bramw_baserow/docker-compose.yml

version: "3.4"

# == README ==
#
# To use this docker-compose.yml to run Baserow you must set the three required
# environment variables in the `x-backend-required-variables` section below and review
# the variables in the `x-common-important-variables` section. If you receive the
# following error it is because you need to set the required environment variables
# first:
#   ```
# ERROR: Missing mandatory value for "environment" option interpolating
#   ```
#
#   If you are upgrading from Baserow 1.8.2 or earlier please read the additional section
#   below.
#
#   See [Configuring Baserow](configuration.md) for information on the
#   other environment variables you can configure.
#
#   ## How to set environment variables
#
#   You can set these variables by using docker-compose env file
# (https://docs.docker.com/compose/environment-variables/#the-env-file):
#   1. Copy the `.env.example` file found in the root of Baserows repository
# (https://gitlab.com/bramw/baserow/-/blob/master/.env.example)  to `.env`:
#   ```
#   curl -o .env https://gitlab.com/bramw/baserow/-/blob/master/.env.example
#   ```
#   2. Edit `.env` and provide values for the missing environment variables.
#   3. `docker-compose up`
#
#   Alternatively you can set these variables by either running docker-compose with
# the environment variables set on the command line (fill in secure values first):
#   ```
#   SECRET_KEY= DATABASE_PASSWORD= REDIS_PASSWORD= docker-compose up
#   ```
#
# ## Upgrading from Baserow 1.8.2's docker-compose file
#
# To upgrade from 1.8.2's docker-compose file from inside the Baserow git repo you need to:
#   1. Stop your existing Baserow install when safe to do so:
#   `docker-compose down`
#   2. `git pull`
#   3. Copy `.env.example` to `.env` and edit `.env` filling in the missing variables
# below:
#   - `SECRET_KEY` to a secure value, existing logins sessions will be invalidated.
#   - `DATABASE_PASSWORD` to a secure password (this defaulted to 'baserow' before, in
#     step 3 we are going to change the database users password to the value you set)
#   - `REDIS_PASSWORD` to a secure password.
#   - `WEB_FRONTEND_PORT` back to 3000 if you want to continue accessing Baserow on
#     that port (it now defaults to 80).
#   - `BASEROW_PUBLIC_URL` to the URL/IP/Domain you were using access Baserow remotely
#     (it must begin with http:// or https://). If you have set `WEB_FRONTEND_PORT` to
#     anything but 80 you must append it to the end of `BASEROW_PUBLIC_URL`.
#   - `BASEROW_CADDY_ADDRESSES` configures which addresses the new internal Caddy reverse
#     proxy listens on. By default, it will serve http only, enable automatic https
#     by setting to `https://YOUR_DOMAIN_NAME.com`. Append `,http://localhost` if you
#     still want to be able to access Baserow from `localhost`.
#   4. Run the command below which will change the baserow postgresql users password to
#      what you have set in step 1 in the .env file (no need to edit the command):
#   ```
#   docker-compose run --rm backend bash -c "PGPASSWORD=baserow psql -h db -U baserow -c \"ALTER USER baserow WITH PASSWORD '$DATABASE_PASSWORD';\" && echo 'Successfully changed Baserow's db user password'"
#   ```
#   5. `docker-compose up -d`

# These environment variables are required to be set securely by you, see the README
# above.
x-backend-required-variables: &backend-required-variables
  SECRET_KEY: ${SECRET_KEY:?
    !!!! ⚠️IMPORTANT ⚠️!!!! Open Baserow's docker-compose.yml and follow the
    instructions.

    This env var must be a condidential secret key used by Baserow's Django Backend to
    secure signed data.}
  DATABASE_PASSWORD: ${DATABASE_PASSWORD:?Set to your own unique secure database
    password for the Baserow Postgresql service user to use, prior to version 1.9
    this defaulted to "baserow" and so should be set to that.}
  REDIS_PASSWORD: ${REDIS_PASSWORD:?Set to your own unqiue secure redis password used
    to access the redis instance run by Baserow.}

