docker-compose.yml

version: '2.3'

# versions: change these in order to pin versions for a certain releases
x-versions:
  services: &IMAGE_RAIDEN_SERVICES_VERSION
    image: raidennetwork/raiden-services:v0.13.2
  db: &IMAGE_DB_VERSION
    image: raidennetwork/raiden-service-bundle:2020.11.2-db
  synapse: &IMAGE_SYNAPSE_VERSION
    image: raidennetwork/raiden-service-bundle:2020.11.2-synapse
  well-known-server: &IMAGE_WELL_KNOWN_VERSION
    image: raidennetwork/raiden-service-bundle:2020.11.2-well_known_server
  room_ensurer: &IMAGE_ROOM_ENSURER_VERSION
    image: raidennetwork/raiden-service-bundle:2020.11.2-room_ensurer
  purger: &IMAGE_PURGER_VERSION
    image: raidennetwork/raiden-service-bundle:2020.11.2-purger
  state_groups_cleaner: &IMAGE_STATE_GROUPS_CLEANER
    image: raidennetwork/raiden-service-bundle:2020.11.2-state_groups_cleaner
  redis: &IMAGE_REDIS_VERSION
    image: redis:6.0
  metrics_db: &IMAGE_METRICS_DB_VERSION
    image: wrouesnel/postgres_exporter:latest
  metrics_redis: &IMAGE_METRICS_REDIS_VERSION
    image: oliver006/redis_exporter:v1.12.0
  traefik: &IMAGE_TRAEFIK_VERSION
    image: traefik:2.2
  node_exporter: &IMAGE_NODE_EXPORTER
    image: quay.io/prometheus/node-exporter:v1.0.1
# /versions

x-defaults: &services-defaults
  <<: *IMAGE_RAIDEN_SERVICES_VERSION
  env_file: .env
  volumes:
    - ${DATA_DIR:-./data}/state:/state
    - ${DATA_DIR:-./data}/keystore:/keystore

x-log-config: &log-config
  logging:
    driver: json-file
    options:
      max-size: "20m"
      max-file: "10"

services:
  # raiden-services containers
  pfs:
    << : *services-defaults
    command: ["python3", "-m", "pathfinding_service.cli", "--matrix-server", "https://transport.${SERVER_NAME}"]
    restart: always
    environment:
      - PFS_STATE_DB=/state/pfs-state.db
      - PFS_HOST=0.0.0.0
      - SERVER_NAME
      - PFS_LOG_LEVEL=${LOG_LEVEL}
      - PFS_KEYSTORE_FILE=/keystore/${KEYSTORE_FILE}
      - PFS_PASSWORD=${PASSWORD}
      - PFS_ETH_RPC=${ETH_RPC}
      - PFS_ACCEPT_DISCLAIMER=${PFS_ACCEPT_DISCLAIMER}
    depends_on:
      synapse:
        condition: service_healthy
    healthcheck:
      disable: true
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pfs.rule=Host(`pfs.${SERVER_NAME}`)"
      - "traefik.http.routers.pfs.entrypoints=websecure"
      - "traefik.http.routers.pfs.tls=true"
      - "traefik.http.routers.pfs.tls.certresolver=le"
      - "traefik.http.routers.pfs.middlewares=pfs-restrict-metrics@docker"
      - "traefik.http.middlewares.pfs-restrict-metrics.stripprefix.prefixes=/metrics"
      - "traefik.http.routers.pfs.service=pfs"
      - "traefik.http.services.pfs.loadbalancer.healthcheck.path=/api/v1/info"
      - "traefik.http.routers.metrics-pfs.rule=Host(`metrics.pfs.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics-pfs.tls=true"
      - "traefik.http.routers.metrics-pfs.tls.certresolver=le"
      - "traefik.http.routers.metrics-pfs.middlewares=metrics-pfs-access-control@docker"
      - "traefik.http.middlewares.metrics-pfs-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"

  ms:
    << : *services-defaults
    command: ["python3", "-m", "monitoring_service.cli"]
    restart: always
    environment:
      - MS_STATE_DB=/state/ms-state.db
      - MS_HOST=0.0.0.0
      - MS_PORT=6000
      - MS_LOG_LEVEL=${LOG_LEVEL}
      - MS_KEYSTORE_FILE=/keystore/${KEYSTORE_FILE}
      - MS_PASSWORD=${PASSWORD}
      - MS_ETH_RPC=${ETH_RPC}
      - MS_ACCEPT_DISCLAIMER=${MS_ACCEPT_DISCLAIMER}
    healthcheck:
      test: 'python3 -c "import sqlite3, sys; from time import sleep; conn=sqlite3.connect(\"/state/ms-state.db\"); r = lambda: conn.execute(\"select latest_committed_block from blockchain ORDER BY latest_committed_block DESC LIMIT 1;\").fetchone()[0]; one = r(); sleep(25); two = r(); print(two); sys.exit(0 if two > one else 1)"'
      start_period: 30s
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ms.rule=Host(`ms.${SERVER_NAME}`)"
      - "traefik.http.routers.ms.entrypoints=websecure"
      - "traefik.http.routers.ms.tls=true"
      - "traefik.http.routers.ms.tls.certresolver=le"
      - "traefik.http.routers.ms.middlewares=ms-restrict-metrics@docker"
      - "traefik.http.routers.ms.service=ms"
      - "traefik.http.middlewares.ms-restrict-metrics.stripprefix.prefixes=/metrics"
      - "traefik.http.services.ms.loadbalancer.healthcheck.path=/api/v1/info"
      - "traefik.http.routers.metrics-ms.rule=Host(`metrics.ms.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics-ms.tls=true"
      - "traefik.http.routers.metrics-ms.tls.certresolver=le"
      - "traefik.http.routers.metrics-ms.middlewares=metrics-ms-access-control@docker"
      - "traefik.http.middlewares.metrics-ms-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"

  msrc:
    << : *services-defaults
    command: ["python3", "-m", "request_collector.cli", "--matrix-server", "https://transport.${SERVER_NAME}"]
    restart: always
    environment:
      - MSRC_STATE_DB=/state/ms-state.db
      - MSRC_LOG_LEVEL=${LOG_LEVEL}
      - MSRC_KEYSTORE_FILE=/keystore/${KEYSTORE_FILE}
      - MSRC_PASSWORD=${PASSWORD}
      - MSRC_CHAIN_ID=${CHAIN_ID}
      - MSRC_ACCEPT_DISCLAIMER=${MS_ACCEPT_DISCLAIMER}
    depends_on:
      synapse:
        condition: service_healthy
    healthcheck:
      disable: true
    << : *log-config

# raiden-transport containers
  synapse:
    << : *IMAGE_SYNAPSE_VERSION
    restart: always
    volumes:
      - ./config/synapse:/config
      - ${DATA_DIR:-./data}/well-known:/data_well_known
      - ${DATA_DIR:-./data}/synapse:/data
    environment:
      - SERVER_NAME=transport.${SERVER_NAME}
      - URL_KNOWN_FEDERATION_SERVERS
    command: ["synapse"]
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.synapse.rule=Host(`transport.${SERVER_NAME}`)"
      - "traefik.http.routers.synapse.tls=true"
      - "traefik.http.routers.synapse.tls.certresolver=le"
      - "traefik.http.routers.synapse.service=synapse"
      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
      - "traefik.http.services.synapse.loadbalancer.healthcheck.path=/_matrix/client/versions"
      - "traefik.http.routers.metrics.rule=Host(`metrics.transport.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics.tls=true"
      - "traefik.http.routers.metrics.tls.certresolver=le"
      - "traefik.http.routers.metrics.middlewares=metrics-access-control@docker"
      - "traefik.http.routers.metrics.service=metrics"
      - "traefik.http.services.metrics.loadbalancer.server.port=9101"
      - "traefik.http.middlewares.metrics-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"
      - "purge_restart_container=true"
      - "state_groups_cleaner_stop=true"

  generic_worker:
    << : *IMAGE_SYNAPSE_VERSION
    restart: always
    volumes:
      - ./config/synapse:/config
      - ${DATA_DIR:-./data}/synapse:/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - SERVER_NAME=transport.${SERVER_NAME}
    depends_on:
      synapse:
        condition: service_healthy
    command: ["worker", "generic_worker"]
    scale: ${WORKER_COUNT:-4}
    <<: *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.generic_worker.rule=Host(`transport.${SERVER_NAME}`) && (PathPrefix(`/_matrix/client/versions`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0)}/initialSync`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0)}/rooms/{room:[^/]+}/initialSync`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/account/3pid`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/join/`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/joined_groups`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/keys/changes`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/keys/query`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/login`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/profile/`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/publicised_groups`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/publicRooms`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/rooms/{room:.*}/context/{context:.*}`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/rooms/{room:.*}/joined_members`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/rooms/{room:.*}/members`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/rooms/{room:.*}/send`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/rooms/{room:.*}/state`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/rooms/{room:.*}/{action:(join|invite|leave|ban|unban|kick)}`) || PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/voip/turnServer`) || PathPrefix(`/_matrix/client/{version:(api/v1|v2_alpha|r0)}/events`) || PathPrefix(`/_matrix/client/{version:(v2_alpha|r0)}/sync`) || PathPrefix(`/_matrix/federation/v1/{type:(backfill|event|event_auth|exchange_third_party_invite|get_groups_publicised|get_missing_events|invite|make_join|make_leave|publicRoom|query|query_auth|send|send_join|send_leave|state|state_ids|user/devices)}`) || PathPrefix(`/_matrix/federation/v2/{type:(invite|send_join|send_leave)}`) || PathPrefix(`/_matrix/key/v2/query`))"
      - "traefik.http.routers.generic_worker.tls=true"
      - "traefik.http.routers.generic_worker.tls.certresolver=le"
      - "traefik.http.routers.generic_worker.service=generic_worker"
      - "traefik.http.services.generic_worker.loadbalancer.server.port=8008"
      - "traefik.http.services.generic_worker.loadbalancer.sticky=true"
      - "state_groups_cleaner_stop=true"

  federation_sender:
    << : *IMAGE_SYNAPSE_VERSION
    restart: always
    volumes:
      - ./config/synapse:/config
      - ${DATA_DIR:-./data}/synapse:/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - SERVER_NAME=transport.${SERVER_NAME}
    depends_on:
      synapse:
        condition: service_healthy
    command: ["worker", "federation_sender"]
    healthcheck:
      disable: true
    << : *log-config
    labels:
      - "purge_restart_container=true"
      - "state_groups_cleaner_stop=true"

  user_dir:
    << : *IMAGE_SYNAPSE_VERSION
    restart: always
    volumes:
      - ./config/synapse:/config
      - ${DATA_DIR:-./data}/synapse:/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - SERVER_NAME=transport.${SERVER_NAME}
    depends_on:
      synapse:
        condition: service_healthy
    command: ["worker", "user_dir"]
    scale: ${WORKER_COUNT:-4}
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.user_dir.rule=Host(`transport.${SERVER_NAME}`) && PathPrefix(`/_matrix/client/{version:(api/v1|r0|unstable)}/user_directory/search`)"
      - "traefik.http.routers.user_dir.tls=true"
      - "traefik.http.routers.user_dir.tls.certresolver=le"
      - "traefik.http.routers.user_dir.service=user_dir"
      - "traefik.http.services.user_dir.loadbalancer.server.port=8008"
      - "traefik.http.services.user_dir.loadbalancer.sticky=true"
      - "state_groups_cleaner_stop=true"

  db:
    << : *IMAGE_DB_VERSION
    restart: always
    volumes:
      - ${DATA_DIR:-./data}/db:/var/lib/postgresql/data
    environment:
      POSTGRES_HOST_AUTH_METHOD: "trust"
    healthcheck:
      test: echo 'select 1' | psql -U postgres > /dev/null || exit 1
    << : *log-config

  metrics_db:
    << : *IMAGE_METRICS_DB_VERSION
    restart: always
    volumes:
      - ./config/metrics_db:/config
    environment:
      - DATA_SOURCE_NAME=postgresql://postgres@db/postgres?sslmode=disable
      - PG_EXPORTER_AUTO_DISCOVER_DATABASES=true
      - PG_EXPORTER_EXTEND_QUERY_PATH=/config/queries.yaml
    depends_on:
      db:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.metrics_db.rule=Host(`metrics.db.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics_db.tls=true"
      - "traefik.http.routers.metrics_db.tls.certresolver=le"
      - "traefik.http.routers.metrics_db.middlewares=metrics_db-access-control@docker"
      - "traefik.http.middlewares.metrics_db-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"

  redis:
    << : *IMAGE_REDIS_VERSION
    restart: always
    healthcheck:
      test: redis-cli ping
    << : *log-config

  metrics_redis:
    << : *IMAGE_METRICS_REDIS_VERSION
    restart: always
    command: -redis.addr redis
    depends_on:
      redis:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.metrics_redis.rule=Host(`metrics.redis.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics_redis.tls=true"
      - "traefik.http.routers.metrics_redis.tls.certresolver=le"
      - "traefik.http.routers.metrics_redis.middlewares=metrics_redis-access-control@docker"
      - "traefik.http.middlewares.metrics_redis-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"
    << : *log-config

  # Serves the .well-known/matrix/server file
  well_known_server:
    << : *IMAGE_WELL_KNOWN_VERSION
    restart: always
    volumes:
      - ${DATA_DIR:-./data}/well-known:/data
    depends_on:
      synapse:
        condition: service_healthy
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.well-known.rule=Host(`transport.${SERVER_NAME}`) && PathPrefix(`/.well-known/matrix`)"
      - "traefik.http.routers.well-known.entrypoints=websecure"
      - "traefik.http.routers.well-known.tls=true"
      - "traefik.http.routers.well-known.tls.certresolver=le"

  room_ensurer:
    << : *IMAGE_ROOM_ENSURER_VERSION
    restart: always
    volumes:
      - ./config/synapse:/config
    depends_on:
      synapse:
        condition: service_healthy
    environment:
      - SERVER_NAME=transport.${SERVER_NAME}
      - URL_KNOWN_FEDERATION_SERVERS
    command:
      - "--own-server"
      - "transport.${SERVER_NAME}"
      - "--log-level"
      - "DEBUG"
      - "--credentials-file"
      - "/config/admin_user_cred.json"
    << : *log-config

  state_groups_cleaner:
    << : *IMAGE_STATE_GROUPS_CLEANER
    restart: always
    volumes:
      - ${DATA_DIR:-./data}/db:/data
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      db:
        condition: service_healthy
    << : *log-config

  purger:
    << : *IMAGE_PURGER_VERSION
    restart: always
    volumes:
      - ./config/synapse:/config
      - /var/run/docker.sock:/var/run/docker.sock
    working_dir: /app
    depends_on:
      synapse:
        condition: service_healthy
      db:
        condition: service_healthy
    environment:
      - PURGE_SLEEP_UNTIL=05:00:00
      - URL_KNOWN_FEDERATION_SERVERS
    command:
      - "https://transport.${SERVER_NAME}"
      - "--docker-restart-label"
      - "purge_restart_container"
      - "--credentials-file"
      - "/config/admin_user_cred.json"
    << : *log-config

  node_exporter:
    << : *IMAGE_NODE_EXPORTER
    restart: always
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - "--path.rootfs=/rootfs"
      - "--path.procfs=/host/proc"
      - "--path.sysfs=/host/sys"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.metrics_node.rule=Host(`metrics.node.${SERVER_NAME}`)"
      - "traefik.http.routers.metrics_node.tls=true"
      - "traefik.http.routers.metrics_node.tls.certresolver=le"
      - "traefik.http.routers.metrics_node.middlewares=metrics_node-access-control@docker"
      - "traefik.http.middlewares.metrics_node-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"
    << : *log-config

# common traefik
  traefik:
    << : *IMAGE_TRAEFIK_VERSION
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./config/traefik:/etc/traefik
      - ${DATA_DIR:-./data}/traefik:/data
      - /var/run/docker.sock:/var/run/docker.sock
    command: --certificatesResolvers.le.acme.email=${LETSENCRYPT_EMAIL}
    healthcheck:
      disable: true
    << : *log-config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`proxy.${SERVER_NAME}`)"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=le"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.middlewares=traefik-access-control@docker"
      - "traefik.http.routers.traefik-metrics.rule=Host(`proxy.${SERVER_NAME}`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.traefik-metrics.tls=true"
      - "traefik.http.routers.traefik-metrics.tls.certresolver=le"
      - "traefik.http.routers.traefik-metrics.service=prometheus@internal"
      - "traefik.http.routers.traefik-metrics.entrypoints=websecure"
      - "traefik.http.routers.traefik-metrics.middlewares=traefik-access-control@docker"
      - "traefik.http.middlewares.traefik-access-control.ipwhitelist.sourcerange=${CIDR_ALLOW_METRICS}"