compose.yaml

# Rogue Scholar Docker Compose
#
# Usage::
#
#   $ docker compose up -d
#
# The following services are included:
# - Reverse proxy: Caddy (exposed ports: 80, 443)
# - Web application: Gunicorn (exposed port: none)
# - DB: (PostgresSQL) (exposed port: 5432)
# - Cache and message queue: Redis (exposed port: 6379)
# - Search platform: (OpenSearch) (exposed ports: 9200, 9300)

x-common-env:

  # Flask-SQLAlchemy
  &common-env
  INVENIO_SQLALCHEMY_DATABASE_URI: ${INVENIO_SQLALCHEMY_DATABASE_URI:-postgresql+psycopg2://postgres:postgres@db/scholar}

  # Invenio-Search
  INVENIO_SEARCH_HOSTS: ${INVENIO_SEARCH_HOSTS:-['search:9200']}
  INVENIO_SEARCH_INDEX_PREFIX: ${INVENIO_SEARCH_INDEX_PREFIX:-invenio-rdm-}

  # Invenio-App Caches and Workers
  INVENIO_ACCOUNTS_SESSION_REDIS_URL: ${INVENIO_ACCOUNTS_SESSION_REDIS_URL:-redis://cache:6379/0}

  # Mail
  INVENIO_MAIL_SUPPRESS_SEND: ${INVENIO_MAIL_SUPPRESS_SEND:-True}
  INVENIO_MAIL_SERVER: ${INVENIO_MAIL_SERVER:-smtp.gmail.com}
  INVENIO_MAIL_PORT: ${INVENIO_MAIL_PORT:-587}
  INVENIO_MAIL_USERNAME: ${INVENIO_MAIL_USERNAME:-info}
  INVENIO_MAIL_PASSWORD: ${INVENIO_MAIL_PASSWORD:-changeme}
  INVENIO_MAIL_USE_TLS: ${INVENIO_MAIL_USE_TLS:-True}
  INVENIO_SECURITY_EMAIL_SENDER: ${INVENIO_SECURITY_EMAIL_SENDER:-}

  # Logging
  INVENIO_LOGGING_CONSOLE_LEVEL: ${INVENIO_LOG_LEVEL:-WARNING}
  INVENIO_LOGGING_FS_LEVEL: ${INVENIO_LOG_LEVEL:-WARNING}
  GUNICORN_LOG_LEVEL: ${INVENIO_LOG_LEVEL:-WARNING}
  INVENIO_CELERY_WORKER_LOG_FORMAT: ${INVENIO_CELERY_WORKER_LOG_FORMAT:-{"time":"%(asctime)s","level":"%(levelname)s","logger":"%(name)s","message":"%(message)s"}}
  INVENIO_CELERY_WORKER_TASK_LOG_FORMAT: ${INVENIO_CELERY_WORKER_TASK_LOG_FORMAT:-{"time":"%(asctime)s","level":"%(levelname)s","logger":"%(name)s","task_name":"%(task_name)s","task_id":"%(task_id)s","message":"%(message)s"}}

  # DOI Registration
  INVENIO_DATACITE_ENABLED: ${INVENIO_DATACITE_ENABLED:-False}
  INVENIO_DATACITE_TEST_MODE: ${INVENIO_DATACITE_TEST_MODE:-False}
  INVENIO_DATACITE_USERNAME: ${INVENIO_DATACITE_USERNAME:-}
  INVENIO_DATACITE_PASSWORD: ${INVENIO_DATACITE_PASSWORD:-}
  INVENIO_DATACITE_PREFIX: ${INVENIO_DATACITE_PREFIX:-}
  INVENIO_DATACITE_DATACENTER_SYMBOL: ${INVENIO_DATACITE_DATACENTER_SYMBOL:-}
  INVENIO_CROSSREF_USERNAME: ${INVENIO_CROSSREF_USERNAME:-}
  INVENIO_CROSSREF_PASSWORD: ${INVENIO_CROSSREF_PASSWORD:-}