# These are optional but important variables which control how Baserow can be accessed.
x-common-important-variables: &common-important-variables
  # BASEROW_PUBLIC_URL is a comma separated list of urls you will be using to access
  # Baserow, normally should just be a single URL. The first URL provided will be used
  # to generate correct urls in emails, share links, downloads. All the urls will be
  # used by the Caddy reverse proxy as addresses to listen for. See
  # https://caddyserver.com/docs/caddyfile/concepts#addresses for more info.
  # Caddy will setup HTTPS automatically if you have setup DNS correctly and use a
  # https:// url. See https://caddyserver.com/docs/automatic-https.
  # > If you are also setting WEB_FRONTEND_PORT to anything but 80 then you must
  # > append this port to your BASEROW_PUBLIC_URL like so:
  # > $YOUR_BASEROW_PUBLIC_URL:$YOUR_CUSTOM_WEB_FRONTEND_PORT
  BASEROW_PUBLIC_URL: ${BASEROW_PUBLIC_URL-http://localhost}
  # This is a comma separated list of addresses the Caddy reverse proxy sitting in-front
  # of Baserow's services will listen on. If you wish to enable automatic https then
  # you should change this to be `https://YOUR_DOMAIN_NAME.com`.
  BASEROW_CADDY_ADDRESSES: ${BASEROW_CADDY_ADDRESSES:-:80}
  # WEB_FRONTEND_PORT is the HTTP port that Baserow will bind to on the host to serve
  # content. Prior to 1.9 this defaulted to 3000 but was changed to 80 in 1.9.
  # > If set to anything but the default of 80 to access Baserow you will need to
  # > append the port to your BASEROW_PUBLIC_URL (see above).
  WEB_FRONTEND_PORT: ${WEB_FRONTEND_PORT:-80}
  # WEB_FRONTEND_SSL_PORT is the SSL port Baserow will bind to on the host for HTTPS.
  WEB_FRONTEND_SSL_PORT: ${WEB_FRONTEND_SSL_PORT:-443}
  # HOST_PUBLISH_IP is the address Baserow will bind to on the host, the choices are:
  # - The default value of 0.0.0.0 : This will make Baserow accessible publicly from
  #   other machines on your network, the internet if the server is exposed to it and
  #   also due to a docker bug/"feature" bypass any Ubuntu UFW Firewall rules
  #   (See https://github.com/chaifeng/ufw-docker).
  # - 127.0.0.1 : This will make Baserow private and only available on the machine
  #               running docker-compose. Useful for when you want to run Baserow behind
  #               a reverse proxy or just make it private.
  HOST_PUBLISH_IP: ${HOST_PUBLISH_IP:-0.0.0.0}
  # Set to any non-empty value to ensure Baserow generates https:// next links provided
  # by paginated API endpoints. Baserow will still work correctly if not enabled, this
  # is purely for giving the correct https url for clients of the API.
  # If you have setup Baserow to use Caddy's auto HTTPS or you have put Baserow behind
  # a reverse proxy which:
  #  * Handles HTTPS
  #  * Strips the X-Forwarded-Proto header from all incoming requests.
  #  * Sets the X-Forwarded-Proto header and sends it to Baserow.
  # Then you can safely set BASEROW_ENABLE_SECURE_PROXY_SSL_HEADER=yes to ensure Baserow
  # generates https links for pagination correctly.
  #
  # 1. !!! Do not enable this setting if you have not setup https. !!!
  # 2. See https://docs.djangoproject.com/en/3.2/ref/settings/#secure-proxy-ssl-header
  #    for more details.
  # 3  You will also need to disable the automatic https provided by Caddy if using your
  #    own reverse proxy by using the BASEROW_CADDY_GLOBAL_CONF variable above.
  BASEROW_ENABLE_SECURE_PROXY_SSL_HEADER: ${BASEROW_ENABLE_SECURE_PROXY_SSL_HEADER:-}

x-common-variables: &common-variables
  <<: *common-important-variables
  PRIVATE_BACKEND_URL: http://backend:8000
  PRIVATE_WEB_FRONTEND_URL: http://web-frontend:3000
  PUBLIC_BACKEND_URL:
  PUBLIC_WEB_FRONTEND_URL:
  FEATURE_FLAGS:

x-common-backend-variables: &common-backend-variables
  <<: *backend-required-variables
  <<: *common-variables
  MIGRATE_ON_STARTUP: ${MIGRATE_ON_STARTUP:-true}
  SYNC_TEMPLATES_ON_STARTUP: ${SYNC_TEMPLATES_ON_STARTUP:-true}
  BASEROW_TRIGGER_SYNC_TEMPLATES_AFTER_MIGRATION:
  DATABASE_USER: ${DATABASE_USER:-baserow}
  DATABASE_NAME: ${DATABASE_NAME:-baserow}
  ADDITIONAL_APPS:
  EMAIL_SMTP:
  EMAIL_SMTP_HOST:
  EMAIL_SMTP_PORT:
  EMAIL_SMTP_USE_TLS:
  EMAIL_SMTP_USER:
  EMAIL_SMTP_PASSWORD:
  FROM_EMAIL:
  DISABLE_ANONYMOUS_PUBLIC_VIEW_WS_CONNECTIONS:
  MEDIA_URL:
  BASEROW_EXTRA_ALLOWED_HOSTS:
  BASEROW_FILE_UPLOAD_SIZE_LIMIT_MB:
  BASEROW_COUNT_ROWS_ENABLED:

services:
  # A caddy reverse proxy sitting in-front of all the services.
  caddy:
    image: caddy:2.4.6
    restart: unless-stopped
    environment:
      <<: *common-variables
      BASEROW_CADDY_GLOBAL_CONF: ${BASEROW_CADDY_GLOBAL_CONF:-}
    ports:
      - "${HOST_PUBLISH_IP:-0.0.0.0}:${WEB_FRONTEND_PORT:-80}:80"
      - "${HOST_PUBLISH_IP:-0.0.0.0}:${WEB_FRONTEND_SSL_PORT:-443}:443"
    volumes:
      - $PWD/Caddyfile:/etc/caddy/Caddyfile
      - media:/baserow/media
      - caddy_config:/config
      - caddy_data:/data
    healthcheck:
      test: [ "CMD", "wget", "--spider", "http://localhost/caddy-health-check" ]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      local:

  backend:
    image: baserow/backend:1.10.1
    restart: unless-stopped
    environment:
      <<: *common-backend-variables
    depends_on:
      - db
      - redis
    volumes:
      - media:/baserow/media
    networks:
      local:

  web-frontend:
    image: baserow/web-frontend:1.10.1
    restart: unless-stopped
    environment:
      <<: *common-variables
    depends_on:
      - backend
    networks:
      local:

  celery:
    image: baserow/backend:1.10.1
    restart: unless-stopped
    environment:
      <<: *common-backend-variables
    command: celery-worker
    # The backend image's baked in healthcheck defaults to the django healthcheck
    # override it to the celery one here.
    healthcheck:
      test: [ "CMD-SHELL", "/baserow/backend/docker/docker-entrypoint.sh celery-worker-healthcheck" ]
    depends_on:
      - backend
    volumes:
      - media:/baserow/media
    networks:
      local:

  celery-export-worker:
    image: baserow/backend:1.10.1
    restart: unless-stopped
    command: celery-exportworker
    # The backend image's baked in healthcheck defaults to the django healthcheck
    # override it to the celery one here.
    healthcheck:
      test: [ "CMD-SHELL", "/baserow/backend/docker/docker-entrypoint.sh celery-exportworker-healthcheck" ]
    depends_on:
      - backend
    environment:
      <<: *common-backend-variables
    volumes:
      - media:/baserow/media
    networks:
      local:

  celery-beat-worker:
    image: baserow/backend:1.10.1
    restart: unless-stopped
    command: celery-beat
    # See https://github.com/sibson/redbeat/issues/129#issuecomment-1057478237
    stop_signal: SIGQUIT
    # We don't yet have a healthcheck for the beat worker, just assume it is healthy.
    healthcheck:
      test: [ "CMD-SHELL", "exit 0" ]
    depends_on:
      - backend
    environment:
      <<: *common-backend-variables
    volumes:
      - media:/baserow/media
    networks:
      local:

  db:
    # Please ensure the postgres-client's major version in the backend image is kept in
    # sync with this major version so pg_dump remains compatible.
    image: postgres:11.3
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${DATABASE_USER:-baserow}
      - POSTGRES_PASSWORD=${DATABASE_PASSWORD:?}
      - POSTGRES_DB=${DATABASE_NAME:-baserow}
    healthcheck:
      test: [ "CMD-SHELL", "su postgres -c \"pg_isready -U ${DATABASE_USER:-baserow}\"" ]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      local:
    volumes:
      - pgdata:/var/lib/postgresql/data

  redis:
    image: redis:6.0
    command: redis-server --requirepass ${REDIS_PASSWORD:?}
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
    networks:
      local:

  # By default, the media volume will be owned by root on startup. Ensure it is owned by
  # the same user that django is running as, so it can write user files.
  volume-permissions-fixer:
    image: bash:4.4
    command: chown 9999:9999 -R /baserow/media
    volumes:
      - media:/baserow/media
    networks:
      local:

volumes:
  pgdata:
  media:
  caddy_data:
  caddy_config:

networks:
  local:
    driver: bridge