docker-compose.yml

version: '3.1'
volumes:
  data:
  capnp-secrets:
  worker-data:
  scheduler-data:
  caddy_data:
  caddy_config:

secrets:
  ocaml-ci-github-key:
    file: ${SECRETS_DIR}/private-key.pem
  ocaml-ci-webhook-secret:
    file: ${SECRETS_DIR}/webhook-secret

services:
  caddy:
    image: caddy
    ports:
      - '80:80'
      - '443:443'
      - '8100:8100'
    volumes:
      - /etc/caddy:/etc/caddy:ro
      - caddy_data:/data
      - caddy_config:/config

  service:
    build:
      context: .
      dockerfile: Dockerfile
    # For local deploys using docker build -t ocaml-ci-service -f Dockerfile .
    command: >
      --github-app-id ${APP_ID}
      --github-private-key-file /run/secrets/ocaml-ci-github-key
      --github-webhook-secret-file /run/secrets/ocaml-ci-webhook-secret
      --confirm above-average
      --confirm-auto-release 120
      --capnp-public-address=tcp:service:9000
      --capnp-listen-address=tcp:0.0.0.0:9000
      --submission-service /capnp-secrets/user.cap
      --submission-solver-service /capnp-secrets/user.cap
      --migration-path /migrations
      --github-account-allowlist '${ALLOW_LIST}'
    depends_on:
      - scheduler
    restart: on-failure
    environment:
      - "CAPNP_PROFILE=production"
      - "PLATFORMS=minimal"
      - "DOCKER_BUILDKIT=1"
      - "PROGRESS_NO_TRUNC=1"
    volumes:
      - 'data:/var/lib/ocurrent'
      - '/var/run/docker.sock:/var/run/docker.sock'
      - 'capnp-secrets:/capnp-secrets'
    secrets:
      - 'ocaml-ci-github-key'
      - 'ocaml-ci-webhook-secret'
    sysctls:
      - 'net.ipv4.tcp_keepalive_time=60'

  web:
    build:
      context: .
      dockerfile: Dockerfile.web
    # For local deploys using docker build -t ocaml-ci-web -f Dockerfile.web .
    command: >
      --backend /capnp-secrets/ocaml-ci-admin.cap
      --listen-prometheus=9090
    depends_on:
      - service
    # Wait for the default network to be created
    restart: on-failure
    volumes:
      - 'capnp-secrets:/capnp-secrets:ro'
    sysctls:
      - 'net.ipv4.tcp_keepalive_time=60'

  scheduler:
    image: ocurrent/ocluster-scheduler:live
    command: >
      --secrets-dir=/capnp-secrets
      --capnp-secret-key-file=/capnp-secrets/key.pem
      --capnp-listen-address=tcp:0.0.0.0:9000
      --capnp-public-address=tcp:scheduler:9000
      --pools=solver,linux-x86_64
      --state-dir=/var/lib/ocluster-scheduler
    restart: on-failure
    volumes:
      - 'scheduler-data:/var/lib/ocluster-scheduler'
      - 'capnp-secrets:/capnp-secrets'

  # Generate the capability file to allow the
  # service to connect to the scheduler
  scheduler-cap:
    image: ocurrent/ocluster-scheduler:live
    entrypoint: /bin/sh
    command: -c "ocluster-admin -c /capnp-secrets/admin.cap add-client user >> /capnp-secrets/user.cap"
    depends_on:
      - scheduler
    volumes:
      - 'capnp-secrets:/capnp-secrets'

  worker:
    # image: ocurrent/ocluster-worker:live
    build:
      context: .
      dockerfile: Dockerfile.rsync-worker
    command: >
      --connect=/capnp-secrets/pool-linux-x86_64.cap
      --name=ocluster-worker
      --capacity=1
      --state-dir=/var/lib/ocluster
      --obuilder-store=rsync:/rsync
      --rsync-mode=copy
      --obuilder-healthcheck=0
    # Required for the Docker in Docker container to work
    privileged: true
    # Wait for the scheduler to write pool-linux-x86_64.cap
    restart: on-failure
    volumes:
      - 'worker-data:/var/lib/ocluster'
      - '/var/run/docker.sock:/var/run/docker.sock'
      - 'capnp-secrets:/capnp-secrets:ro'
    environment:
      - DOCKER_BUILDKIT=1
      - DOCKER_CLI_EXPERIMENTAL=enabled

  solver-worker:
      image: ocurrent/solver-service:live
      command: >
        --connect=/capnp-secrets/pool-solver.cap
        --name=solver-worker
        --capacity=1
        --internal-workers=1
        --state-dir=/var/lib/ocluster
      # Wait for the scheduler to write pool-solver.cap
      restart: on-failure
      volumes:
        - 'worker-data:/var/lib/ocluster'
        - 'capnp-secrets:/capnp-secrets:ro'
      environment:
        - DOCKER_BUILDKIT=1