  # Invenio-RDM-Records
  INVENIO_RDM_ALLOW_METADATA_ONLY_RECORDS: ${INVENIO_RDM_ALLOW_METADATA_ONLY_RECORDS:-True}
  INVENIO_RDM_ALLOW_RESTRICTED_RECORDS: ${INVENIO_RDM_ALLOW_RESTRICTED_RECORDS:-True}
  INVENIO_RDM_ALLOW_EXTERNAL_DOI_VERSIONING: ${INVENIO_RDM_ALLOW_EXTERNAL_DOI_VERSIONING:-False}

  RDM_CITATION_STYLES_LIST: ${RDM_CITATION_STYLES_LIST:-apa,chicago-author-date,harvard-cite-them-right,ieee,vancouver}

  # Invenio-S3
  INVENIO_S3_ENDPOINT_URL: ${INVENIO_S3_ENDPOINT_URL:-}
  INVENIO_S3_BUCKET_NAME: ${INVENIO_S3_BUCKET_NAME:-}
  INVENIO_S3_ACCESS_KEY_ID: ${INVENIO_S3_ACCESS_KEY_ID:-}
  INVENIO_S3_SECRET_ACCESS_KEY: ${INVENIO_S3_SECRET_ACCESS_KEY:-}

  # Admin user
  INVENIO_ADMIN_EMAIL: ${INVENIO_ADMIN_EMAIL:-info@example.org}
  INVENIO_ADMIN_PASSWORD: ${INVENIO_ADMIN_PASSWORD:-changeme}
services:
  proxy:
    image: caddy:2.10
    restart: "unless-stopped"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
  web:
    image: ghcr.io/front-matter/rogue-scholar:latest
    platform: linux/amd64
    expose:
      - "4000"
    volumes:
      - uploaded_data:/opt/invenio/var/instance/data
      - archived_data:/opt/invenio/var/instance/archive
    healthcheck:
      test:
        - CMD
        - python3
        - '-c'
        - "import urllib.request; urllib.request.urlopen('http://localhost:4000/ping')"
      interval: 60s
      timeout: 20s
      retries: 3
      start_period: 40s
    environment:
      <<: *common-env

      # Flask
      INVENIO_TRUSTED_HOSTS: ${INVENIO_TRUSTED_HOSTS:-['0.0.0.0', 'localhost', '127.0.0.1']}

      # Flask-Babel
      INVENIO_BABEL_DEFAULT_LOCALE: ${INVENIO_BABEL_DEFAULT_LOCALE:-en}
      INVENIO_BABEL_DEFAULT_TIMEZONE: ${INVENIO_BABEL_DEFAULT_TIMEZONE:-UTC}

      # Invenio-I18N (exclude INVENIO_BABEL_DEFAULT_LOCALE)
      INVENIO_ISO639_LANGUAGES: ${INVENIO_ISO639_LANGUAGES:-de,es,fr}

      # Invenio-App
      INVENIO_SECRET_KEY: ${INVENIO_SECRET_KEY:-changeme}

      # Invenio-Theme
      # See: https://inveniordm.docs.cern.ch/operate/customize/look-and-feel/
      INVENIO_THEME_LOGO: ${INVENIO_THEME_LOGO:-images/rogue-scholar-white.svg}
      INVENIO_THEME_SITENAME: ${INVENIO_THEME_SITENAME:-Rogue Scholar}
      INVENIO_THEME_FRONTPAGE_TITLE: ${INVENIO_THEME_FRONTPAGE_TITLE:-Science blogging on steroids.}
      INVENIO_THEME_FRONTPAGE_SUBTITLE: ${INVENIO_THEME_FRONTPAGE_SUBTITLE:-The Rogue Scholar science blog archive improves science blogs in important ways, including full-text search, long-term archiving, DOIs and metadata, and communities.}
      INVENIO_THEME_SHOW_FRONTPAGE_INTRO_SECTION: "False"

      # Invenio-Records-Resources
      INVENIO_SITE_UI_URL: ${INVENIO_SITE_UI_URL:-https://localhost}
      INVENIO_SITE_API_URL: ${INVENIO_SITE_API_URL:-https://localhost/api}

