docker-compose.yml

version: "3.7"
# run this in server command line
# > docker-compose -f docker-compose.yml --env-file <specific run env vars like MAIN_USER etc> build
# > docker-compose -f docker-compose.yml --env-file <specific run env vars like MAIN_USER etc> up --remove-orphans -d
# NOTE : MUST explicitly set to localhost (127.0.0.1) the translated ports for all services that should NOT be accessible outside the firewall
# as Docker added 'allow' iptables rules for such ports on 0.0.0.0.... bypassing any other iptables/ufw rules....
# This also means that it is not neccessary to add explicit ufw rules for ports exposed by the docker containers such as 80, 443, 8883 etc...

services:
  influxdb:
    image: influxdb:1.8
    container_name: influxdb
    restart: always
    networks:
      - backend
    ports:
      - 8086:8086
    volumes:
      - influxdb-db:/var/lib/influxdb
      - influxdb-conf:/etc/influxdb
    # 1st run time : create a owner admin user using the web UI eg user 'admin' in the org 'myorg'
    # then create the processing user/pass (INFLUXDB_USER/INFLUXDB_PASS : 'msgproc' by default) by entering the influxdb docker and using influx CLI (this cannot be done using the UI!!)
    # sudo docker exec -it <container id> /bin/bash
    # influx config create --config-name admin --host-url http://localhost:8086 --org <organisation name> --token <owner user api token> --active
    # influx user create -n msgproc -p msgproc01 -o <org name>

  ttn-msgproc-1:
    build:
      context: .
      dockerfile: Dockerfile.msgproc
    container_name: ttn-msgproc
    networks:
      - backend
    links:
      - influxdb
    restart: always
    depends_on:
      - influxdb
    environment:
      - INFLUXDB_ADDRESS
      - INFLUXDB_USER
      - INFLUXDB_PASSWORD
      - TTN_TENANT
      - MQTT_ADDRESS
      - MQTT_PORT
      - MQTT_USER=smarthouse-22rdk-29600
      - MQTT_PASS=NNSXS.GIXHBFWDXVGQMEQMJ7FTTUBEVC5LFYXI55SWPVI.V7AXSCYTGVIM5MTU6BZGRXHD6YWQ7VGFXK3BJCD2ZTOM5QDZ5SSQ

  ttn-msgproc-2:
    build:
      context: .
      dockerfile: Dockerfile.msgproc
    container_name: ttn-msgproc2
    networks:
      - backend
    links:
      - influxdb
    restart: always
    depends_on:
      - influxdb
    environment:
      - INFLUXDB_ADDRESS
      - INFLUXDB_USER
      - INFLUXDB_PASSWORD
      - TTN_TENANT
      - MQTT_ADDRESS
      - MQTT_PORT
      - MQTT_USER=mynewt-app
      - MQTT_PASS=NNSXS.7FENHURPB2TH7DPUGXNAHJWAQZTWRJVJLH7R6BQ.E3DEC2N4X4VN2A5TCGHFLCU4CATP73SOUWLMQTJNPQ7RS4YDKTBA

  ttn-msgproc-3:
    build:
      context: .
      dockerfile: Dockerfile.msgproc
    container_name: ttn-msgproc3
    networks:
      - backend
    links:
      - influxdb
    restart: always
    depends_on:
      - influxdb
    environment:
      - INFLUXDB_ADDRESS
      - INFLUXDB_USER
      - INFLUXDB_PASSWORD
      - TTN_TENANT
      - MQTT_ADDRESS
      - MQTT_PORT
      - MQTT_USER=infrafon-test
      - MQTT_PASS=NNSXS.TTEKP2YTMODNSJ7UIKVZY7LO3WI73FPHIXFQUFA.I4FMVSB6NPGSUAAFSUK5NENRUCUGM5VLWFVM3CLKI4L7PYCLPJDA
      - DECODER=infrafon
      
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: always
    depends_on:
      - influxdb
    ports:
      - 3000:3000
      # TODO put back the 127.0.0.1 to protect from public access
    networks:
      - backend
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=frontend"
      - "traefik.http.routers.ife_server.rule=Host(`${PLATFORM_API_HOST}`)"
      - "traefik.http.routers.ife_server.tls=true"
      - "traefik.http.routers.ife_server.tls.certresolver=letsencrypt"
    volumes:
      - grafana-db:/var/lib/grafana
      - grafana-log:/var/log/grafana
      - grafana-conf:/etc/grafana

  traefik:
    image: traefik:v2.4.14
    restart: always
    container_name: traefik
    ports:
      - "80:80"
      - "443:443"
      - "8883:8883"
      #- "127.0.0.1:8080:8080"
    networks:
      - frontend
    command:
      - --api.insecure=true
      - --providers.docker
      - --log.level=DEBUG
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.email=contact@wt-consulting.fr
      - --certificatesresolvers.letsencrypt.acme.storage=/acme.json
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --entrypoints.webinsecure.address=:80
      - --entrypoints.webinsecure.http.redirections.entryPoint.to=websecure
      - --entrypoints.webinsecure.http.redirections.entryPoint.scheme=https
      - --entrypoints.webinsecure.http.redirections.entrypoint.permanent=true
      - --entrypoints.mqtt.address=:8883
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik/acme.json:/acme.json

volumes:
  influxdb-db:
    external: false
    name: influxdb-db
  influxdb-conf:
    external: false
    name: influxdb-conf
  grafana-db:
    external: false
    name: grafana-db
  grafana-log:
    external: false
    name: grafana-log
  grafana-conf:
    external: false
    name: grafana-conf
    
networks:
  #Dedicated network for traefik communication
  frontend:
    name: frontend
    external: false
    driver: bridge
  #Dedicated network to communicate with database
  backend:
    name: backend
    external: false
    driver: bridge