM_MEMORY}
- STABLE_EXTENSIONS=importer-plugin
- HTTPS_HOST=${DOMAIN}
- HTTPS_PORT=443
- HTTP_HOST=127.0.0.1
- HTTP_PORT=80
- GEOSERVER_DATA_DIR=/opt/geoserver/data_dir
volumes:
# This path is specified by the GEOSERVER_DATA_DIR
- geoserver_data:/opt/geoserver/data_dir
# Mounted in to geoserver for serving geoserver data
# store
- geoserver_user_data:/geoserver_user_data
restart: on-failure
networks:
- os-gis-stack
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
qgis-server:
image: *qgis-server-image
profiles:
- qgis-server
env_file: .env
environment:
# Do not run the embedded copy of nginx
SKIP_NGINX: "true"
# Improve rendering performance
QGIS_SERVER_PARALLEL_RENDERING: "true"
QGIS_SERVER_MAX_THREADS: 4
# Limit the maximum size returned by a GetMap
QGIS_SERVER_WMS_MAX_HEIGHT: 5000
QGIS_SERVER_WMS_MAX_WIDTH: 5000
# Verbose logging
QGIS_SERVER_LOG_LEVEL: 0
# Initialize the authentication system
# creates or uses qgis-auth.db in ~/.qgis3/ or directory
# defined by QGIS_AUTH_DB_DIR_PATH env variable
# set the master password as first line of file defined by
# QGIS_AUTH_PASSWORD_FILE env variable
# (QGIS_AUTH_PASSWORD_FILE variable removed from environment
# after accessing)
# See also volume mounts below
QGIS_AUTH_DB_DIR_PATH: /tmp/
QGIS_AUTH_PASSWORD_FILE: /tmp/qgis-auth-pwd.txt
# For OGC API
# # Landing page plugin projects directory
#QGIS_SERVER_LANDING_PAGE_PROJECTS_DIRECTORIES ${QGIS_SERVER_LANDING_PAGE_PROJECTS_DIRECTORIES}
#QGIS_SERVER_LANDING_PAGE_PROJECTS_PG_CONNECTIONS postgresql://${POSTGRES_USER}:${POSTGRES_PASS}@postgis:5432?sslmode=disable&dbname=${POSTGRES_DBNAME}&schema=public`
ports:
- "9993"
networks:
- os-gis-stack
volumes:
# Data should be mount RO when working
# with GeoPackages and more than one QGIS container
# Data dir structure
# $(pwd)/qgis_projects must have the following structure:
#
# data
# |
# |-- <project_name>
# |-- <project_name>.qgs
#
# The data dir is mounted in the SCP volume
# too so that you can upload your projects easily
# using then have them published
#
# It would be much nicer to mount this RO
# but when working with GPKG files QGIS wants to
# create wal and shm files and your projects wont load
# if it can't
# There is an option to disable creating WAL files
# in QGIS but I havent looked into how to set up QGIS Server
# to support it.
# See https://gis.stackexchange.com/questions/224188/geopackage-error-is-mounted-and-in-wal-mode-this-combination-is-not-allowed
#- qgis_projects:/io/data:ro
- qgis_projects:/io/data
#
# qgis_plugins
# |
# |-- <plugin_name>
# |-- <plugin_code>.py
# |-- metadata.txt
# |-- __init__.py
- ./qgis_plugins:/io/plugins
#
# Custom fonts are loaded into /usr/share/fonts. fc-cache is
# run when container is started.
- qgis_fonts:/usr/share/fonts
- qgis_svg:/var/lib/qgis/.local/share/QGIS/QGIS3/profiles/default/svg
- ./conf/qgis_conf/auth-db/qgis-auth.db:/tmp/qgis-auth.db
- ./conf/qgis_conf/auth-db/qgis-auth-pwd.txt:/tmp/qgis-auth-pwd.txt
# Working path for the pg_service file if using
# openquake/qgis-server:stable
# See https://github.com/gem/oq-qgis-server/issues/54
# The service file contains two service definitions
# nginx - used for connecting to the database to load a QGIS
# project stored in the database
# In that case you cannot yet use qgis-auth.db
# database for user/pass credentials
# smallholding - used for layer definitions. This service has
# no user/pass data and
# instead we fetch those credentials from the qgis
# authdb
- ./conf/pg_conf/pg_service.conf:/etc/postgresql-common/pg_service.conf:ro
# As per the oq QGIS Server docs at
# https://github.com/gem/oq-qgis-server/blob/master/README.md#postgresql-connection-service-file-optional
# but wrong!
#This works instead for the openquake/qgis-server:3 image
#- ./conf/pg_conf/pg_service.conf:/etc/pg_service.conf:ro
# Mount the mergin db sync data into nginx so we can access
# images etc.
# Ideally we should only be mounting the image subfolders to
# avoid leaking our geopackage etc.
# To do that the mergin project needs to be set up accordingly
# - TODO for the future
- mergin_sync_data:/mergin-data
restart: unless-stopped
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
# QGIS Desktop running in a web browser via XPRA
# We will revers proxy it via nginx so no public port
# open here.
qgis-desktop:
image: *qgis-desktop-image
profiles:
- qgis-desktop
networks:
- os-gis-stack
ports:
- "9876"
volumes:
# qgis-projects
# |
# |-- <project_name>
# |-- <project_name>.qgs
#
# The data dir is mounted in the SCP volume
# too so that you can upload your projects easily
# using then have them published
#
- qgis_projects:/qgis-projects
#
# Custom fonts are loaded into /usr/share/fonts. fc-cache is
# run when container is started.
- qgis_fonts:/usr/share/fonts
# Need to check this
- qgis_svg:/var/lib/qgis/.local/share/QGIS/QGIS3/profiles/default/svg
# and this
- ./conf/qgis_conf/auth-db/qgis-auth.db:/tmp/qgis-auth.db
# Working path for the pg_service file
- ./conf/pg_conf/pg_service.conf:/etc/postgresql-common/pg_service.conf:ro
# Mount the mergin db sync data into nginx so we can access
# images etc.
# Ideally we should only be mounting the image subfolders to
# avoid leaking our geopackage etc.
# To do that the mergin project needs to be set up accordingly
# - TODO for the future
- mergin_sync_data:/mergin-data
restart: unless-stopped
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
mapproxy:
image: *mapproxy-image
profiles:
- mapproxy
env_file: .env
user: 1000:1000
# Added this because mapproxy was not resolving my QGIS SServer on its public hostname
dns:
- 8.8.8.8
- 4.4.4.4
environment:
- PRODUCTION=false
- PROCESSES=4
- THREADS=10
user: "1000:1000"
volumes:
- ./conf/mapproxy_conf:/mapproxy
- mapproxy_cache_data:/mapproxy/cache_data
networks:
- os-gis-stack
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
mapproxy-seed:
##
## Example usage: docker-compose --profile=mapproxy-seed up mapproxy-seed
##
## Crank up the number of threads and processes if you have a
## fast machine
##
image: *mapproxy-image
profiles:
- mapproxy-seed
user: 1000:1000
# Added this because mapproxy was not resolving my QGIS SServer on its public hostname
dns:
- 8.8.8.8
- 4.4.4.4
entrypoint: ["mapproxy-seed"]
command: ["-c", "4", "-s", "/mapproxy/seed.yaml", "-f", "/mapproxy/mapproxy.yaml"]
env_file: .env
environment:
- PRODUCTION=True
- PROCESSES=30
- THREADS=100
user: "1000:1000"
volumes:
- ./conf/mapproxy_conf:/mapproxy
- mapproxy_cache_data:/mapproxy/cache_data
networks:
- os-gis-stack
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
postgrest:
#
# Used for pushing readings from IoT devices to our database
#
image: *postgrest-image
profiles:
- postgrest
- db
env_file: .env
environment:
PGRST_DB_URI: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:${POSTGRES_PRIVATE_PORT}/gis
PGRST_DB_SCHEMA: ${PGRST_DB_SCHEMA}
# In production this role should not be the same as the one used for the connection
# depends_on
PGRST_DB_ANON_ROLE: ${PGRST_DB_ANON_ROLE}
PGRST_SERVER_PROXY_URI: ${PGRST_SERVER_PROXY_URI}
PGRST_OPENAPI_SERVER_PROXY_URI: ${PGRST_OPENAPI_SERVER_PROXY_URI}
PGRST_SERVER_PORT: ${PGRST_SERVER_PORT}
links:
- db:db
ports:
- "3000"
depends_on:
- db
networks:
- os-gis-stack
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
swagger:
image: *swagger-image
profiles:
- postgrest
ports:
- "8080"
volumes:
- ./conf/swagger_conf/swagger.json:/swagger.json
env_file: .env
environment:
SWAGGER_JSON: /swagger.json
API_URL: ${API_URL}
depends_on:
- db
- postgrest
networks:
- os-gis-stack
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
node-red:
image: *node-red-image
profiles:
- node-red
env_file: .env
environment:
- TZ=${TIMEZONE}
ports:
- 1880
networks:
- os-gis-stack
volumes:
- node-red-data:/data
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
mosquitto:
image: *mosquitto-image
profiles:
- mosquitto
ports:
- 1883:1883
networks:
- os-gis-stack
volumes:
- mosquitto-data:/mosquitto/data
- ./certbot/certbot/conf:/etc/letsencrypt
- ./conf/mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf
- ./conf/mosquitto/start-mosquitto.sh:/mosquitto/config/start-mosquitto.sh
command: /mosquitto/config/start-mosquitto.sh
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
############################################################
#
# MERGIN Service - this is not run in production by
# default. It will sync your mergin projects to the db image.
# To run do:
#
# docker-compose --profile=mergin up -d
#
############################################################
mergin-dbsync:
image: *mergin-db-sync-image
profiles:
- mergin-dbsync
volumes:
# We do this so we can easily inspect what is being pulled
# down from mergin, flush the working dir when needed etc
- mergin_sync_data:/tmp
env_file: .env
environment:
- DB_CONN_INFO=host=db dbname=${MERGIN_DATABASE} user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} sslmode=require
- DB_SCHEMA_MODIFIED=${DB_SCHEMA_MODIFIED}
- DB_SCHEMA_BASE=${DB_SCHEMA_BASE}
- MERGIN_USERNAME=${MERGIN_USER}
- MERGIN_PASSWORD=${MERGIN_PASSWORD}
- MERGIN_PROJECT_NAME=${MERGIN_PROJECT_NAME}
- MERGIN_SYNC_FILE=${MERGIN_SYNC_FILE}
# Ultimately we want to swap to having the db as the master
# copy. If you are using the geopackage as the master copy:
entrypoint: "python3 dbsync_daemon.py --init-from-gpkg"
# If you are using the database as the master copy:
#entrypoint: "python3 dbsync_daemon.py --init-from-db"
networks:
- os-gis-stack
restart: unless-stopped
depends_on:
- db
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
##############################################################
# Will just check out a project and update every interval
##############################################################
mergin-client:
image: *mergin-client-image
profiles:
- mergin-client
env_file: .env
environment:
- MERGIN_URL=${MERGIN_URL}
- MERGIN_USER=${MERGIN_USER}
- MERGIN_PASSWORD=${MERGIN_PASSWORD}
#command: "download"
command: "download tim1/GloriousProjectOfMagnificence /home/mergin/project"
#command: "/bin/sh -c 'set -x; mergin.sh download $MERGIN_PROJECT; while :; do sleep 1m & wait $${!}; set -x; cd $MERGIN_PROJECT; mergin pull; cd ..; done' "
volumes:
# Host mounted volume
# Also mounted to QGIS Server for serving QGIS projects
- qgis_projects:/home/mergin
networks:
- os-gis-stack
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
############################################################
#
# OSM Sync Services - these are not run in production by
# default - to run them do:
#
# docker-compose --profile=osm up -d
#
############################################################
imposm:
image: *imposm-image
profiles:
- osm
volumes:
# These are sharable to other containers
- ./conf/osm_conf:/home/settings
- osm_import_done:/home/import_done
- osm_import_queue:/home/import_queue
- osm_cache:/home/cache
depends_on:
- db
networks:
- os-gis-stack
env_file: .env
environment:
- POSTGRES_USER=${POSTGRES_USER}
- POSTGRES_PASS=${POSTGRES_PASSWORD}
- POSTGRES_DBNAME=gis
- POSTGRES_PORT=${POSTGRES_PRIVATE_PORT}
- POSTGRES_HOST=db
- SSL_MODE=require
# seconds between 2 executions of the script if 0, then no
# update will be done, only the first initial import from the
# PBF
- TIME=120
# folder for settings (with *.json and *.sql)
- SETTINGS=settings
# folder for caching
- CACHE=cache
# folder for diff which has been imported
- IMPORT_DONE=import_done
# folder for diff which hasn't been imported yet
- IMPORT_QUEUE=import_queue
# it can be 3857
- SRID=4326
# see http://imposm.org/docs/imposm3/latest/tutorial.html#optimize
- OPTIMIZE=false
# see http://imposm.org/docs/imposm3/latest/tutorial.html#deploy-production-tables
- DBSCHEMA_PRODUCTION=${DBSCHEMA_PRODUCTION}
# http://imposm.org/docs/imposm3/latest/tutorial.html#deploy-production-tables
- DBSCHEMA_IMPORT=osm_import
# http://imposm.org/docs/imposm3/latest/tutorial.html#deploy-production-tables
- DBSCHEMA_BACKUP=osm_backup
# Install some styles if you are using the default mapping.
# It can be 'yes' or 'no'
- QGIS_STYLE=yes
# Use clip in the database
- CLIP=yes
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
osmupdate:
image: *osm-update-image
profiles:
- osm
volumes:
# These are sharable to other containers
- ./conf/osm_conf:/home/settings
- osm_import_done:/home/import_done
- osm_import_queue:/home/import_queue
- osm_cache:/home/cache
depends_on:
- db
networks:
- os-gis-stack
environment:
# These are all currently the defaults but listed here for
# your convenience if you want to change them.
# The maximum time range to assemble a cumulated changefile.
- MAX_DAYS=100
# osmupdate uses a combination of minutely, hourly and daily
# changefiles. This value can be minute, hour, day or
# sporadic.
- DIFF=sporadic
# argument to determine the maximum number of parallely
# processed changefiles.
- MAX_MERGE=7
# define level for gzip compression. values between 1 (low
# compression but fast) and 9 (high compression but slow)
- COMPRESSION_LEVEL=1
# change the URL to use a custom URL to fetch regional file
# updates.
- BASE_URL=http://planet.openstreetmap.org/replication/
# folder for diff which hasn't been imported yet
- IMPORT_QUEUE=import_queue
# folder for diff which has been imported
- IMPORT_DONE=import_done
# seconds between 2 executions of the script
# if 0, then no update will be done, only the first initial
# import from the PBF
- TIME=120
logging:
driver: json-file
options:
max-size: 200m
max-file: '10'
# This server updates user and date of osm edits in the mirror
osmenrich:
image: *osm-enrich-image
profiles:
- osm