# Copyright (C) 2018-2022 Intel Corporation
#
# SPDX-License-Identifier: MIT

services:
  cvat_db:
    container_name: cvat_db
    image: postgres:15-alpine
    restart: always
    environment:
      POSTGRES_USER: root
      POSTGRES_DB: cvat
      POSTGRES_HOST_AUTH_METHOD: trust
    volumes:
      - cvat_db:/var/lib/postgresql/data
    networks:
      - cvat

  cvat_redis:
    container_name: cvat_redis
    image: redis:4.0-alpine
    restart: always
    networks:
      - cvat

  cvat_server:
    container_name: cvat_server
    image: cvat/server:${CVAT_VERSION:-dev}
    restart: always
    depends_on:
      - cvat_redis
      - cvat_db
      - cvat_opa
    environment:
      DJANGO_MODWSGI_EXTRA_ARGS: ''
      ALLOWED_HOSTS: '*'
      CVAT_REDIS_HOST: 'cvat_redis'
      CVAT_POSTGRES_HOST: 'cvat_db'
      ADAPTIVE_AUTO_ANNOTATION: 'false'
      IAM_OPA_BUNDLE: '1'
      no_proxy: elasticsearch,kibana,logstash,nuclio,opa,${no_proxy:-}
      NUMPROCS: 1
      USE_ALLAUTH_SOCIAL_ACCOUNTS:
      # Google enviroment variables
      SOCIAL_AUTH_GOOGLE_CLIENT_ID:
      SOCIAL_AUTH_GOOGLE_CLIENT_SECRET:
      # GitHub enviroment variables
      SOCIAL_AUTH_GITHUB_CLIENT_ID:
      SOCIAL_AUTH_GITHUB_CLIENT_SECRET:
      # Amazon Cognito enviroment variables
      SOCIAL_AUTH_AMAZON_COGNITO_DOMAIN:
      SOCIAL_AUTH_AMAZON_COGNITO_CLIENT_ID:
      SOCIAL_AUTH_AMAZON_COGNITO_CLIENT_SECRET:
    command: -c supervisord/server.conf
    labels:
      - traefik.enable=true
      - traefik.http.services.cvat.loadbalancer.server.port=8080
      - traefik.http.routers.cvat.rule=Host(`${CVAT_HOST:-localhost}`) &&
        PathPrefix(`/api/`, `/git/`, `/opencv/`, `/static/`, `/admin`, `/documentation/`, `/django-rq`)
      - traefik.http.routers.cvat.entrypoints=web
    volumes:
      - cvat_data:/home/django/data
      - cvat_keys:/home/django/keys
      - cvat_logs:/home/django/logs
    networks:
      cvat:
        aliases:
          - cvat-server

  cvat_utils:
    container_name: cvat_utils
    image: cvat/server:${CVAT_VERSION:-dev}
    restart: always
    depends_on:
      - cvat_redis
      - cvat_db
      - cvat_opa
    environment:
      CVAT_REDIS_HOST: 'cvat_redis'
      CVAT_REDIS_PASSWORD: ''
      CVAT_POSTGRES_HOST: 'cvat_db'
      no_proxy: elasticsearch,kibana,logstash,nuclio,opa,${no_proxy:-}
    command: -c supervisord/utils.conf
    volumes:
      - cvat_data:/home/django/data
      - cvat_keys:/home/django/keys
      - cvat_logs:/home/django/logs
    networks:
      - cvat

  cvat_worker_import:
    container_name: cvat_worker_import
    image: cvat/server:${CVAT_VERSION:-dev}
    restart: always
    depends_on:
      - cvat_redis
      - cvat_db
    environment:
      CVAT_REDIS_HOST: 'cvat_redis'
      CVAT_POSTGRES_HOST: 'cvat_db'
      no_proxy: elasticsearch,kibana,logstash,nuclio,opa,${no_proxy:-}
      NUMPROCS: 2
    command: -c supervisord/worker.import.conf
    volumes:
      - cvat_data:/home/django/data
      - cvat_keys:/home/django/keys
      - cvat_logs:/home/django/logs
    networks:
      - cvat

