docker-compose.yml

version: '2.3'

# versions: change these in order to pin versions for a certain releases
x-versions:
  services: &IMAGE_RAIDEN_SERVICES_VERSION
    image: raidennetwork/raiden-services:v2.0.0
  db: &IMAGE_DB_VERSION
    image: raidennetwork/raiden-service-bundle:2022.05.0-db
  synapse: &IMAGE_SYNAPSE_VERSION
    image: raidennetwork/raiden-service-bundle:2022.05.0-synapse
  well-known-server: &IMAGE_WELL_KNOWN_VERSION
    image: raidennetwork/raiden-service-bundle:2022.05.0-well_known_server
  redis: &IMAGE_REDIS_VERSION
    image: redis:6.0
  metrics_db: &IMAGE_METRICS_DB_VERSION
    image: wrouesnel/postgres_exporter:latest
  metrics_redis: &IMAGE_METRICS_REDIS_VERSION
    image: oliver006/redis_exporter:v1.12.0
  traefik: &IMAGE_TRAEFIK_VERSION
    image: traefik:2.2
  node_exporter: &IMAGE_NODE_EXPORTER
    image: quay.io/prometheus/node-exporter:v1.0.1
# /versions

x-defaults: &services-defaults
  <<: *IMAGE_RAIDEN_SERVICES_VERSION
  env_file: .env
  volumes:
    - ${DATA_DIR:-./data}/state:/state
    - ${DATA_DIR:-./data}/keystore:/keystore

x-log-config: &log-config
  logging:
    driver: json-file
    options:
      max-size: "50m"
      max-file: "20"

services:
  # raiden-services containers
  pfs:
    << : *services-defaults
    command: ["python3", "-m", "pathfinding_service.cli", "--matrix-server", "https://transport.${SERVER_NAME}", "--password", "${PASSWORD}"]
    restart: always
    environment:
      - PFS_STATE_DB=/state/pfs-state.db
      - PFS_HOST=0.0.0.0
      - SERVER_NAME
      - PFS_LOG_LEVEL=${LOG_LEVEL}
      - PFS_KEYSTORE_FILE=/keystore/${KEYSTORE_FILE}
      - PFS_ETH_RPC=${ETH_RPC}
      - PFS_ACCEPT_DISCLAIMER=${PFS_ACCEPT_DISCLAIMER}
    depends_on:
      synapse:
        condition: service_healthy
    healthcheck:
      disable: true
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pfs.rule=Host(`pfs.${SERVER_NAME}`)"
      - "traefik.http.routers.pfs.entrypoints=websecure"
      - "traefik.http.routers.pfs.tls=true"
      - "traefik.http.routers.pfs.tls.certresolver=le"
      - "traefik.http.routers.pfs.middlewares=pfs-restrict-metrics@docker"
      - "traefik.http.middlewares.pfs-restrict-metrics.stripprefix.prefixes=/metrics"
      - "traefik.http.routers.pfs.service=pfs"
      - "traefik.http.services.pfs.loadbalancer.healthcheck.path=/api/v1/info"
      - "traefik.http.routers.metrics-pfs.rule=Host(`metrics.pfs.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics-pfs.tls=true"
      - "traefik.http.routers.metrics-pfs.tls.certresolver=le"
      - "traefik.http.routers.metrics-pfs.middlewares=metrics-pfs-access-control@docker"
      - "traefik.http.middlewares.metrics-pfs-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"

  ms:
    << : *services-defaults
    command: ["python3", "-m", "monitoring_service.cli", "--password", "${PASSWORD}"]
    restart: always
    environment:
      - MS_STATE_DB=/state/ms-state.db
      - MS_HOST=0.0.0.0
      - MS_PORT=6000
      - MS_LOG_LEVEL=${LOG_LEVEL}
      - MS_KEYSTORE_FILE=/keystore/${KEYSTORE_FILE}
      - MS_ETH_RPC=${ETH_RPC}
      - MS_ACCEPT_DISCLAIMER=${MS_ACCEPT_DISCLAIMER}
    healthcheck:
      test: 'python3 -c "import sqlite3, sys; from time import sleep; conn=sqlite3.connect(\"/state/ms-state.db\"); r = lambda: conn.execute(\"select latest_committed_block from blockchain ORDER BY latest_committed_block DESC LIMIT 1;\").fetchone()[0]; one = r(); sleep(25); two = r(); print(two); sys.exit(0 if two > one else 1)"'
      start_period: 30s
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ms.rule=Host(`ms.${SERVER_NAME}`)"
      - "traefik.http.routers.ms.entrypoints=websecure"
      - "traefik.http.routers.ms.tls=true"
      - "traefik.http.routers.ms.tls.certresolver=le"
      - "traefik.http.routers.ms.middlewares=ms-restrict-metrics@docker"
      - "traefik.http.routers.ms.service=ms"
      - "traefik.http.middlewares.ms-restrict-metrics.stripprefix.prefixes=/metrics"
      - "traefik.http.services.ms.loadbalancer.healthcheck.path=/api/v1/info"
      - "traefik.http.routers.metrics-ms.rule=Host(`metrics.ms.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics-ms.tls=true"
      - "traefik.http.routers.metrics-ms.tls.certresolver=le"
      - "traefik.http.routers.metrics-ms.middlewares=metrics-ms-access-control@docker"
      - "traefik.http.middlewares.metrics-ms-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"

  msrc:
    << : *services-defaults
    command: ["python3", "-m", "request_collector.cli", "--matrix-server", "https://transport.${SERVER_NAME}", "--password", "${PASSWORD}"]
    restart: always
    environment:
      - MSRC_STATE_DB=/state/ms-state.db
      - MSRC_LOG_LEVEL=${LOG_LEVEL}
      - MSRC_KEYSTORE_FILE=/keystore/${KEYSTORE_FILE}
      - MSRC_CHAIN_ID=${CHAIN_ID}
      - MSRC_ACCEPT_DISCLAIMER=${MS_ACCEPT_DISCLAIMER}
    depends_on:
      synapse:
        condition: service_healthy
    healthcheck:
      disable: true
    << : *log-config

# raiden-transport containers
  synapse:
    << : *IMAGE_SYNAPSE_VERSION
    restart: always
    volumes:
      - ./config/synapse:/config
      - ${DATA_DIR:-./data}/well-known:/data_well_known
      - ${DATA_DIR:-./data}/synapse:/data
    environment:
      - SERVER_NAME=transport.${SERVER_NAME}
      - URL_KNOWN_FEDERATION_SERVERS
      - SERVICE_REGISTRY
      - ETH_RPC
    command: ["synapse"]
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.synapse.rule=Host(`transport.${SERVER_NAME}`)"
      - "traefik.http.routers.synapse.tls=true"
      - "traefik.http.routers.synapse.tls.certresolver=le"
      - "traefik.http.routers.synapse.middlewares=tls-headers-middleware@docker"
      - "traefik.http.routers.synapse.service=synapse"
      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
      - "traefik.http.middlewares.tls-headers-middleware.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.metrics.rule=Host(`metrics.transport.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics.tls=true"
      - "traefik.http.routers.metrics.tls.certresolver=le"
      - "traefik.http.routers.metrics.middlewares=metrics-access-control@docker"
      - "traefik.http.routers.metrics.service=metrics"
      - "traefik.http.services.metrics.loadbalancer.server.port=9101"
      - "traefik.http.middlewares.metrics-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"
      - "purge_restart_container=true"


  db:
    << : *IMAGE_DB_VERSION
    restart: always
    volumes:
      - ${DATA_DIR:-./data}/db:/var/lib/postgresql/data
    environment:
      POSTGRES_HOST_AUTH_METHOD: "trust"
    healthcheck:
      test: echo 'select 1' | psql -U postgres > /dev/null || exit 1
    << : *log-config

  metrics_db:
    << : *IMAGE_METRICS_DB_VERSION
    restart: always
    volumes:
      - ./config/metrics_db:/config
    environment:
      - DATA_SOURCE_NAME=postgresql://postgres@db/postgres?sslmode=disable
      - PG_EXPORTER_AUTO_DISCOVER_DATABASES=true
      - PG_EXPORTER_EXTEND_QUERY_PATH=/config/queries.yaml
    depends_on:
      db:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.metrics_db.rule=Host(`metrics.db.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics_db.tls=true"
      - "traefik.http.routers.metrics_db.tls.certresolver=le"
      - "traefik.http.routers.metrics_db.middlewares=metrics_db-access-control@docker"
      - "traefik.http.middlewares.metrics_db-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"

  redis:
    << : *IMAGE_REDIS_VERSION
    restart: always
    healthcheck:
      test: redis-cli ping
    << : *log-config

  metrics_redis:
    << : *IMAGE_METRICS_REDIS_VERSION
    restart: always
    command: -redis.addr redis
    depends_on:
      redis:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.metrics_redis.rule=Host(`metrics.redis.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics_redis.tls=true"
      - "traefik.http.routers.metrics_redis.tls.certresolver=le"
      - "traefik.http.routers.metrics_redis.middlewares=metrics_redis-access-control@docker"
      - "traefik.http.middlewares.metrics_redis-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"
    << : *log-config

  # Serves the .well-known/matrix/server file
  well_known_server:
    << : *IMAGE_WELL_KNOWN_VERSION
    restart: always
    volumes:
      - ${DATA_DIR:-./data}/well-known:/data
    depends_on:
      synapse:
        condition: service_healthy
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.well-known.rule=Host(`transport.${SERVER_NAME}`) && PathPrefix(`/.well-known/matrix`)"
      - "traefik.http.routers.well-known.entrypoints=websecure"
      - "traefik.http.routers.well-known.tls=true"
      - "traefik.http.routers.well-known.tls.certresolver=le"

  node_exporter:
    << : *IMAGE_NODE_EXPORTER
    restart: always
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - "--path.rootfs=/rootfs"
      - "--path.procfs=/host/proc"
      - "--path.sysfs=/host/sys"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.metrics_node.rule=Host(`metrics.node.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics_node.tls=true"
      - "traefik.http.routers.metrics_node.tls.certresolver=le"
      - "traefik.http.routers.metrics_node.middlewares=metrics_node-access-control@docker"
      - "traefik.http.middlewares.metrics_node-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"
    << : *log-config

# common traefik
  traefik:
    << : *IMAGE_TRAEFIK_VERSION
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./config/traefik:/etc/traefik
      - ${DATA_DIR:-./data}/traefik:/data
      - /var/run/docker.sock:/var/run/docker.sock
    command: --certificatesResolvers.le.acme.email=${LETSENCRYPT_EMAIL}
    healthcheck:
      disable: true
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`proxy.${SERVER_NAME}`)"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=le"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.middlewares=traefik-access-control@docker"
      - "traefik.http.routers.traefik-metrics.rule=Host(`proxy.${SERVER_NAME}`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.traefik-metrics.tls=true"
      - "traefik.http.routers.traefik-metrics.tls.certresolver=le"
      - "traefik.http.routers.traefik-metrics.service=prometheus@internal"
      - "traefik.http.routers.traefik-metrics.entrypoints=websecure"
      - "traefik.http.routers.traefik-metrics.middlewares=traefik-access-control@docker"
      - "traefik.http.middlewares.traefik-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"