      # Authentication
      # See: https://inveniordm.docs.cern.ch/operate/customize/authentication/
      INVENIO_ACCOUNTS_LOCAL_LOGIN_ENABLED: ${INVENIO_ACCOUNTS_LOCAL_LOGIN_ENABLED:-True}
      INVENIO_ACCOUNTS_DEFAULT_USER_VISIBILITY: ${INVENIO_ACCOUNTS_DEFAULT_USER_VISIBILITY:-restricted}
      INVENIO_SECURITY_LOGIN_WITHOUT_CONFIRMATION: ${INVENIO_SECURITY_LOGIN_WITHOUT_CONFIRMATION:-True}
      INVENIO_OAUTHCLIENT_AUTO_REDIRECT_TO_EXTERNAL_LOGIN: ${INVENIO_OAUTHCLIENT_AUTO_REDIRECT_TO_EXTERNAL_LOGIN:-False}
      INVENIO_USERPROFILES_READ_ONLY: ${INVENIO_USERPROFILES_READ_ONLY:-True}

      INVENIO_SECURITY_CHANGEABLE: ${INVENIO_SECURITY_CHANGEABLE:-True}
      INVENIO_SECURITY_CONFIRMABLE: ${INVENIO_SECURITY_CONFIRMABLE:-True}
      INVENIO_SECURITY_RECOVERABLE: ${INVENIO_SECURITY_RECOVERABLE:-True}
      INVENIO_SECURITY_REGISTERABLE: ${INVENIO_SECURITY_REGISTERABLE:-True}
      INVENIO_SECURITY_TRACKABLE: ${INVENIO_SECURITY_TRACKABLE:-True}

      INVENIO_OIDC_ISSUER: ${INVENIO_OIDC_ISSUER:-}
      INVENIO_OIDC_APP_CREDENTIALS_CONSUMER_KEY: ${INVENIO_OIDC_APP_CREDENTIALS_CONSUMER_KEY:-}
      INVENIO_OIDC_APP_CREDENTIALS_CONSUMER_SECRET: ${INVENIO_OIDC_APP_CREDENTIALS_CONSUMER_SECRET:-}
    depends_on:
      search:
        condition: service_healthy
      cache:
        condition: service_healthy
      db:
        condition: service_healthy
  worker:
    image: ghcr.io/front-matter/rogue-scholar:latest
    platform: linux/amd64
    command: [ "celery", "-A", "invenio_app.celery", "worker", "--beat", "--schedule=/tmp/celerybeat-schedule", "--events", "--loglevel=WARNING" ]
    volumes:
      - uploaded_data:/opt/invenio/var/instance/data
    environment:
      <<: *common-env
    depends_on:
      search:
        condition: service_healthy
      cache:
        condition: service_healthy
      db:
        condition: service_healthy
  cache:
    image: valkey/valkey:7.2.5-bookworm
    restart: "unless-stopped"
    command: [ "valkey-server", "--loglevel", "warning" ]
    ports:
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: [ "CMD", "valkey-cli", "ping" ]
      interval: 5s
      timeout: 3s
      retries: 5
  db:
    image: postgres:17.4-bookworm
    restart: "unless-stopped"
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
      - POSTGRES_DB=${POSTGRES_DB:-scholar}
    ports:
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U postgres" ]
      interval: 5s
      timeout: 3s
      retries: 5
  search:
    image: opensearchproject/opensearch:2.18.0
    restart: "unless-stopped"
    volumes:
      - ./log4j2.properties:/usr/share/opensearch/config/log4j2.properties:ro
    environment:
      bootstrap.memory_lock: "true"
      OPENSEARCH_JAVA_OPTS: "-Xms512m -Xmx512m"
      DISABLE_INSTALL_DEMO_CONFIG: "true"
      DISABLE_SECURITY_PLUGIN: "true"
      discovery.type: "single-node"
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    mem_limit: 2g
    ports:
      - "127.0.0.1:9200:9200"
      - "127.0.0.1:9600:9600"
    healthcheck:
      test: [ "CMD-SHELL", "curl -f http://localhost:9200/_cluster/health || exit 1" ]
      interval: 10s
      timeout: 5s
      retries: 10
volumes:
  app_data:
  uploaded_data:
  archived_data:
  caddy_data:
  caddy_config: