docker-compose.yml

# Some people have reported problems with the balrogui API proxy not working correctly.
# This appears to be the same problem reported in https://github.com/docker/compose/issues/2172,
# and seems to only occur with certain (older) versions of docker-compose.
version: '2.1'
services:
  balrogadmin:
    build:
      context: .
      dockerfile: taskcluster/docker/balrog-backend/Dockerfile
      args:
        PYTHON_VERSION: 3.13
        SRC: .
    depends_on:
      balrogdb:
        condition: service_healthy
      graphite:
        condition: service_started
    entrypoint:
      - bash
      - scripts/initdb_and_run.sh
    command: admin
    expose:
      - "7070"
    volumes:
      - .:/app
      - /app/.venv
    environment:
      - DBURI=mysql://balrogadmin:balrogadmin@balrogdb/balrog
      - DB_HOST=balrogdb
      - SECRET_KEY=blahblah
      - PORT=7070
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
      - INSECURE_SESSION_COOKIE=1
      - LOCALDEV=1
      - AUTH0_DOMAIN=balrog-localdev.auth0.com
      - AUTH0_AUDIENCE=balrog-localdev
      - STATSD_HOST=graphite
      # By default, we disable writes to releases history for local development
      # and read existing history from the production bucket.
      # If you want to test release history writes, you need to set up your own
      # bucket, change these variables, and provide credentials in google.json.
      - RELEASES_HISTORY_BUCKET=balrog-prod-release-history-v1
      - NIGHTLY_HISTORY_BUCKET=balrog-prod-nightly-history-v1
      - GOOGLE_APPLICATION_CREDENTIALS=google.json
      - CORS_ORIGINS=*
      - STAGING
      - LOCAL_ADMIN
    healthcheck:
        test: nc -z -v balrogadmin 7070
        interval: 2s
        timeout: 30s
        retries: 50
    ulimits:
      nofile:
        soft: 4096
        hard: 4096


  balrogpub:
    build:
      context: .
      dockerfile: taskcluster/docker/balrog-backend/Dockerfile
      args:
        PYTHON_VERSION: 3.13
        SRC: .
    depends_on:
      balrogdb:
        condition: service_healthy
      autograph:
        condition: service_healthy
      graphite:
        condition: service_started
      redis:
        condition: service_healthy
    command: public
    ports:
      - "9010:9010"
    volumes:
      - .:/app
      - /app/.venv
    environment:
      - DBURI=mysql://balrogadmin:balrogadmin@balrogdb/balrog
      - AUTOGRAPH_URL=http://autograph:8000
      - AUTOGRAPH_KEYID=normandy
      - AUTOGRAPH_USERNAME=alice
      - AUTOGRAPH_PASSWORD=fs5wgcer9qj819kfptdlp8gm227ewxnzvsuj9ztycsx08hfhzu
      - STATSD_HOST=graphite
      - SECRET_KEY=blahblah
      - PORT=9010
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
      - REDIS_CACHE=1
      - REDIS_URL=redis://redis:6379
    ulimits:
      nofile:
        soft: 4096
        hard: 4096


  balrogagent:
    build:
      context: .
      dockerfile: taskcluster/docker/balrog-agent/Dockerfile
      args:
        PYTHON_VERSION: 3.13
        SRC: .
    depends_on:
      nginx:
        condition: service_healthy
    volumes:
      - ./agent:/app/agent
      - /app/.venv
    environment:
      - BALROG_API_ROOT=http://nginx:9012
      - BALROG_USERNAME=balrogagent
      - BALROG_PASSWORD=na
      - TELEMETRY_API_ROOT=abc
      - LOG_FORMAT=plain
      - LOG_LEVEL=WARNING
      - AUTH0_DOMAIN=balrog-localdev.auth0.com
      - AUTH0_AUDIENCE=balrog-localdev
      # Not a real secret. This machine-to-machine clientId is in its own
      # Auth0 account, and has access to nothing except the Balrog
      # local development API.
      - AUTH0_M2M_CLIENT_ID=41U6XJQdSa6CL8oGa6CXvO4aZWlnq5xg
      - AUTH0_M2M_CLIENT_SECRET=updk4Gi1f6ncXDCDBH5ZclbsbIUaZmqvEXYCQLCFI56RnWlnTQXCQe6-h9n86QTv


  balrogui:
    image: node:24@sha256:3a09aa6354567619221ef6c45a5051b671f953f0a1924d1f819ffb236e520e6b
    depends_on:
      balrogadmin:
        condition: service_healthy
    ports:
      - "9000:9000"
    environment:
      - BALROG_ROOT_URL=https://localhost:9011
      - HOST=0.0.0.0
      - PORT=9000
    volumes:
      - ./ui:/app
      - node_modules:/app/node_modules
    entrypoint:
      - /bin/bash
      - --login
      - -c
      - yarn install && yarn start
    working_dir: /app


  nginx:
    build:
      context: .
      dockerfile: Dockerfile.nginx
    depends_on:
      balrogadmin:
        condition: service_healthy
    ports:
      - "9011:9011"
      - "9012:9012"
    volumes:
      - ./scripts/nginx.conf:/etc/nginx/conf.d/http_balrog.conf.template
      - ./scripts/server.crt:/etc/nginx/server.crt
      - ./scripts/server.key:/etc/nginx/server.key
      - ./scripts/dhparam.pem:/etc/nginx/dhparam.pem
    environment:
      - NGINX_PORT=9011
      - NGINX_BALROG_AGENT_PORT=9012
      - BALROG_ADMIN_ROOT=http://balrogadmin:7070
    command: /bin/bash -c "envsubst '$$NGINX_PORT $$NGINX_BALROG_AGENT_PORT $$BALROG_ADMIN_ROOT' < /etc/nginx/conf.d/http_balrog.conf.template > /etc/nginx/conf.d/http_balrog.conf && nginx -g 'daemon off;'"
    healthcheck:
        test: nc -z -v nginx 9011 && nc -z -v nginx 9012
        interval: 2s
        timeout: 30s
        retries: 50


  balrogdb:
    build:
      context: .
      dockerfile: Dockerfile.database
    expose:
      - "3306"
    ports:
      - "3306:3306"
    environment:
      - MYSQL_DATABASE=balrog
      - MYSQL_USER=balrogadmin
      - MYSQL_PASSWORD=balrogadmin
      - MYSQL_ROOT_PASSWORD=admin
    volumes:
      - mysqldb:/var/lib/mysql
    logging:
      driver: none
    healthcheck:
        test: nc -z -v balrogdb 3306
        interval: 2s
        timeout: 30s
        retries: 50

  # TODO: provide our own config so that we can guarantee the keyid
  autograph:
    image: mozilla/autograph:latest@sha256:26bd613868d69405998d32a13271b1874c9a6c6888f1a2c16c9e7cd409e013ad
    expose:
      - "8000"
    ports:
      - "8000:8000"
    volumes:
      - autographtmp:/tmp/
    logging:
      driver: none
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/__heartbeat__"]
      interval: 2s
      timeout: 10s
      retries: 3

  # allows for testing statsd logging locally, including visualizations
  # visit http://localhost:8050 to view stats
  # see also: https://github.com/graphite-project/docker-graphite-statsd
  graphite:
    image: graphiteapp/graphite-statsd:latest@sha256:2d61228771119ddaee2f62d65739d3b5e903de36666e899703e47be1def571fe
    expose:
      - "8125"
    ports:
      - "8050:80"

  redis:
    image: redis:8-alpine@sha256:fd83658b0e40e2164617d262f13c02ca9ee9e1e6b276fd2fa06617e09bd5c780
    command: redis-server --loglevel warning
    expose:
      - "6379"
    healthcheck:
      test: ["CMD", "redis-cli", "PING"]

volumes:
  node_modules:
  autographtmp:
  mysqldb: