docker-compose.yml

version: '3.8'
services:
  traefik:
    image: traefik:latest
    command:
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.file.directory=/conf/
      - --accesslog=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  traefik-forward-auth:
    image: quay.io/oauth2-proxy/oauth2-proxy:latest
    environment:
      - http_proxy=${http_proxy}
      - https_proxy=${https_proxy}
      - OAUTH2_PROXY_PROVIDER=oidc
      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
      - OAUTH2_PROXY_OIDC_ISSUER_URL=${OAUTH_ISSUER_URL}
      - OAUTH2_PROXY_CLIENT_ID=${OAUTH_CLIENT_ID}
      - OAUTH2_PROXY_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
      - OAUTH2_PROXY_COOKIE_SECRET=${AUTHENTICATION_SECRET}
      - OAUTH2_PROXY_COOKIE_DOMAINS=.${GUI_HOST}
      - OAUTH2_PROXY_HTTP_ADDRESS=:4180
      - OAUTH2_PROXY_REVERSE_PROXY=true
      - OAUTH2_PROXY_WHITELIST_DOMAINS=.${GUI_HOST}
      - OAUTH2_PROXY_UPSTREAMS=static://202
      - OAUTH2_PROXY_EMAIL_DOMAINS=*
      - OAUTH2_PROXY_ALLOWED_GROUPS=${ALLOWED_GROUPS}
      # For some reason, login.verbis.dkfz.de does not have a "groups" scope but this comes automatically through a
      # scope called microprofile-jwt. Remove the following line once we have a "groups" scope.
      - OAUTH2_PROXY_SCOPE=openid profile email
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4180"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
      - "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4180"
      - "traefik.http.routers.oauth2.rule=Host(`${GUI_HOST}`) && PathPrefix(`/oauth2/`)"
      - "traefik.http.routers.oauth2.tls=true"

  lens:
    # NOTE: This will only host the default image. You will need to create your own image at docker hub using the provided Dockerfile.
    image: samply/dktk-explorer${COMPOSE_PROFILES}
    environment:
      - NGINX_SERVER_NAME=${GUI_HOST}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.lens.rule=Host(`${GUI_HOST}`)"
      - "traefik.http.routers.lens.tls=true"
      - "traefik.http.routers.lens.middlewares=traefik-forward-auth"

  spot:
    # NOTE: This will be replaced by https://github.com/samply/spot soon.
    image: docker.verbis.dkfz.de/ccp-private/central-spot
    environment:
      BEAM_SECRET: "${LOCAL_BEAM_SECRET}"
      BEAM_URL: http://beam-proxy:8081
      BEAM_PROXY_ID: ${LOCAL_BEAM_ID}
      BEAM_BROKER_ID: ${BROKER_HOST}
      BEAM_APP_ID: "focus"
    depends_on:
      - "beam-proxy"
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.spot.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolalloworiginlist=https://${GUI_HOST}"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolallowcredentials=true"
      - "traefik.http.middlewares.corsheaders.headers.accesscontrolmaxage=-1"
      - "traefik.http.routers.spot.rule=Host(`backend.${GUI_HOST}`) && PathPrefix(`/prod`)"
      - "traefik.http.middlewares.stripprefix_spot_prod.stripprefix.prefixes=/prod"
      - "traefik.http.routers.spot.tls=true"
      - "traefik.http.routers.spot.middlewares=corsheaders,traefik-forward-auth,stripprefix_spot_prod"

  beam-proxy:
    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
    environment:
      BROKER_URL: https://${BROKER_HOST}
      PROXY_ID: ${LOCAL_BEAM_ID}.${BROKER_HOST}
      APP_focus_KEY: ${LOCAL_BEAM_SECRET}
      PRIVKEY_FILE: /run/secrets/proxy.pem
      ALL_PROXY: ${http_proxy}
    secrets:
      - proxy.pem
      - root.crt.pem

  spot-test:
    # NOTE: This will be replaced by https://github.com/samply/spot soon.
    image: docker.verbis.dkfz.de/ccp-private/central-spot
    environment:
      BEAM_SECRET: "${LOCAL_BEAM_SECRET_TEST}"
      BEAM_URL: http://beam-proxy-test:8081
      BEAM_PROXY_ID: ${LOCAL_BEAM_ID}
      BEAM_BROKER_ID: ${BROKER_HOST_TEST}
      BEAM_APP_ID: "focus"
    depends_on:
      - "beam-proxy"
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.spot-test.loadbalancer.server.port=8080"
      - "traefik.http.routers.spot-test.rule=Host(`backend.${GUI_HOST}`) && PathPrefix(`/test`)"
      - "traefik.http.middlewares.stripprefix_spot_test.stripprefix.prefixes=/test"
      - "traefik.http.routers.spot-test.tls=true"
      - "traefik.http.routers.spot-test.middlewares=corsheaders,traefik-forward-auth,stripprefix_spot_test"
    profiles:
      - ":develop"

  beam-proxy-test:
    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
    environment:
      BROKER_URL: https://${BROKER_HOST_TEST}
      PROXY_ID: ${LOCAL_BEAM_ID}.${BROKER_HOST_TEST}
      APP_focus_KEY: ${LOCAL_BEAM_SECRET_TEST}
      PRIVKEY_FILE: /run/secrets/proxy.pem
      ROOTCERT_FILE: /run/secrets/root-test.crt.pem
      ALL_PROXY: ${http_proxy}
    secrets:
      - proxy.pem
      - root-test.crt.pem
    profiles:
      - ":develop"

secrets:
  proxy.pem:
    file: /etc/lens/pki/${LOCAL_BEAM_ID}.priv.pem
  root.crt.pem:
    file: ./rootcerts/${BROKER_HOST}-root.crt.pem
  root-test.crt.pem:
    file: ./rootcerts/${BROKER_HOST_TEST}-root.crt.pem