---
version: "3"

volumes:
  akvorado-zookeeper:
  akvorado-kafka:
  akvorado-geoip:
  akvorado-clickhouse:
  akvorado-run:
  akvorado-console-db:

services:
  geoip:
    # Put GEOIPUPDATE_ACCOUNT_ID and GEOIPUPDATE_LICENSE_KEY values in `.env` file.
    image: maxmindinc/geoipupdate:v4
    environment:
      - GEOIPUPDATE_ACCOUNT_ID
      - GEOIPUPDATE_LICENSE_KEY
      - GEOIPUPDATE_EDITION_IDS=GeoLite2-ASN GeoLite2-Country
      - GEOIPUPDATE_FREQUENCY=48
    volumes:
      - akvorado-geoip:/usr/share/GeoIP

  zookeeper:
    image: bitnami/zookeeper:3.7
    environment:
      - ALLOW_ANONYMOUS_LOGIN=yes
    restart: unless-stopped
    volumes:
      - akvorado-zookeeper:/bitnami/zookeeper
  kafka:
    image: bitnami/kafka:3.3
    environment:
      - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181
      - ALLOW_PLAINTEXT_LISTENER=yes
      - KAFKA_DELETE_TOPIC_ENABLE=true
      - KAFKA_ENABLE_KRAFT=no
    restart: unless-stopped
    depends_on:
      - zookeeper
    volumes:
      - akvorado-kafka:/bitnami/kafka
    healthcheck:
      interval: 20s
      timeout: 10s
      retries: 3
      test: ["CMD", "kafka-topics.sh", "--list", "--bootstrap-server", "kafka:9092"]
  kafka-ui:
    image: provectuslabs/kafka-ui:v0.5.0
    restart: unless-stopped
    environment:
      - KAFKA_CLUSTERS_0_NAME=local
      - KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=kafka:9092
      - SERVER_SERVLET_CONTEXT_PATH=/kafka-ui
    labels:
      - traefik.enable=true
      - traefik.http.routers.kafka-ui.entrypoints=private
      - traefik.http.routers.kafka-ui.rule=PathPrefix(`/kafka-ui`)

  redis:
    image: bitnami/redis:7.0
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
    restart: unless-stopped

  akvorado-service: &akvorado-image
    image: ghcr.io/akvorado/akvorado:latest
    command: version

  akvorado-orchestrator:
    <<: *akvorado-image
    restart: unless-stopped
    command: orchestrator /etc/akvorado/akvorado.yaml
    volumes:
      - ./config:/etc/akvorado:ro
    labels:
      - traefik.enable=true
      - traefik.http.routers.akvorado-orchestrator.entrypoints=private # it exposes configuration files with passwords
      - traefik.http.routers.akvorado-orchestrator.rule=PathPrefix(`/api/v0/orchestrator`)
      - traefik.http.services.akvorado-orchestrator.loadbalancer.server.port=8080
  akvorado-console:
    <<: *akvorado-image
    restart: unless-stopped
    depends_on:
      - redis
      - clickhouse
    command: console http://akvorado-orchestrator:8080
    volumes:
      - akvorado-console-db:/run/akvorado
    labels:
      - traefik.enable=true
      - traefik.http.routers.akvorado-console.rule=PathPrefix(`/`)
      - traefik.http.services.akvorado-console.loadbalancer.server.port=8080
      - traefik.http.middlewares.testheader.headers.customrequestheaders.Remote-User=alfred
      - traefik.http.middlewares.testheader.headers.customrequestheaders.Remote-Name=Alfred Pennyworth
      - traefik.http.middlewares.testheader.headers.customrequestheaders.Remote-Email=alfred@example.com
  akvorado-inlet:
    <<: *akvorado-image
    ports:
      - 2055:2055/udp
      - 6343:6343/udp
      - 10179:10179/tcp
    restart: unless-stopped
    command: inlet http://akvorado-orchestrator:8080
    volumes:
      - akvorado-geoip:/usr/share/GeoIP:ro
      # If you prefer to use geo IP databases from host, comment the
      # above line and uncomment this one:
      # - /usr/share/GeoIP:/usr/share/GeoIP:ro
      - akvorado-run:/run/akvorado
    labels:
      - traefik.enable=true
      - traefik.http.routers.akvorado-inlet.rule=PathPrefix(`/api/v0/inlet`)
      - traefik.http.services.akvorado-inlet.loadbalancer.server.port=8080
      - akvorado.conntrack.fix=true
  akvorado-conntrack-fixer:
    <<: *akvorado-image
    cap_add:
      - NET_ADMIN
    command: conntrack-fixer
    restart: unless-stopped
    network_mode: host
    healthcheck:
      disable: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  clickhouse:
    image: clickhouse/clickhouse-server:22.8
    volumes:
      - ./orchestrator/clickhouse/data/docker-entrypoint.sh:/docker-entrypoint-initdb.d/init-db.sh:ro
      - akvorado-clickhouse:/var/lib/clickhouse
    environment:
      - CLICKHOUSE_INIT_TIMEOUT=60
    restart: unless-stopped
    healthcheck:
      interval: 30s
      timeout: 10s
      retries: 3
      test: ["CMD", "wget", "-T", "1", "--spider", "--no-proxy", "http://clickhouse:8123"]
    labels:
      - traefik.enable=true
      - traefik.http.routers.clickhouse.entrypoints=private
      - traefik.http.routers.clickhouse.rule=PathPrefix(`/clickhouse`)
      - traefik.http.services.clickhouse.loadbalancer.server.port=8123

  traefik:
    image: traefik:2.6
    restart: unless-stopped
    command:
      - --api=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      # - --providers.docker.allowEmptyServices=true
      - --entrypoints.private.address=:8080
      - --entrypoints.public.address=:8081
    ports:
      # Port 8080 is considered private as it exposes sensible unauthenticated
      # services (ClickHouse, configuration, ...). Therefore, it is only exposed
      # on the loopback. Port 8081 is the one you can expose to users. If you
      # want to change these ports, leave "8080/tcp" and "8081/tcp" unchanged:
      # you can modify the IP/port on the left.
      - 127.0.0.1:8080:8080/tcp
      - 8081:8081/tcp
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro