stack: enable auth for loki as it needs public exposure

catching all the logs needs to go via traefik

config/traefik/.htpasswd

@@ -0,0 +1,5 b''
+# basic auth for traefik middleware.
+# format here is <user>:<bcrypt_password>
+# to generate bcrypt password one can use
+# curl --verbose --request POST --data "password=XlokiAuth101&cost=10" https://www.toptal.com/developers/bcrypt/api/generate-hash.json
+loki-auth:$2b$10$U8Cui8cO9ZXehYV.7atv8uPuA6rBVrA.Mxzvt8EsdheztkyXZagv6

config/traefik/traefik.yaml

@@ -1,42 +1,45 b''
 ## Static configuration, needs traefik reload
 
 entryPoints:
   http:
     address: ":80"
 
   https:
     address: ":443"
 
   ssh:
     address: ":${RC_SSH_PORT:?must-specify-ssh-port}"
 
+  loki:
+    address: ":3100"
+
   traefik:
     address: ":7000"
 
 api:
   dashboard: false
   insecure: false # change to true to expose dashboard
 
 accessLog: {}
 
 log:
   # DEBUG / INFO
   level: INFO
 
 metrics:
   prometheus: {}
 
 
 providers:
   docker:
     exposedByDefault: false
     swarmMode: false
 
   file:
     filename: "/etc/traefik/traefik_dynamic.yaml"
     watch: true
 
 
 serversTransport:
   #this disables SSL certificate verification for legacy own cert services like NextCloud etc
   insecureSkipVerify: true

config/traefik/traefik_dynamic.yaml

@@ -1,24 +1,28 b''
 
 ## Setting up the middleware for redirect to https ##
 http:
 
   middlewares:
 
     https-redirect:
       redirectScheme:
         scheme: https
         # permanent: true
 
     middlewares-rate-limit:
       rateLimit:
         average: 100
         burst: 50
 
+    basic-auth:
+      basicAuth:
+        usersfile: /etc/traefik/.htpasswd
+
 # Dynamic configuration for standard file based SSL cert
 # create a custom copy of the traefik into .custom/ and remount this
 # to enable custom certificates
 #tls:
 #  certificates:
 #    # first certificate
 #    - certFile: /etc/traefik/certs/rhodecode-com.cert
 #      keyFile: /etc/traefik/certs/rhodecode-com.key

docker-compose-apps.yaml

@@ -1,336 +1,336 b''
 version: '3.9'
 
 x-logging: &custom-logging
   # docker plugin install grafana/loki-docker-driver:2.7.1 --alias loki --grant-all-permissions
   # NOTE: loki logging driver ONLY works for host type networks...
   driver: loki
   options:
-    #loki-url: "http://loki:3100/loki/api/v1/push"
-    loki-url: "http://127.0.0.1:3100/loki/api/v1/push"
+    #loki-url: "http://${RC_LOKI_AUTH}loki:3100/loki/api/v1/push"
+    loki-url: "http://${RC_LOKI_AUTH}127.0.0.1:3100/loki/api/v1/push"
     loki-retries: "5"
     loki-timeout: "1s"
     loki-max-backoff: "800ms"
 
 
 services:
 
   rhodecode:
     networks:
       - rhodecode_network
     extra_hosts:
       - "host.docker.internal:host-gateway"
     image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:-4.28.0}
     stdin_open: true
     tty: true
     restart: always
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command: [
       "/usr/local/bin/rhodecode_bin/bin/gunicorn",
       "--name=gunicorn-rhodecode-1",
       "--error-logfile=-",
       "--paster=/etc/rhodecode/conf/rhodecode.ini",
       "--config=/etc/rhodecode/conf/gunicorn_conf_rc.py"
     ]
     deploy:
       # override this in .custom/docker-compose-apps.override.yaml to scale up
       replicas: 1
 
 #    ports:
 #      - "127.0.0.1::10020"
 
     build:
       context: .
       dockerfile: service/rhodecode/rhodecode.dockerfile
       args:
         TZ: ${TZ}
         RHODECODE_VERSION: ${RC_VERSION:-4.28.0}
         RHODECODE_DB: postgresql://rhodecode:${DB_PASSWORD:?must-specify-db-password}@database/${DB_NAME:?must-specify-db-name}
         RHODECODE_USER_NAME: ${RHODECODE_USER_NAME}
         RHODECODE_USER_PASS: ${RHODECODE_USER_PASS}
         RHODECODE_USER_EMAIL: ${RHODECODE_USER_EMAIL}
 
     environment:
       RC_APP_TYPE: rhodecode_http
       RC_APP_PROC: 1
       SSL_CERT_FILE: "/etc/rhodecode/conf/ca-bundle.crt"
       REQUESTS_CA_BUNDLE: "/etc/rhodecode/conf/ca-bundle.crt"
       GIT_SSL_CAINFO: "/etc/rhodecode/conf/ca-bundle.crt"
       GEVENT_RESOLVER: "ares"
 
       DB_UPGRADE: 1  # run the DB upgrade
       SETUP_APP: 1 # run the application default settings setup, can be turned off after initial run
       #FORCE_DB_INIT_FILE: 1 # force the database init, warning: destroys old DB
       #FORCE_RC_SETUP_APP: 1 # force running setup scripts for configuration/license application
       MAIN_INI_PATH: /etc/rhodecode/conf/rhodecode.ini
 
       # SVN Specific
       MOD_DAV_SVN_PORT: 8090
       APACHE_LOG_DIR: /var/log/rhodecode/svn
       MOD_DAV_SVN_CONF_FILE: /etc/rhodecode/conf/svn/mod_dav_svn.conf
 
     healthcheck:
       test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://127.0.0.1:10020/_admin/ops/ping" ]
       timeout: 30s
       interval: 60s
       retries: 10
 
 #    depends_on:
 #      - database
 #      - redis
 #      - channelstream
 
     volumes:
       - confvolume:/etc/rhodecode/conf
       - logvolume:/var/log/rhodecode
       - rc_reposvolume:/var/opt/rhodecode_repo_store
       - rc_datavolume:/var/opt/rhodecode_data
 
     tmpfs:
       - /data_ramdisk:size=${RC_DATA_RAMDISK_SIZE:?specify-RC_DATA_RAMDISK_SIZE-env-var}
 
     logging:
       *custom-logging
 
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.rhodecode.entrypoints=http"
       - "traefik.http.routers.rhodecode.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`)"
       - "traefik.http.routers.rhodecode.service=rhodecode-web"
       - "traefik.http.services.rhodecode-web.loadbalancer.server.port=10020"
       # SSL + proxy prefix example, should be put into .custom/docker-compose-apps.override.yaml
       #- "traefik.http.routers.rhodecode-rt.entrypoints=https"
       #- "traefik.http.routers.rhodecode-rt.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`)"
       #- "traefik.http.routers.rhodecode-rt.tls=true"
       #- "traefik.http.routers.rhodecode-rt.service=rhodecode-ssl"
       #- "traefik.http.services.rhodecode-ssl.loadbalancer.server.port=10020"
 
   vcsserver:
     networks:
       - rhodecode_network
     extra_hosts:
       - "host.docker.internal:host-gateway"
     image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:-4.28.0}
 
     stdin_open: true
     tty: true
     restart: always
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command: [
        "/home/rhodecode/.rccontrol/vcsserver-1/profile/bin/gunicorn",
        "--name=gunicorn-vcsserver-1",
        "--error-logfile=-",
        "--paster=/etc/rhodecode/conf/vcsserver.ini",
        "--config=/etc/rhodecode/conf/gunicorn_conf_vcs.py"
     ]
     deploy:
       # override this in .custom/docker-compose-apps.override.yaml to scale up
       replicas: 1
 
 #    ports:
 #      - "127.0.0.1::10010"
 
     healthcheck:
       test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://127.0.0.1:10010/status" ]
       timeout: 30s
       interval: 60s
       retries: 10
 
     environment:
       RC_APP_TYPE: rhodecode_vcsserver
       RC_APP_PROC: 1
       MAIN_INI_PATH: /etc/rhodecode/conf/vcsserver.ini
       SSL_CERT_FILE: "/etc/rhodecode/conf/ca-bundle.crt"
       REQUESTS_CA_BUNDLE: "/etc/rhodecode/conf/ca-bundle.crt"
       GIT_SSL_CAINFO: "/etc/rhodecode/conf/ca-bundle.crt"
 
 #    depends_on:
 #      - redis
 
     volumes:
       - confvolume:/etc/rhodecode/conf
       - logvolume:/var/log/rhodecode
       - rc_reposvolume:/var/opt/rhodecode_repo_store
       - rc_datavolume:/var/opt/rhodecode_data
 
     logging:
       *custom-logging
 
   celery:
     networks:
       - rhodecode_network
     extra_hosts:
       - "host.docker.internal:host-gateway"
     image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:-4.28.0}
 
     stdin_open: true
     tty: true
     restart: always
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command: [
         "/usr/local/bin/rhodecode_bin/bin/celery",
         "worker",
         "--task-events",
         "--autoscale=10,2",
         "--no-color",
         "--app=rhodecode.lib.celerylib.loader",
         "--loglevel=DEBUG",
         "--ini=/etc/rhodecode/conf/rhodecode.ini"
     ]
 
     environment:
       RC_APP_TYPE: rhodecode_celery
       RC_APP_PROC: 1
       MAIN_INI_PATH: /etc/rhodecode/conf/rhodecode.ini
       SSL_CERT_FILE: "/etc/rhodecode/conf/ca-bundle.crt"
       REQUESTS_CA_BUNDLE: "/etc/rhodecode/conf/ca-bundle.crt"
       GIT_SSL_CAINFO: "/etc/rhodecode/conf/ca-bundle.crt"
 
 #    depends_on:
 #      - database
 #      - redis
 
     volumes:
       - confvolume:/etc/rhodecode/conf
       - logvolume:/var/log/rhodecode
       - rc_reposvolume:/var/opt/rhodecode_repo_store
       - rc_datavolume:/var/opt/rhodecode_data
 
     logging:
       *custom-logging
 
     labels:
       - "traefik.enable=false"
 
   celery-beat:
     # This service is not scalable
     networks:
       - rhodecode_network
     extra_hosts:
       - "host.docker.internal:host-gateway"
     image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:-4.28.0}
 
     stdin_open: true
     tty: true
     restart: always
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command: [
       "/usr/local/bin/rhodecode_bin/bin/celery",
       "beat",
       "--no-color",
       "--app=rhodecode.lib.celerylib.loader",
       "--scheduler=rhodecode.lib.celerylib.scheduler.RcScheduler",
       "--loglevel=DEBUG",
       "--ini=/etc/rhodecode/conf/rhodecode.ini"
     ]
 
     environment:
       RC_APP_TYPE: rhodecode_beat
       RC_APP_PROC: 1
       MAIN_INI_PATH: /etc/rhodecode/conf/rhodecode.ini
       SSL_CERT_FILE: "/etc/rhodecode/conf/ca-bundle.crt"
       REQUESTS_CA_BUNDLE: "/etc/rhodecode/conf/ca-bundle.crt"
       GIT_SSL_CAINFO: "/etc/rhodecode/conf/ca-bundle.crt"
 
 #    depends_on:
 #      - database
 #      - redis
 
     volumes:
       - confvolume:/etc/rhodecode/conf
       - logvolume:/var/log/rhodecode
       - rc_reposvolume:/var/opt/rhodecode_repo_store
       - rc_datavolume:/var/opt/rhodecode_data
 
     logging:
       *custom-logging
 
     labels:
       - "traefik.enable=false"
 
   svn:
     networks:
       - rhodecode_network
     extra_hosts:
       - "host.docker.internal:host-gateway"
     image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:-4.28.0}
 
 #    build:
 #      context: .
 #      dockerfile: service/svn/rhodecode_svn.dockerfile
 #      args:
 #        APACHE_VER: 1.3
 
     stdin_open: true
     tty: true
     restart: always
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command: ["apachectl", "-D", "FOREGROUND"]
 
     environment:
       RC_APP_TYPE: rhodecode_svn
 
       # SVN Specific
       MOD_DAV_SVN_PORT: 8090
       APACHE_LOG_DIR: /var/log/rhodecode/svn
       MOD_DAV_SVN_CONF_FILE: /etc/rhodecode/conf/svn/mod_dav_svn.conf
 
 #    ports:
 #      - "127.0.0.1::8090"
 
     healthcheck:
       test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://127.0.0.1:8090/_server_status" ]
       timeout: 30s
       interval: 60s
       retries: 10
 
     volumes:
       - confvolume:/etc/rhodecode/conf
       - logvolume:/var/log/rhodecode
       - rc_reposvolume:/var/opt/rhodecode_repo_store
       - rc_datavolume:/var/opt/rhodecode_data
 
     logging:
       *custom-logging
 
   sshd:
     networks:
       - rhodecode_network
     extra_hosts:
       - "host.docker.internal:host-gateway"
     image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:-4.28.0}
 
     stdin_open: true
     tty: true
     restart: always
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command: ["/usr/sbin/sshd", "-f", "/etc/rhodecode/sshd_config", "-D", "-e"]
 
     environment:
       RC_APP_TYPE: rhodecode_sshd
       SSH_BOOTSTRAP: 1
 
 #    ports:
 #      # set from .env file
 #      - "${RC_SSH_PORT:?must-specify-ssh-port}:22"
 
     volumes:
       - confvolume:/etc/rhodecode/conf
       - logvolume:/var/log/rhodecode
       - rc_reposvolume:/var/opt/rhodecode_repo_store
       - rc_datavolume:/var/opt/rhodecode_data
 
     logging:
       *custom-logging
 
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.sshd.entrypoints=ssh"
       - "traefik.http.routers.sshd.rule=Host(`*`)"
       - "traefik.http.routers.sshd.service=rhodecode-ssh"
       - "traefik.http.services.rhodecode-ssh.loadbalancer.server.port=${RC_SSH_PORT:?must-specify-ssh-port}"

docker-compose-base.yaml

@@ -1,55 +1,55 b''
 version: '3.9'
 
 ## Shared base stuff for all compose files in stack
 
 x-logging: &custom-logging
   # Install loki plugin
   # docker plugin install grafana/loki-docker-driver:2.7.1 --alias loki --grant-all-permissions
   # NOTE: loki logging driver ONLY works for host type networks...
   # To cleanly uninstall the plugin, disable and remove it
   # docker plugin disable loki --force && docker plugin rm loki
   # debug: sudo journalctl -u docker.service | grep loki
   driver: loki
   options:
-    #loki-url: "http://loki:3100/loki/api/v1/push"
-    loki-url: "http://127.0.0.1:3100/loki/api/v1/push"
+    #loki-url: "http://${RC_LOKI_AUTH}loki:3100/loki/api/v1/push"
+    loki-url: "http://${RC_LOKI_AUTH}127.0.0.1:3100/loki/api/v1/push"
     loki-retries: "5"
     loki-timeout: "1s"
     loki-max-backoff: "800ms"
 
 volumes:
   # shared logvolume
   logvolume:
     driver: local
     driver_opts:
       type: none
       o: bind
       device: $PWD/logs
 
   # bind-mount with configs
   confvolume:
     driver: local
     driver_opts:
      type: none
      o: bind
      device: $PWD/config/_shared
 
   # SHARED volume for rhodecode caches, archive caches, nginx static,
   # must be run via: docker volume create --name=rc_datavolume
   rc_datavolume:
     external: true
 
   # volume for RhodeCode repo-store, it's where the repositories will be stored
   # must be run via: docker volume create --name=rc_reposvolume
   rc_reposvolume:
     external: true
 
 networks:
 
   # SHARED network for all containers
   # must be run via: docker network create --name=rhodecode_network
   rhodecode_network:
     name: rhodecode_network
     driver: bridge
     external: true
 

docker-compose-metrics.yaml

@@ -1,131 +1,138 b''
 version: '3.9'
 
 volumes:
 
   prometheus_data:
     labels:
       "keep": 1
 
   grafana_data:
     labels:
       "keep": 1
 
 services:
 
   statsd-exporter:
     image: prom/statsd-exporter:v0.22.8
     restart: always
     command: [
       '--statsd.mapping-config=/etc/statsd/statsd.yaml',
       '--statsd.listen-udp=:9125',
       '--web.listen-address=:9102'
     ]
     networks:
       - rhodecode_network
 #    ports:
 #      - "9125:9125/udp"
 #      - "9102:9102"
 
     volumes:
       - ./config/statsd-exporter:/etc/statsd
     labels:
       - "traefik.enable=false"
       - "traefik.http.services.statsd-exporter.loadbalancer.server.port=9125"
       - "traefik.http.services.statsd-exporter.loadbalancer.server.port=9102"
 
   node-exporter:
     image: prom/node-exporter:v1.4.1
     command:
       - "--path.procfs=/host/proc"
       - "--path.rootfs=/rootfs"
       - "--path.sysfs=/host/sys"
       - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
       - "--collector.systemd"
       - "--collector.processes"
     networks:
       - rhodecode_network
     pid: host
     restart: always
 #    ports:
 #      - "9100:9100"
     volumes:
       - "/proc:/host/proc:ro"
       - "/sys:/host/sys:ro"
       - "/:/rootfs:ro"
     labels:
       - "traefik.enable=false"
       - "traefik.http.services.node-exporter.loadbalancer.server.port=9100"
 
   prometheus:
     image: prom/prometheus:v2.40.6
     restart: always
     command:
       - "--config.file=/etc/prometheus/prometheus.yml"
       - "--storage.tsdb.path=/prometheus"
       - "--web.console.libraries=/etc/prometheus/console_libraries"
       - "--web.console.templates=/etc/prometheus/consoles"
       - "--storage.tsdb.retention.time=24h"
       - "--web.enable-lifecycle"
 #    ports:
 #      - "9090:9090"
     networks:
       - rhodecode_network
     volumes:
       - ./config/prometheus:/etc/prometheus
       - prometheus_data:/prometheus
     labels:
       - "traefik.enable=false"
       - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
 
   grafana:
     image: grafana/grafana:9.3.1
     restart: always
 #    ports:
 #      - "3000:3000"
     volumes:
       - grafana_data:/var/lib/grafana
       - ./config/grafana:/etc/grafana
     networks:
       - rhodecode_network
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.grafana.entrypoints=http"
       - "traefik.http.routers.grafana.rule=PathPrefix(`/_grafana`)"
       - "traefik.http.routers.grafana.service=grafana-http"
       - "traefik.http.services.grafana-http.loadbalancer.server.port=3000"
       # SSL + proxy prefix example, should be put into .custom/docker-compose-metrics.override.yaml
       #- "traefik.http.routers.grafana-rt.entrypoints=https"
       #- "traefik.http.routers.grafana-rt.rule=Host(`metrics.example.com`) && PathPrefix(`/_grafana`)"
       #- "traefik.http.routers.grafana-rt.tls=true"
       #- "traefik.http.routers.grafana-rt.service=grafana-ssl"
       #- "traefik.http.services.grafana-ssl.loadbalancer.server.port=3000"
 
   loki:
     image: grafana/loki:2.7.1
     restart: always
-    ports:
-      # Loki port is the only one that needs explicitly
-      # be exposed because of logging driver host-only woking mode
-      - "3100:3100"
+#    ports:
+#      - "3100:3100"
 #      - "9095:9095"
     command: [
       "-config.file=/etc/loki/loki-config.yaml"
     ]
     networks:
       - rhodecode_network
     volumes:
       - ./config/loki:/etc/loki
+      # optionally mount host container to scrape docker logs...
+      # - /var/lib/docker/containers:/var/lib/docker/containers:ro
+    labels:
+      # Loki port is the only one that needs explicitly
+      # be exposed because of logging driver host-only working mode
+      - "traefik.enable=true"
+      - "traefik.http.routers.loki.entrypoints=loki"
+      - "traefik.http.routers.loki.rule=PathPrefix(`/`)"
+      - "traefik.http.routers.loki.middlewares=basic-auth@file"
+      - "traefik.http.routers.loki.service=loki-http"
+      - "traefik.http.services.loki-http.loadbalancer.server.port=3100"
 
   promtail:
     image: grafana/promtail:2.7.1
     command: [
       "-config.file=/etc/promtail/promtail-config.yaml"
     ]
     networks:
       - rhodecode_network
     volumes:
       - /var/log:/var/log
       - logvolume:/var/log_volume
       - ./config/promtail:/etc/promtail
-    labels:
-      - "traefik.enable=false"

docker-compose-router.yaml

@@ -1,44 +1,46 b''
 version: '3.9'
 
 x-logging: &custom-logging
   # docker plugin install grafana/loki-docker-driver:2.7.1 --alias loki --grant-all-permissions
   # NOTE: loki logging driver ONLY works for host type networks...
   driver: loki
   options:
-    #loki-url: "http://loki:3100/loki/api/v1/push"
-    loki-url: "http://127.0.0.1:3100/loki/api/v1/push"
+    #loki-url: "http://${RC_LOKI_AUTH}loki:3100/loki/api/v1/push"
+    loki-url: "http://${RC_LOKI_AUTH}127.0.0.1:3100/loki/api/v1/push"
     loki-retries: "5"
     loki-timeout: "1s"
     loki-max-backoff: "800ms"
 
 ## docker network create -d overlay lb-net
 services:
 
   traefik:
 
     image: traefik:v2.9.6
 
     ports:
       # The HTTP port, exposed as http entrypoint
       - "80:80"
       # The HTTPS port, exposed as https entrypoint
       - "443:443"
+      # The loki port, exposed as http entrypoint behind auth
+      - "3100:3100"
       # The SSH port
       - "${RC_SSH_PORT}:${RC_SSH_PORT}"
     volumes:
       # So that Traefik can listen to the Docker events
       - /var/run/docker.sock:/var/run/docker.sock
       - ./config/traefik:/etc/traefik
     deploy:
       placement:
         constraints:
           # limit swarm deploy to MANAGER only
           - node.role == manager
     networks:
       - rhodecode_network
 
     labels:
       - "traefik.enable=true"
 
     logging:
       *custom-logging

docker-compose-services.yaml

@@ -1,248 +1,248 b''
 version: '3.9'
 
 x-logging: &custom-logging
   # docker plugin install grafana/loki-docker-driver:2.7.1 --alias loki --grant-all-permissions
   # NOTE: loki logging driver ONLY works for host type networks...
   driver: loki
   options:
-    #loki-url: "http://loki:3100/loki/api/v1/push"
-    loki-url: "http://127.0.0.1:3100/loki/api/v1/push"
+    #loki-url: "http://${RC_LOKI_AUTH}loki:3100/loki/api/v1/push"
+    loki-url: "http://${RC_LOKI_AUTH}127.0.0.1:3100/loki/api/v1/push"
     loki-retries: "5"
     loki-timeout: "1s"
     loki-max-backoff: "800ms"
 
 volumes:
 
   # volume for redis data store
   redis_data:
     labels:
       "keep": 1
 
    # volume for Postgres db store
 
   # volume for Postgres Data
   pg_data:
     labels:
       "keep": 1
 
   # volume for rhodecode elasticsearch
   es_data:
     labels:
       "keep": 1
 
 
 services:
 
   channelstream:
     networks:
       - rhodecode_network
     image: channelstream/channelstream:0.7.1
 
     restart: always
 
 #    ports:
 #      - "127.0.0.1:9800:9800"
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command: ["channelstream"]
 
     healthcheck:
         test: [ "CMD", "curl", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://channelstream:8000/admin/sign_in" ]
         timeout: 5s
         interval: 60s
         retries: 10
 
     volumes:
       - confvolume:/etc/rhodecode/conf
       - logvolume:/var/log/rhodecode
 
     logging:
       *custom-logging
 
     labels:
       - "traefik.enable=false"
       #- "traefik.http.routers.channelstream.entrypoints=http"
       #- "traefik.http.services.channelstream.loadbalancer.server.port=9800"
 
     profiles:
       ["channelstream"]
 
   nginx:
     networks:
       - rhodecode_network
     image: library/nginx:1.23.3
 
     restart: always
 
     environment:
       NGINX_ENTRYPOINT_QUIET_LOGS: 1
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
 
     healthcheck:
       # change port 80 to 443 when only using SSL
       test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://127.0.0.1:80/_health" ]
       timeout: 30s
       interval: 60s
       retries: 10
 
 #    depends_on:
 #      - channelstream
 
     volumes:
       - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       - ./config/nginx/http.conf:/etc/nginx/http.conf:ro
       - ./config/nginx/proxy.conf:/etc/nginx/proxy.conf:ro
       - logvolume:/var/log/rhodecode
       - rc_datavolume:/var/opt/rhodecode_data
 
     logging:
       *custom-logging
 
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.nginx.entrypoints=http"
       - "traefik.http.routers.nginx.rule=Host(`${RC_HOSTNAME:?must-specify-rhodecode-hostname}`) && ( PathPrefix(`/_health`) || PathPrefix(`/_channelstream`) || PathPrefix(`/_static/rhodecode`) )"
       - "traefik.http.services.nginx.loadbalancer.server.port=80"
 
   elasticsearch:
     networks:
       - rhodecode_network
     image: elasticsearch:6.8.23
 
     environment:
       - cluster.name=elasticsearch-cluster
       - network.host=0.0.0.0
       - bootstrap.memory_lock=true
       - discovery.type=single-node
       - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     healthcheck:
       # change port 80 to 443 when only using SSL
       test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "elasticsearch:9200/_cat/health" ]
       timeout: 30s
       interval: 60s
       retries: 10
 
     ulimits:
       memlock:
         soft: -1
         hard: -1
 
     volumes:
       - es_data:/usr/share/elasticsearch/data
 
     logging:
       *custom-logging
 
     profiles:
       ["elasticsearch"]
 
   redis:
     networks:
       - rhodecode_network
     image: library/redis:7.0.6
 
     restart: always
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
     command:
       - "redis-server"
       - "/etc/redis/redis.conf"
       - "--maxmemory-policy allkeys-lru"
       - "--maxmemory ${RC_REDIS_MAXMEMORY:?must-specify-redis-maxmemory}"
 
 #    ports:
 #      - "127.0.0.1::6379"
 
     healthcheck:
       test: [ "CMD", "redis-cli", "--raw", "incr", "ping" ]
       interval: 60s
 
     volumes:
       - ./config/redis/redis.conf:/etc/redis/redis.conf:ro
       - logvolume:/var/log/rhodecode
       - redis_data:/data
 
     profiles:
       ["redis"]
 
     logging:
       *custom-logging
 
   database:
     networks:
       - rhodecode_network
     image: library/postgres:14.6
 
     environment:
       POSTGRES_DB: ${DB_NAME:?must-specify-db-name}
       POSTGRES_USER: ${DB_USER:?must-specify-db-user}
       PGUSER: ${DB_USER:?must-specify-db-user}
       POSTGRES_PASSWORD: ${DB_PASSWORD:?must-specify-db-password}
       POSTGRES_HOST_AUTH_METHOD: md5
       POSTGRES_INITDB_ARGS: "--auth-host=md5 --auth-local=md5"
     env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
 
     restart: always
     command:
       - "postgres"
       - "-c"
       - "log_statement=ddl"
       - "-c"
       - "config_file=/etc/conf.d/pg_customized.conf"
 
 #    ports:
 #      - "127.0.0.1::5432"
 
     healthcheck:
       test: ["CMD-SHELL", "pg_isready", '-U', "$DB_USER"]
       interval: 10s
       timeout: 5s
       retries: 5
 
     volumes:
       - $PWD/config/database/pg_customized.conf:/etc/conf.d/pg_customized.conf:ro
       # db dumps reverse mount
       - $PWD/.custom/db_dump:/var/rc-data-dump
       # save the pg_data volume
       - pg_data:/var/lib/postgresql/data
       - logvolume:/var/log/rhodecode
 
     profiles:
       ["postgres"]
 
     logging:
       *custom-logging
 
   database-mysql:
       networks:
         - rhodecode_network
       image: library/mysql:8.0.31
 
       environment:
         MYSQL_DATABASE: ${DB_NAME:?must-specify-db-name}
         MYSQL_USER: ${DB_USER:?must-specify-db-user}
         MYSQL_PASSWORD: ${DB_PASSWORD:?must-specify-db-password}
         MYSQL_ROOT_PASSWORD: ${DB_PASSWORD:?must-specify-db-password}
       env_file:
         - ${RC_ENV_FILE:?must-specify-rc-env-file}
 
       restart: always
 
 #      ports:
 #        - "127.0.0.1::3306"
 
       volumes:
         - ./config/database/mysql_customized.conf:/etc/mysql/conf.d/config-file.cnf:ro
         # save the mysql_data volume
         - $PWD/mysql_dir:/var/lib/mysql
         - logvolume:/var/log/rhodecode
 
       profiles:
         ["mysql"]
 
       logging:
         *custom-logging

templates/docker-compose-apps.override.yaml

@@ -1,33 +1,42 b''
 version: '3.9'
 
 services:
 
   rhodecode:
-    ports:
-      - "10020:10020"
+    #ports:
+    #  # expose port for optional direct port connection
+    #  - "10020:10020"
     environment:
       DB_UPGRADE: 0  # run the DB upgrade
       SETUP_APP: 0   # run the application default settings setup, can be turned off after initial run
 
+    #healthcheck:
+    #  # disable the healthcheck
+    #  test: ['CMD','true']
+
     deploy:
       replicas: 1
 
   vcsserver:
 
     environment:
       {}
 
     deploy:
       replicas: 1
 
+    #healthcheck:
+    #  # disable the healthcheck
+    #  test: ['CMD','true']
+
   sshd:
     {}
 
   svn:
     {}
 
   celery-beat:
     {}
 
   celery:
     {}