  cvat_worker_export:
    container_name: cvat_worker_export
    image: cvat/server:${CVAT_VERSION:-dev}
    restart: always
    depends_on:
      - cvat_redis
      - cvat_db
    environment:
      CVAT_REDIS_HOST: 'cvat_redis'
      CVAT_POSTGRES_HOST: 'cvat_db'
      no_proxy: elasticsearch,kibana,logstash,nuclio,opa,${no_proxy:-}
      NUMPROCS: 2
    command: -c supervisord/worker.export.conf
    volumes:
      - cvat_data:/home/django/data
      - cvat_keys:/home/django/keys
      - cvat_logs:/home/django/logs
    networks:
      - cvat

  cvat_worker_annotation:
    container_name: cvat_worker_annotation
    image: cvat/server:${CVAT_VERSION:-dev}
    restart: always
    depends_on:
      - cvat_redis
      - cvat_db
      - cvat_opa
    environment:
      CVAT_REDIS_HOST: 'cvat_redis'
      CVAT_POSTGRES_HOST: 'cvat_db'
      no_proxy: elasticsearch,kibana,logstash,nuclio,opa,${no_proxy:-}
      NUMPROCS: 1
    command: -c supervisord/worker.annotation.conf
    volumes:
      - cvat_data:/home/django/data
      - cvat_keys:/home/django/keys
      - cvat_logs:/home/django/logs
    networks:
      - cvat

  cvat_worker_webhooks:
    container_name: cvat_worker_webhooks
    image: cvat/server:${CVAT_VERSION:-dev}
    restart: always
    depends_on:
      - cvat_redis
      - cvat_db
      - cvat_opa
    environment:
      CVAT_REDIS_HOST: 'cvat_redis'
      CVAT_POSTGRES_HOST: 'cvat_db'
      no_proxy: elasticsearch,kibana,logstash,nuclio,opa,${no_proxy:-}
      NUMPROCS: 1
    command: -c supervisord/worker.webhooks.conf
    volumes:
      - cvat_data:/home/django/data
      - cvat_keys:/home/django/keys
      - cvat_logs:/home/django/logs
    networks:
      - cvat

  cvat_ui:
    container_name: cvat_ui
    image: cvat/ui:${CVAT_VERSION:-dev}
    restart: always
    depends_on:
      - cvat_server
    labels:
      - traefik.enable=true
      - traefik.http.services.cvat-ui.loadbalancer.server.port=80
      - traefik.http.routers.cvat-ui.rule=Host(`${CVAT_HOST:-localhost}`)
      - traefik.http.routers.cvat-ui.entrypoints=web
    networks:
      - cvat

  traefik:
    image: traefik:v2.9
    container_name: traefik
    restart: always
    command:
      - '--providers.docker.exposedByDefault=false'
      - '--providers.docker.network=cvat'
      - '--entryPoints.web.address=:8080'
      - '--providers.file.directory=/etc/traefik/rules'
    # Uncomment to get Traefik dashboard
    #   - "--entryPoints.dashboard.address=:8090"
    #   - "--api.dashboard=true"
    # labels:
    #   - traefik.enable=true
    #   - traefik.http.routers.dashboard.entrypoints=dashboard
    #   - traefik.http.routers.dashboard.service=api@internal
    #   - traefik.http.routers.dashboard.rule=Host(`${CVAT_HOST:-localhost}`)
    ports:
      - 8080:8080
      - 8090:8090
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - cvat

  cvat_opa:
    container_name: cvat_opa
    image: openpolicyagent/opa:0.45.0-rootless
    restart: always
    networks:
      cvat:
        aliases:
          - opa
    command:
      - run
      - --server
      - --set=decision_logs.console=true
      - --set=services.cvat.url=http://cvat-server:8080
      - --set=bundles.cvat.service=cvat
      - --set=bundles.cvat.resource=/api/auth/rules
      - --set=bundles.cvat.polling.min_delay_seconds=5
      - --set=bundles.cvat.polling.max_delay_seconds=15

volumes:
  cvat_db:
  cvat_data:
  cvat_keys:
  cvat_logs:

networks:
  cvat: