release of new installer/docker stack updates

Tons of changes to move towards new rccontrol docker stack based installer

.dockerignore

@@ -0,0 +1,4 b''
+.git/*
+
+#.source/*
+#.cache/*
  No newline at end of file

config/grafana/grafana.ini

@@ -0,0 +1,19 b''
+[security]
+admin_user=admin
+admin_password=admin
+
+[users]
+allow_sign_up=false
+
+[smtp]
+enabled=true
+host=
+user=
+password=
+from_address=[e-mail]
+from_name=[Grafana] Alerting
+
+# subpath /_grafana
+[server]
+serve_from_sub_path=true
+root_url=%(protocol)s://%(domain)s:%(http_port)s/_grafana/

config/traefik/certs/README.md

@@ -0,0 +1,3 b''
+Store your certificate files here.
+your-domain.crt
+your-domain.key
  No newline at end of file

config/traefik/traefik.yaml

@@ -0,0 +1,42 b''
+## Static configuration, needs traefik reload
+
+entryPoints:
+  http:
+    address: ":80"
+
+  https:
+    address: ":443"
+
+#  ssh:
+#    address: ":${RC_SSH_PORT:?must-specify-ssh-port}"
+
+  traefik:
+    address: ":7000"
+
+api:
+  dashboard: false
+  insecure: false # change to true to expose dashboard
+
+accessLog: {}
+
+log:
+  # DEBUG / INFO
+  level: INFO
+
+metrics:
+  prometheus: {}
+
+
+providers:
+  docker:
+    exposedByDefault: false
+    swarmMode: false
+
+  file:
+    filename: "/etc/traefik/traefik_dynamic.yaml"
+    watch: true
+
+
+serversTransport:
+  #this disables SSL certificate verification for legacy own cert services like NextCloud etc
+  insecureSkipVerify: true

config/traefik/traefik_dynamic.yaml

@@ -0,0 +1,24 b''
+
+## Setting up the middleware for redirect to https ##
+http:
+
+  middlewares:
+
+    https-redirect:
+      redirectScheme:
+        scheme: https
+        # permanent: true
+
+    middlewares-rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+
+# Dynamic configuration for standard file based SSL cert
+# create a custom copy of the traefik into .custom/ and remount this
+# to enable custom certificates
+#tls:
+#  certificates:
+#    # first certificate
+#    - certFile: /etc/traefik/certs/rhodecode-com.cert
+#      keyFile: /etc/traefik/certs/rhodecode-com.key

docker-compose-apps.yaml

@@ -0,0 +1,312 b''
+version: '3.9'
+
+x-logging: &custom-logging
+  # docker plugin install grafana/loki-docker-driver:latest --alias loki --grant-all-permissions
+  # NOTE: loki logging driver ONLY works for host type networks...
+  driver: loki
+  options:
+    loki-url: "http://127.0.0.1:3100/loki/api/v1/push"
+    #loki-url: "http://loki:3100/loki/api/v1/push"
+    loki-retries: "5"
+    loki-timeout: "1s"
+    loki-max-backoff: "800ms"
+
+volumes:
+
+  # volume for RhodeCode repo-store, it's where the repositories will be stored
+  rhodecode_repos:
+    labels:
+      "keep": 1
+
+
+services:
+
+  rhodecode:
+    networks:
+      - rhodecode_network
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}
+    env_file:
+      - .custom/.runtime.env
+    stdin_open: true
+    tty: true
+    restart: always
+    command: [
+      "/usr/local/bin/rhodecode_bin/bin/gunicorn",
+      "--name=gunicorn-rhodecode-1",
+      "--error-logfile=-",
+      "--paster=/etc/rhodecode/conf/rhodecode.optimized.ini",
+      "--config=/etc/rhodecode/conf/gunicorn_conf.py"
+    ]
+
+#    ports:
+#      - "127.0.0.1::10020"
+
+    build:
+      context: .
+      dockerfile: service/rhodecode/rhodecode.dockerfile
+      args:
+        TZ: ${TZ}
+        RHODECODE_VERSION: ${RC_VERSION:?specify-RC_VERSION-env-var}
+        RHODECODE_DB: postgresql://rhodecode:${DB_PASSWORD:?must-specify-db-password}@database/${DB_NAME:?must-specify-db-name}
+        RHODECODE_USER_NAME: ${RHODECODE_USER_NAME}
+        RHODECODE_USER_PASS: ${RHODECODE_USER_PASS}
+        RHODECODE_USER_EMAIL: ${RHODECODE_USER_EMAIL}
+
+    environment:
+      RC_APP_TYPE: rhodecode_http
+      RC_APP_PROC: 1
+      SSL_CERT_FILE: "/etc/rhodecode/conf/ca-bundle.crt"
+      REQUESTS_CA_BUNDLE: "/etc/rhodecode/conf/ca-bundle.crt"
+      GIT_SSL_CAINFO: "/etc/rhodecode/conf/ca-bundle.crt"
+      GEVENT_RESOLVER: "ares"
+
+      DB_UPGRADE: 1  # run the DB upgrade
+      SETUP_APP: 1 # run the application default settings setup, can be turned off after initial run
+      #FORCE_DB_INIT_FILE: 1 # force the database init, warning: destroys old DB
+      #FORCE_RC_SETUP_APP: 1 # force running setup scripts for configuration/license application
+      MAIN_INI_PATH: /etc/rhodecode/conf/rhodecode.optimized.ini
+
+      # SVN Specific
+      MOD_DAV_SVN_PORT: 8090
+      APACHE_LOG_DIR: /var/log/rhodecode/svn
+      MOD_DAV_SVN_CONF_FILE: /etc/rhodecode/conf/svn/mod_dav_svn.conf
+
+    healthcheck:
+      test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://127.0.0.1:10020/_admin/ops/ping" ]
+      timeout: 30s
+      interval: 60s
+      retries: 10
+
+#    depends_on:
+#      - database
+#      - redis
+#      - channelstream
+
+    volumes:
+      - confvolume:/etc/rhodecode/conf
+      - logvolume:/var/log/rhodecode
+      - rhodecode_repos:/var/opt/rhodecode_repo_store
+      - rc_datavolume:/var/opt/rhodecode_data
+
+    tmpfs:
+      - /data_ramdisk:size=${RC_DATA_RAMDISK_SIZE:?specify-RC_DATA_RAMDISK_SIZE-env-var}
+
+    logging:
+      *custom-logging
+
+    labels:
+      - "traefik.enable=false"
+
+  vcsserver:
+    networks:
+      - rhodecode_network
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}
+    env_file:
+      - .custom/.runtime.env
+    stdin_open: true
+    tty: true
+    restart: always
+    command: [
+       "/home/rhodecode/.rccontrol/vcsserver-1/profile/bin/gunicorn",
+       "--name=gunicorn-vcsserver-1",
+       "--error-logfile=-",
+       "--paster=/etc/rhodecode/conf/vcsserver.optimized.ini",
+       "--config=/etc/rhodecode/conf/gunicorn_conf_vcs.py"
+    ]
+
+#    ports:
+#      - "127.0.0.1::10010"
+
+    healthcheck:
+      test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://127.0.0.1:10010/status" ]
+      timeout: 30s
+      interval: 60s
+      retries: 10
+
+    environment:
+      RC_APP_TYPE: rhodecode_vcsserver
+      RC_APP_PROC: 1
+      MAIN_INI_PATH: /etc/rhodecode/conf/vcsserver.optimized.ini
+      SSL_CERT_FILE: "/etc/rhodecode/conf/ca-bundle.crt"
+      REQUESTS_CA_BUNDLE: "/etc/rhodecode/conf/ca-bundle.crt"
+      GIT_SSL_CAINFO: "/etc/rhodecode/conf/ca-bundle.crt"
+
+#    depends_on:
+#      - redis
+
+    volumes:
+      - confvolume:/etc/rhodecode/conf
+      - logvolume:/var/log/rhodecode
+      - rhodecode_repos:/var/opt/rhodecode_repo_store
+      - rc_datavolume:/var/opt/rhodecode_data
+
+    logging:
+      *custom-logging
+
+  celery:
+    networks:
+      - rhodecode_network
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}
+    env_file:
+      - .custom/.runtime.env
+    stdin_open: true
+    tty: true
+    restart: always
+    command: [
+        "/usr/local/bin/rhodecode_bin/bin/celery",
+        "worker",
+        "--task-events",
+        "--autoscale=10,2",
+        "--no-color",
+        "--app=rhodecode.lib.celerylib.loader",
+        "--loglevel=DEBUG",
+        "--ini=/etc/rhodecode/conf/rhodecode.optimized.ini"
+    ]
+
+    environment:
+      RC_APP_TYPE: rhodecode_celery
+      RC_APP_PROC: 1
+      MAIN_INI_PATH: /etc/rhodecode/conf/rhodecode.optimized.ini
+      SSL_CERT_FILE: "/etc/rhodecode/conf/ca-bundle.crt"
+      REQUESTS_CA_BUNDLE: "/etc/rhodecode/conf/ca-bundle.crt"
+      GIT_SSL_CAINFO: "/etc/rhodecode/conf/ca-bundle.crt"
+
+#    depends_on:
+#      - database
+#      - redis
+
+    volumes:
+      - confvolume:/etc/rhodecode/conf
+      - logvolume:/var/log/rhodecode
+      - rhodecode_repos:/var/opt/rhodecode_repo_store
+      - rc_datavolume:/var/opt/rhodecode_data
+
+    logging:
+      *custom-logging
+
+    labels:
+      - "traefik.enable=false"
+
+  celery-beat:
+    # This service is not scalable
+    networks:
+      - rhodecode_network
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}
+    env_file:
+      - .custom/.runtime.env
+    stdin_open: true
+    tty: true
+    restart: always
+    command: [
+      "/usr/local/bin/rhodecode_bin/bin/celery",
+      "beat",
+      "--no-color",
+      "--app=rhodecode.lib.celerylib.loader",
+      "--scheduler=rhodecode.lib.celerylib.scheduler.RcScheduler",
+      "--loglevel=DEBUG",
+      "--ini=/etc/rhodecode/conf/rhodecode.optimized.ini"
+    ]
+
+    environment:
+      RC_APP_TYPE: rhodecode_beat
+      RC_APP_PROC: 1
+      MAIN_INI_PATH: /etc/rhodecode/conf/rhodecode.optimized.ini
+      SSL_CERT_FILE: "/etc/rhodecode/conf/ca-bundle.crt"
+      REQUESTS_CA_BUNDLE: "/etc/rhodecode/conf/ca-bundle.crt"
+      GIT_SSL_CAINFO: "/etc/rhodecode/conf/ca-bundle.crt"
+
+#    depends_on:
+#      - database
+#      - redis
+
+    volumes:
+      - confvolume:/etc/rhodecode/conf
+      - logvolume:/var/log/rhodecode
+      - rhodecode_repos:/var/opt/rhodecode_repo_store
+      - rc_datavolume:/var/opt/rhodecode_data
+
+    logging:
+      *custom-logging
+
+    labels:
+      - "traefik.enable=false"
+
+  svn:
+    networks:
+      - rhodecode_network
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}
+    env_file:
+      - .custom/.runtime.env
+
+#    build:
+#      context: .
+#      dockerfile: service/svn/rhodecode_svn.dockerfile
+#      args:
+#        APACHE_VER: 1.3
+
+    stdin_open: true
+    tty: true
+    restart: always
+    command: ["apachectl", "-D", "FOREGROUND"]
+
+    environment:
+      RC_APP_TYPE: rhodecode_svn
+
+      # SVN Specific
+      MOD_DAV_SVN_PORT: 8090
+      APACHE_LOG_DIR: /var/log/rhodecode/svn
+      MOD_DAV_SVN_CONF_FILE: /etc/rhodecode/conf/svn/mod_dav_svn.conf
+
+#    ports:
+#      - "127.0.0.1::8090"
+
+    healthcheck:
+      test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://127.0.0.1:8090/_server_status" ]
+      timeout: 30s
+      interval: 60s
+      retries: 10
+
+    volumes:
+      - confvolume:/etc/rhodecode/conf
+      - logvolume:/var/log/rhodecode
+      - rhodecode_repos:/var/opt/rhodecode_repo_store
+
+    logging:
+      *custom-logging
+
+  sshd:
+    networks:
+      - rhodecode_network
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}
+    env_file:
+      - .custom/.runtime.env
+
+    stdin_open: true
+    tty: true
+    restart: always
+    command: ["/usr/sbin/sshd", "-f", "/etc/rhodecode/sshd_config", "-D", "-e"]
+
+    environment:
+      RC_APP_TYPE: rhodecode_sshd
+      SSH_BOOTSTRAP: 1
+
+#    ports:
+#      # set from .env file
+#      - "${RC_SSH_PORT:?must-specify-ssh-port}:22"
+
+    volumes:
+      - confvolume:/etc/rhodecode/conf
+      - logvolume:/var/log/rhodecode
+      - rhodecode_repos:/var/opt/rhodecode_repo_store
+      - rc_datavolume:/var/opt/rhodecode_data
+
+    logging:
+      *custom-logging
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.sshd.entrypoints=ssh"
+      - "traefik.http.routers.sshd.rule=Host(`*`)"
+      - "traefik.http.services.sshd.loadbalancer.server.port=${RC_SSH_PORT:?must-specify-ssh-port}"
+
+

docker-compose-base.yaml

@@ -0,0 +1,46 b''
+version: '3.9'
+
+## Shared base stuff for all compose files in stack
+
+x-logging: &custom-logging
+  # docker plugin install grafana/loki-docker-driver:latest --alias loki --grant-all-permissions
+  # NOTE: loki logging driver ONLY works for host type networks...
+  driver: loki
+  options:
+    loki-url: "http://127.0.0.1:3100/loki/api/v1/push"
+    #loki-url: "http://loki:3100/loki/api/v1/push"
+    loki-retries: "5"
+    loki-timeout: "1s"
+    loki-max-backoff: "800ms"
+
+volumes:
+  # shared logvolume
+  logvolume:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: $PWD/logs
+
+  # bind-mount with configs
+  confvolume:
+    driver: local
+    driver_opts:
+     type: none
+     o: bind
+     device: $PWD/config/_shared
+
+  # SHARED volume for rhodecode caches, archive caches, nginx static,
+  # must be run via: docker volume create --name=rc_datavolume
+  rc_datavolume:
+    external: true
+
+networks:
+
+  # SHARED network for all containers
+  # must be run via: docker network create --name=rhodecode_network
+  rhodecode_network:
+    name: rhodecode_network
+    driver: bridge
+    external: true
+

docker-compose-router.yaml

@@ -0,0 +1,78 b''
+version: '3.9'
+
+x-logging: &custom-logging
+  # docker plugin install grafana/loki-docker-driver:latest --alias loki --grant-all-permissions
+  # NOTE: loki logging driver ONLY works for host type networks...
+  driver: loki
+  options:
+    loki-url: "http://127.0.0.1:3100/loki/api/v1/push"
+    #loki-url: "http://loki:3100/loki/api/v1/push"
+    loki-retries: "5"
+    loki-timeout: "1s"
+    loki-max-backoff: "800ms"
+
+## docker network create -d overlay lb-net
+services:
+
+  traefik:
+
+    image: traefik:v2.9.5
+
+    ports:
+      # The HTTP port, exposed as http entrypoint
+      - "80:80"
+      # The HTTPS port, exposed as https entrypoint
+      - "443:443"
+      # The SSH port
+      - "${RC_SSH_PORT}:${RC_SSH_PORT}"
+      # The Web UI (enabled by --api.insecure=true)
+      # uncomment to expose dashboard at port :7000
+      #- "7000:7000"
+    volumes:
+      # So that Traefik can listen to the Docker events
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./config/traefik:/etc/traefik
+    deploy:
+      placement:
+        constraints:
+          # limit swarm deploy to MANAGER only
+          - node.role == manager
+    networks:
+      - rhodecode_network
+
+    labels:
+      - "traefik.enable=true"
+
+    logging:
+      *custom-logging
+
+  portainer:
+    # Run with COMPOSE_PROFILES=portainer
+    # to access portainer set HEADER `X-Docker-Host=portainer`
+    image: portainer/portainer-ce:latest
+    restart: always
+    volumes:
+      - portainer_data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          # limit swarm deploy to MANAGER only
+          - node.role == manager
+
+    networks:
+      - rhodecode_network
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
+      - "traefik.http.routers.portainer.entrypoints=https"
+      - "traefik.http.routers.portainer.rule=Headers(`X-Docker-Host`, `portainer`)"
+
+    profiles:
+      ["portainer"]
+
+volumes:
+  portainer_data:
+    external: true
  No newline at end of file

docker-compose-services.yaml

@@ -0,0 +1,240 b''
+version: '3.9'
+
+x-logging: &custom-logging
+  # docker plugin install grafana/loki-docker-driver:latest --alias loki --grant-all-permissions
+  # NOTE: loki logging driver ONLY works for host type networks...
+  driver: loki
+  options:
+    loki-url: "http://127.0.0.1:3100/loki/api/v1/push"
+    #loki-url: "http://loki:3100/loki/api/v1/push"
+    loki-retries: "5"
+    loki-timeout: "1s"
+    loki-max-backoff: "800ms"
+
+volumes:
+
+  # volume for redis data store
+  redis_data:
+    labels:
+      "keep": 1
+
+   # volume for Postgres db store
+
+  # volume for Postgres Data
+  pg_data:
+    labels:
+      "keep": 1
+
+  # volume for rhodecode elasticsearch
+  es_data:
+    labels:
+      "keep": 1
+
+
+services:
+
+  channelstream:
+    networks:
+      - rhodecode_network
+    image: channelstream/channelstream:0.7.1
+
+    restart: always
+
+#    ports:
+#      - "127.0.0.1:9800:9800"
+
+    command: ["channelstream", "-i", "/etc/rhodecode/conf/channelstream.ini"]
+
+    environment:
+      CHANNELSTREAM_ALLOW_POSTING_FROM: 0.0.0.0
+
+    healthcheck:
+        test: [ "CMD", "curl", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://channelstream:8000/admin/sign_in" ]
+        timeout: 5s
+        interval: 60s
+        retries: 10
+
+    volumes:
+      - confvolume:/etc/rhodecode/conf
+      - logvolume:/var/log/rhodecode
+
+    logging:
+      *custom-logging
+
+    labels:
+      - "traefik.enable=false"
+      #- "traefik.http.routers.channelstream.entrypoints=http"
+      #- "traefik.http.services.channelstream.loadbalancer.server.port=9800"
+
+    profiles:
+      ["channelstream"]
+
+  nginx:
+    networks:
+      - rhodecode_network
+    image: library/nginx:1.23.2
+
+    restart: always
+
+    environment:
+      NGINX_ENTRYPOINT_QUIET_LOGS: 1
+
+    healthcheck:
+      # change port 80 to 443 when only using SSL
+      test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "http://127.0.0.1:80/_admin/ops/ping" ]
+      timeout: 30s
+      interval: 60s
+      retries: 10
+
+#    depends_on:
+#      - channelstream
+
+    volumes:
+      - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./config/nginx/http.conf:/etc/nginx/http.conf:ro
+      - ./config/nginx/proxy.conf:/etc/nginx/proxy.conf:ro
+      - logvolume:/var/log/rhodecode
+      - rc_datavolume:/var/opt/rhodecode_data
+
+    logging:
+      *custom-logging
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.nginx.entrypoints=http"
+      - "traefik.http.services.nginx.loadbalancer.server.port=80"
+      - "traefik.http.routers.nginx.rule=Host(`${RHODECODE_HOSTNAME:?must-specify-rhodecode-hostname}`)"
+
+  elasticsearch:
+    networks:
+      - rhodecode_network
+    image: elasticsearch:6.8.23
+
+    environment:
+      - cluster.name=elasticsearch-cluster
+      - network.host=0.0.0.0
+      - bootstrap.memory_lock=true
+      - discovery.type=single-node
+      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+    healthcheck:
+      # change port 80 to 443 when only using SSL
+      test: [ "CMD", "curl", "-A", "RhodeCode-Healthcheck", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", "elasticsearch:9200/_cat/health" ]
+      timeout: 30s
+      interval: 60s
+      retries: 10
+
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+
+    volumes:
+      - es_data:/usr/share/elasticsearch/data
+
+    logging:
+      *custom-logging
+
+    profiles:
+      ["elasticsearch"]
+
+  redis:
+    networks:
+      - rhodecode_network
+    image: library/redis:7.0.5
+
+    restart: always
+    command:
+      - "redis-server"
+      - "/etc/redis/redis.conf"
+      - "--maxmemory-policy allkeys-lru"
+      - "--maxmemory ${RC_REDIS_MAXMEMORY}"
+
+#    ports:
+#      - "127.0.0.1::6379"
+
+    healthcheck:
+      test: [ "CMD", "redis-cli", "--raw", "incr", "ping" ]
+      interval: 60s
+
+    volumes:
+      - ./config/redis/redis.conf:/etc/redis/redis.conf:ro
+      - logvolume:/var/log/rhodecode
+      - redis_data:/data
+
+    profiles:
+      ["redis"]
+
+    logging:
+      *custom-logging
+
+  database:
+    networks:
+      - rhodecode_network
+    image: library/postgres:14.6
+
+    environment:
+      POSTGRES_DB: ${DB_NAME:?must-specify-db-name}
+      POSTGRES_USER: ${DB_USER:?must-specify-db-user}
+      PGUSER: ${DB_USER:?must-specify-db-user}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:?must-specify-db-password}
+      POSTGRES_HOST_AUTH_METHOD: md5
+      POSTGRES_INITDB_ARGS: "--auth-host=md5 --auth-local=md5"
+
+    restart: unless-stopped
+    command:
+      - "postgres"
+      - "-c"
+      - "log_statement=ddl"
+      - "-c"
+      - "config_file=/etc/conf.d/pg_customized.conf"
+
+#    ports:
+#      - "127.0.0.1::5432"
+
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready", '-U', "$DB_USER"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+    volumes:
+      - $PWD/config/database/pg_customized.conf:/etc/conf.d/pg_customized.conf:ro
+      # db dumps reverse mount
+      - $PWD/.custom/db_dump:/var/rc-data-dump
+      # save the pg_data volume
+      - pg_data:/var/lib/postgresql/data
+      - logvolume:/var/log/rhodecode
+
+    profiles:
+      ["postgres"]
+
+    logging:
+      *custom-logging
+
+  database-mysql:
+      networks:
+        - rhodecode_network
+      image: library/mysql:8.0.31
+
+      environment:
+        MYSQL_DATABASE: ${DB_NAME:?must-specify-db-name}
+        MYSQL_USER: ${DB_USER:?must-specify-db-user}
+        MYSQL_PASSWORD: ${DB_PASSWORD:?must-specify-db-password}
+        MYSQL_ROOT_PASSWORD: ${DB_PASSWORD:?must-specify-db-password}
+
+      restart: unless-stopped
+
+#      ports:
+#        - "127.0.0.1::3306"
+
+      volumes:
+        - ./config/database/mysql_customized.conf:/etc/mysql/conf.d/config-file.cnf:ro
+        # save the mysql_data volume
+        - $PWD/mysql_dir:/var/lib/mysql
+        - logvolume:/var/log/rhodecode
+
+      profiles:
+        ["mysql"]
+
+      logging:
+        *custom-logging

rccontrol

@@ -0,0 +1,1 b''
+scripts/rccontrol/rccontrol
  No newline at end of file

scripts/rccontrol/rccontrol

@@ -0,0 +1,2889 b''
+#!/usr/bin/env bash
+# This script was generated by bashly 0.8.10 (https://bashly.dannyb.co)
+# Modifying it manually is not recommended
+
+# :wrapper.bash3_bouncer
+if [[ "${BASH_VERSINFO:-0}" -lt 4 ]]; then
+  printf "bash version 4 or higher is required\n" >&2
+  exit 1
+fi
+
+# :command.master_script
+
+# :command.version_command
+version_command() {
+  echo "$version"
+}
+
+# :command.usage
+rccontrol_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol - RhodeCode Control - CLI for manaing RhodeCode Cluster Stack\n"
+    echo
+
+  else
+    printf "rccontrol - RhodeCode Control - CLI for manaing RhodeCode Cluster Stack\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol [OPTIONS] COMMAND\n"
+  printf "  rccontrol [COMMAND] --help | -h\n"
+  printf "  rccontrol --version | -v\n"
+  echo
+  # :command.usage_commands
+  printf "Commands:\n"
+  echo "  self-update           update rccontrol and it's docker definitions"
+  echo "  bootstrap             Bootstrap this machine, check docker version and install rhodecode-network"
+  echo "  stack                 run one of available cluster stacks, use -h for more details"
+  echo "  stack-status          show stack status"
+  echo "  stack-upgrade         upgrade ALL stack status"
+  echo
+  printf "Build Commands:\n"
+  echo "  get-build-artifacts   Fetch Artifacts to run installer based build"
+  echo "  build                 Build RhodeCode image from installer"
+  echo "  get-build-source      Fetch RhodeCode sources, store in .source dir to run a source-based builds"
+  echo "  build-source          Build RhodeCode image from source, requires upgrade-source initially"
+  echo
+  printf "CLI Commands:\n"
+  echo "  cli-redis             CLI"
+  echo "  cli-db                CLI"
+  echo "  cli-db-upgrade        CLI"
+  echo
+  printf "Backup Commands:\n"
+  echo "  backup-db             CLI"
+  echo "  backup-data           CLI"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+    echo "  --version, -v"
+    printf "    Show version number\n"
+    echo
+
+    # :command.usage_flags
+    # :flag.usage
+    echo "  --debug"
+    printf "    Enable debug and detailed output\n"
+    echo
+
+    # :command.usage_environment_variables
+    printf "Environment Variables:\n"
+
+    # :environment_variable.usage
+    echo "  AUTH_TOKEN"
+    printf "    Set your RhodeCode AUTH Token\n"
+    echo
+
+    # :environment_variable.usage
+    echo "  RC_CLI_VERSION_NAME"
+    printf "    default version to build and install\n"
+    printf "    Default: 4.27.0\n"
+    echo
+
+    # :environment_variable.usage
+    echo "  RC_STACK_ROUTER_EXT"
+    printf "\n"
+    printf "    Default: .custom/docker-compose-router.override.yaml\n"
+    echo
+
+    # :environment_variable.usage
+    echo "  RC_STACK_METRICS_EXT"
+    printf "\n"
+    printf "    Default: .custom/docker-compose-metrics.override.yaml\n"
+    echo
+
+    # :environment_variable.usage
+    echo "  RC_STACK_SERVICES_EXT"
+    printf "\n"
+    printf "    Default: .custom/docker-compose-services.override.yaml\n"
+    echo
+
+    # :environment_variable.usage
+    echo "  RC_STACK_RHODECODE_EXT"
+    printf "\n"
+    printf "    Default: .custom/docker-compose-apps.override.yaml\n"
+    echo
+
+    # :command.footer
+    printf "RhodeCode Inc 2022\n\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_self_update_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol self-update - update rccontrol and it's docker definitions\n"
+    echo
+
+  else
+    printf "rccontrol self-update - update rccontrol and it's docker definitions\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol self-update [OPTIONS]\n"
+  printf "  rccontrol self-update --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+    # :command.usage_flags
+    # :flag.usage
+    echo "  --auth-token AUTH_TOKEN"
+    printf "    Optionally specify AUTH TOKEN to obtain sources\n"
+    echo
+
+    # :flag.usage
+    echo "  --server-url SERVER_URL"
+    printf "    Specify RhodeCode server location where projects should be downloaded\n"
+    printf "    Default: https://code.rhodecode.com\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_bootstrap_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol bootstrap - Bootstrap this machine, check docker version and install rhodecode-network\n"
+    echo
+
+  else
+    printf "rccontrol bootstrap - Bootstrap this machine, check docker version and install rhodecode-network\n"
+    echo
+
+  fi
+
+  printf "Alias: install\n"
+  echo
+
+  printf "Usage:\n"
+  printf "  rccontrol bootstrap [OPTIONS]\n"
+  printf "  rccontrol bootstrap --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+    # :command.usage_flags
+    # :flag.usage
+    echo "  --force, -f"
+    printf "    Overwrite existing files\n"
+    echo
+
+    # :flag.usage
+    echo "  --auth-token AUTH_TOKEN"
+    printf "    Optionally specify AUTH TOKEN to obtain sources\n"
+    echo
+
+    # :flag.usage
+    echo "  --server-url SERVER_URL"
+    printf "    Specify RhodeCode server location where projects should be downloaded\n"
+    printf "    Default: https://code.rhodecode.com\n"
+    echo
+
+    # :command.usage_examples
+    printf "Examples:\n"
+    printf "  rccontrol3 bootstrap\n"
+    printf "  rccontrol3 bootstrap --force\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_get_build_artifacts_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol get-build-artifacts - Fetch Artifacts to run installer based build\n"
+    echo
+
+  else
+    printf "rccontrol get-build-artifacts - Fetch Artifacts to run installer based build\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol get-build-artifacts [OPTIONS]\n"
+  printf "  rccontrol get-build-artifacts --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+    # :command.usage_flags
+    # :flag.usage
+    echo "  --auth AUTH"
+    printf "    Specify custom auth for curl e.g -u admin:secret\n"
+    printf "    Default: \n"
+    echo
+
+    # :flag.usage
+    echo "  --installer-url INSTALLER_URL"
+    printf "    Installer Download URL\n"
+    printf "    Default: https://dls.rhodecode.com/dls/N2E2ZTY1NzA3NjYxNDA2NTc1NjI3MTcyNzA2MjcxNzIyZTcwNjI3YQ==/rhodecode-control/latest-linux-ee\n"
+    echo
+
+    # :flag.usage
+    echo "  --manifest-url MANIFEST_URL"
+    printf "    Manifest file url\n"
+    printf "    Default: https://dls.rhodecode.com/linux/MANIFEST\n"
+    echo
+
+    # :flag.usage
+    echo "  --version-name VERSION_NAME"
+    printf "    Specify custom build ver e.g $RC_CLI_VERSION_NAME\n"
+    printf "    Default: $RC_CLI_VERSION_NAME\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_build_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol build - Build RhodeCode image from installer\n"
+    echo
+
+  else
+    printf "rccontrol build - Build RhodeCode image from installer\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol build [OPTIONS]\n"
+  printf "  rccontrol build --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+    # :command.usage_flags
+    # :flag.usage
+    echo "  --version-name VERSION_NAME"
+    printf "    Specify custom build ver e.g $RC_CLI_VERSION_NAME\n"
+    printf "    Default: $RC_CLI_VERSION_NAME\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_get_build_source_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol get-build-source - Fetch RhodeCode sources, store in .source dir to run a source-based builds\n"
+    echo
+
+  else
+    printf "rccontrol get-build-source - Fetch RhodeCode sources, store in .source dir to run a source-based builds\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol get-build-source REVISION [OPTIONS]\n"
+  printf "  rccontrol get-build-source --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+    # :command.usage_flags
+    # :flag.usage
+    echo "  --auth-token AUTH_TOKEN"
+    printf "    Specify AUTH TOKEN to obtain sources\n"
+    echo
+
+    # :flag.usage
+    echo "  --server-url SERVER_URL"
+    printf "    Specify RhodeCode server location where projects should be downloaded\n"
+    printf "    Default: https://code.rhodecode.com\n"
+    echo
+
+    # :command.usage_args
+    printf "Arguments:\n"
+
+    # :argument.usage
+    echo "  REVISION"
+    printf "    revision to download\n"
+    echo
+
+    # :command.usage_examples
+    printf "Examples:\n"
+    printf "  rccontrol3 get-sources $RC_CLI_VERSION_NAME\n"
+    printf "  rccontrol3 get-sources default --auth-token xyxyxyx --server-url\n  https://secret.repo/\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_build_source_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol build-source - Build RhodeCode image from source, requires upgrade-source initially\n"
+    echo
+
+  else
+    printf "rccontrol build-source - Build RhodeCode image from source, requires upgrade-source initially\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol build-source [OPTIONS]\n"
+  printf "  rccontrol build-source --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+    # :command.usage_flags
+    # :flag.usage
+    echo "  --version-name VERSION_NAME"
+    printf "    Specify custom build ver e.g $RC_CLI_VERSION_NAME\n"
+    printf "    Default: $RC_CLI_VERSION_NAME\n"
+    echo
+
+    # :command.usage_examples
+    printf "Examples:\n"
+    printf "  build foo\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_stack_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol stack - run one of available cluster stacks, use -h for more details\n"
+    echo
+
+  else
+    printf "rccontrol stack - run one of available cluster stacks, use -h for more details\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol stack NAME [SERVICES PARAMS...]\n"
+  printf "  rccontrol stack --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+    # :command.usage_args
+    printf "Arguments:\n"
+
+    # :argument.usage
+    echo "  NAME"
+    printf "    Stack name\n"
+    printf "    Allowed: router, metrics, services, rhodecode\n"
+    echo
+
+    echo "  SERVICES PARAMS..."
+    printf "    Additional arguments or flags for services command\n"
+    echo
+
+    # :command.usage_examples
+    printf "Examples:\n"
+    printf "  - ./rccontrol3 stack router up          # run router stack with output to\n  console\n  - ./rccontrol3 stack router up --detach # run router stack detached\n  - ./rccontrol3 stack router down        # stop whole router stack\n  - ./rccontrol3 stack router ps          # check status of router stack\n  - ./rccontrol3 stack router -f docker-overrides.yaml up -d # run router stack\n  with your overrides\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_stack_status_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol stack-status - show stack status\n"
+    echo
+
+  else
+    printf "rccontrol stack-status - show stack status\n"
+    echo
+
+  fi
+
+  printf "Alias: status\n"
+  echo
+
+  printf "Usage:\n"
+  printf "  rccontrol stack-status\n"
+  printf "  rccontrol stack-status --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_stack_upgrade_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol stack-upgrade - upgrade ALL stack status\n"
+    echo
+
+  else
+    printf "rccontrol stack-upgrade - upgrade ALL stack status\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol stack-upgrade\n"
+  printf "  rccontrol stack-upgrade --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_cli_redis_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol cli-redis - CLI\n"
+    echo
+
+  else
+    printf "rccontrol cli-redis - CLI\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol cli-redis\n"
+  printf "  rccontrol cli-redis --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_cli_db_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol cli-db - CLI\n"
+    echo
+
+  else
+    printf "rccontrol cli-db - CLI\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol cli-db\n"
+  printf "  rccontrol cli-db --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_cli_db_upgrade_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol cli-db-upgrade - CLI\n"
+    echo
+
+  else
+    printf "rccontrol cli-db-upgrade - CLI\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol cli-db-upgrade\n"
+  printf "  rccontrol cli-db-upgrade --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol__completions_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol _completions - Generate completions, eval "$(./rccontrol _completions)"\n"
+    echo
+
+  else
+    printf "rccontrol _completions - Generate completions, eval "$(./rccontrol _completions)"\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol _completions\n"
+  printf "  rccontrol _completions --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_backup_db_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol backup-db - CLI\n"
+    echo
+
+  else
+    printf "rccontrol backup-db - CLI\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol backup-db\n"
+  printf "  rccontrol backup-db --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+    # :command.usage_examples
+    printf "Examples:\n"
+    printf "  ./rccontrol backup-db\n"
+    echo
+
+  fi
+}
+
+# :command.usage
+rccontrol_backup_data_usage() {
+  if [[ -n $long_usage ]]; then
+    printf "rccontrol backup-data - CLI\n"
+    echo
+
+  else
+    printf "rccontrol backup-data - CLI\n"
+    echo
+
+  fi
+
+  printf "Usage:\n"
+  printf "  rccontrol backup-data\n"
+  printf "  rccontrol backup-data --help | -h\n"
+  echo
+
+  # :command.long_usage
+  if [[ -n $long_usage ]]; then
+    printf "Options:\n"
+
+    # :command.usage_fixed_flags
+    echo "  --help, -h"
+    printf "    Show this help\n"
+    echo
+
+  fi
+}
+
+# :command.normalize_input
+normalize_input() {
+  local arg flags
+
+  while [[ $# -gt 0 ]]; do
+    arg="$1"
+    if [[ $arg =~ ^(--[a-zA-Z0-9_\-]+)=(.+)$ ]]; then
+      input+=("${BASH_REMATCH[1]}")
+      input+=("${BASH_REMATCH[2]}")
+    elif [[ $arg =~ ^(-[a-zA-Z0-9])=(.+)$ ]]; then
+      input+=("${BASH_REMATCH[1]}")
+      input+=("${BASH_REMATCH[2]}")
+    elif [[ $arg =~ ^-([a-zA-Z0-9][a-zA-Z0-9]+)$ ]]; then
+      flags="${BASH_REMATCH[1]}"
+      for (( i=0 ; i < ${#flags} ; i++ )); do
+        input+=("-${flags:i:1}")
+      done
+    else
+      input+=("$arg")
+    fi
+
+    shift
+  done
+}
+# :command.inspect_args
+inspect_args() {
+  readarray -t sorted_keys < <(printf '%s\n' "${!args[@]}" | sort)
+  if (( ${#args[@]} )); then
+    echo args:
+    for k in "${sorted_keys[@]}"; do echo "- \${args[$k]} = ${args[$k]}"; done
+  else
+    echo args: none
+  fi
+
+  if (( ${#other_args[@]} )); then
+    echo
+    echo other_args:
+    echo "- \${other_args[*]} = ${other_args[*]}"
+    for i in "${!other_args[@]}"; do
+      echo "- \${other_args[$i]} = ${other_args[$i]}"
+    done
+  fi
+}
+
+# :command.user_lib
+# src/lib/colors.sh
+print_in_color() {
+  local color="$1"
+  shift
+  if [[ -z ${NO_COLOR+x} ]]; then
+    printf "$color%b\e[0m\n" "$*";
+  else
+    printf "%b\n" "$*";
+  fi
+}
+
+red() { print_in_color "\e[31m" "$*"; }
+green() { print_in_color "\e[32m" "$*"; }
+yellow() { print_in_color "\e[33m" "$*"; }
+blue() { print_in_color "\e[34m" "$*"; }
+magenta() { print_in_color "\e[35m" "$*"; }
+cyan() { print_in_color "\e[36m" "$*"; }
+bold() { print_in_color "\e[1m" "$*"; }
+underlined() { print_in_color "\e[4m" "$*"; }
+red_bold() { print_in_color "\e[1;31m" "$*"; }
+green_bold() { print_in_color "\e[1;32m" "$*"; }
+yellow_bold() { print_in_color "\e[1;33m" "$*"; }
+blue_bold() { print_in_color "\e[1;34m" "$*"; }
+magenta_bold() { print_in_color "\e[1;35m" "$*"; }
+cyan_bold() { print_in_color "\e[1;36m" "$*"; }
+red_underlined() { print_in_color "\e[4;31m" "$*"; }
+green_underlined() { print_in_color "\e[4;32m" "$*"; }
+yellow_underlined() { print_in_color "\e[4;33m" "$*"; }
+blue_underlined() { print_in_color "\e[4;34m" "$*"; }
+magenta_underlined() { print_in_color "\e[4;35m" "$*"; }
+cyan_underlined() { print_in_color "\e[4;36m" "$*"; }
+
+# src/lib/config.sh
+config_init() {
+  CONFIG_FILE=${CONFIG_FILE:=config.ini}
+  [[ -f "$CONFIG_FILE" ]] || touch "$CONFIG_FILE"
+}
+
+config_get() {
+  local key=$1
+  local regex="^$key *= *(.+)$"
+  local value=""
+
+  config_init
+
+  while IFS= read -r line || [ -n "$line" ]; do
+    if [[ $line =~ $regex ]]; then
+      value="${BASH_REMATCH[1]}"
+      break
+    fi
+  done < "$CONFIG_FILE"
+
+  echo "$value"
+}
+
+config_set() {
+  local key=$1
+  shift
+  local value="$*"
+
+  config_init
+
+  local regex="^($key) *= *.+$"
+  local output=""
+  local found_key=""
+  local newline
+
+  while IFS= read -r line || [ -n "$line" ]; do
+    newline=$line
+    if [[ $line =~ $regex ]]; then
+      found_key="${BASH_REMATCH[1]}"
+      newline="$key = $value"
+      output="$output$newline\n"
+    elif [[ $line ]]; then
+      output="$output$line\n"
+    fi
+  done < "$CONFIG_FILE"
+
+  if [[ -z $found_key ]]; then
+    output="$output$key = $value\n"
+  fi
+
+  printf "%b\n" "$output" > "$CONFIG_FILE"
+}
+
+config_del() {
+  local key=$1
+
+  local regex="^($key) *="
+  local output=""
+
+  config_init
+
+  while IFS= read -r line || [ -n "$line" ]; do
+    if [[ $line ]] && [[ ! $line =~ $regex ]]; then
+      output="$output$line\n"
+    fi
+  done < "$CONFIG_FILE"
+
+  printf "%b\n" "$output" > "$CONFIG_FILE"
+}
+
+config_show() {
+  config_init
+  cat "$CONFIG_FILE"
+}
+
+config_keys() {
+  local regex="^([a-zA-Z0-9_\-\/\.]+) *="
+
+  config_init
+
+  local keys=()
+  local key
+
+  while IFS= read -r line || [ -n "$line" ]; do
+    if [[ $line =~ $regex ]]; then
+      key="${BASH_REMATCH[1]}"
+      keys+=("$key")
+    fi
+  done < "$CONFIG_FILE"
+  echo "${keys[@]}"
+}
+
+config_has_key() {
+  [[ $(config_get "$1") ]]
+}
+
+# src/lib/sample_function.sh
+
+docker_ping_host() {
+  PING_HOST="$1"
+  docker run --network rhodecode_network --rm alpine ping "$PING_HOST"
+}
+
+check_bootstrap() {
+  # Avoid destroying bootstrapping by simple start/stop
+  if [[ ! -e $BOOTSTRAP_FILE ]]; then
+    echo "$(yellow WARNING:) initial bootstrap file $BOOTSTRAP_FILE not found !"
+    echo "$(yellow NOTICE:) Please run ./rccontrol bootstrap first"
+    exit
+  fi
+}
+
+# src/lib/send_completions.sh
+send_completions() {
+  echo $'# rccontrol3 completion                                    -*- shell-script -*-'
+  echo $''
+  echo $'# This bash completions script was generated by'
+  echo $'# completely (https://github.com/dannyben/completely)'
+  echo $'# Modifying it manually is not recommended'
+  echo $''
+  echo $'_rccontrol3_completions_filter() {'
+  echo $'  local words="$1"'
+  echo $'  local cur=${COMP_WORDS[COMP_CWORD]}'
+  echo $'  local result=()'
+  echo $''
+  echo $'  if [[ "${cur:0:1}" == "-" ]]; then'
+  echo $'    echo "$words"'
+  echo $'  '
+  echo $'  else'
+  echo $'    for word in $words; do'
+  echo $'      [[ "${word:0:1}" != "-" ]] && result+=("$word")'
+  echo $'    done'
+  echo $''
+  echo $'    echo "${result[*]}"'
+  echo $''
+  echo $'  fi'
+  echo $'}'
+  echo $''
+  echo $'_rccontrol3_completions() {'
+  echo $'  local cur=${COMP_WORDS[COMP_CWORD]}'
+  echo $'  local compwords=("${COMP_WORDS[@]:1:$COMP_CWORD-1}")'
+  echo $'  local compline="${compwords[*]}"'
+  echo $''
+  echo $'  case "$compline" in'
+  echo $'    \'upgrade-source\'*)'
+  echo $'      while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_rccontrol3_completions_filter "--auth-token --help --server-url -h")" -- "$cur" )'
+  echo $'      ;;'
+  echo $''
+  echo $'    \'build-source\'*)'
+  echo $'      while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_rccontrol3_completions_filter "--help --version-name -h")" -- "$cur" )'
+  echo $'      ;;'
+  echo $''
+  echo $'    \'self-update\'*)'
+  echo $'      while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_rccontrol3_completions_filter "--auth-token --help --server-url -h")" -- "$cur" )'
+  echo $'      ;;'
+  echo $''
+  echo $'    \'bootstrap\'*)'
+  echo $'      while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_rccontrol3_completions_filter "--auth-token --force --help --server-url -f -h")" -- "$cur" )'
+  echo $'      ;;'
+  echo $''
+  echo $'    \'build\'*)'
+  echo $'      while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_rccontrol3_completions_filter "--help --version-name -h")" -- "$cur" )'
+  echo $'      ;;'
+  echo $''
+  echo $'    \'stack\'*)'
+  echo $'      while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_rccontrol3_completions_filter "--help -h metrics rhodecode router services")" -- "$cur" )'
+  echo $'      ;;'
+  echo $''
+  echo $'    *)'
+  echo $'      while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_rccontrol3_completions_filter "--help --version -h -v bootstrap build build-source self-update stack upgrade-source")" -- "$cur" )'
+  echo $'      ;;'
+  echo $''
+  echo $'  esac'
+  echo $'} &&'
+  echo $'complete -F _rccontrol3_completions rccontrol3'
+  echo $''
+  echo $'# ex: filetype=sh'
+}
+
+# src/lib/validate_stack_exists.sh
+
+validate_stack_exists() {
+  err=""
+  invalid="1"
+
+  for item in $VALID_SERVICES
+  do
+      if [ "$1" == "$item" ]; then
+          invalid=""
+          break
+      fi
+  done
+
+  if [[ -n $invalid ]]; then
+    err="command '$1' not in list of $VALID_SERVICES"
+  fi
+
+  echo $err
+}
+
+# :command.command_functions
+# :command.function
+rccontrol_self_update_command() {
+  # src/self_update_command.sh
+  check_bootstrap
+
+  echo "# this file is located in 'src/self_update_command.sh'"
+  echo "# code for 'rccontrol3 self-update' goes here"
+  echo "# you can edit it freely and regenerate (it will not be overwritten)"
+  inspect_args
+
+}
+
+# :command.function
+rccontrol_bootstrap_command() {
+  # src/bootstrap_command.sh
+  DEBUG=${args[--debug]}
+  force=${args[--force]}
+
+  check_bash_version() {
+
+     if [ ! "${BASH_VERSINFO:-0}" -ge 4 ]; then
+        echo "$(red Bash version 4 or greater is required, please update your bash version!)"
+        exit
+     fi
+  }
+
+  check_docker() {
+    (which docker || which docker.io) &>/dev/null
+  }
+
+  check_and_install_docker() {
+    failMsg="Failed to find docker on your PATH"
+
+    if ! check_docker; then
+      echo "$failMsg"
+      read -p "Enter to install Docker directly from https://get.docker.com/ or Ctrl+C to exit"
+      curl https://get.docker.com/ | sh
+
+      if ! check_docker; then
+        echo "$failMsg"
+        echo "Docker install failed. Quitting."
+        exit
+      fi
+    fi
+  }
+
+  docker_bootstrap() {
+    check_and_install_docker
+    echo 'Docker: Running bootstrap.'
+
+    echo "Docker: creating network 'rc_datavolume'"
+    docker volume create --name=rc_datavolume
+    echo "Docker: done"
+    echo ""
+
+    echo "Docker: creating network 'rhodecode_network'"
+    docker network inspect rhodecode_network >/dev/null 2>&1 || docker network create rhodecode_network
+    echo "Docker: done"
+    echo ""
+
+    echo "Docker: creating loki logging"
+    loki_driver=$(docker plugin ls --format {{.Name}} --filter enabled=true | grep loki || echo "")
+    if [[ $loki_driver == "" ]]; then
+      docker plugin install grafana/loki-docker-driver:latest --alias loki --grant-all-permissions
+    else
+      echo "Docker: loki driver already exists"
+    fi
+  }
+
+  definitions_bootstrap() {
+
+    SOURCE_DIR=$PWD
+    RHODECODE_DOCKER_HASH='master'
+
+    AUTH_TOKEN=${args[--auth-token]}
+    SERVER_URL=${args[--server-url]}
+
+    DEFINITIONS_EXIST=""
+    CHECK_FILES="rccontrol .env docker-compose-services.yaml docker-compose-apps.yaml"
+    for check_file in $CHECK_FILES; do
+      if [[ -f "$check_file" ]]; then
+        DEFINITIONS_EXIST="1"
+      fi
+    done
+
+    if [[ -n $DEFINITIONS_EXIST && ! $force ]]; then
+        echo "$(yellow skipping docker defs creation, existing files found. Use --force to create them anyway)"
+        return
+    fi
+
+    if [[ -n $DEFINITIONS_EXIST ]]; then
+        echo "$(yellow docker definitions exists, are you sure to force re-create them?)"
+        while true; do
+          read -p "Would you like to continue with overriding file? [yn] " yn
+          case $yn in
+            [Yy]*) return 2 ;;
+            [Nn]*) exit ;;
+            *) echo "Please answer y or n." ;;
+          esac
+        done
+    fi
+
+    exit
+
+    # download sources
+    echo "Files: download rhodecode docker definitions from $SERVER_URL"
+    echo ""
+
+    if [ $DEBUG ]; then
+      echo "downloading: $SERVER_URL/rhodecode-enterprise-docker/archive/$RHODECODE_DOCKER_HASH.tgz?with_hash=0"
+      curl --header "X-Rc-Auth-Token: $AUTH_TOKEN" -L $SERVER_URL/rhodecode-enterprise-docker/archive/$RHODECODE_DOCKER_HASH.tgz?with_hash=0 | tar -xz -C $SOURCE_DIR
+
+      echo "running CP $SOURCE_DIR/*rhodecode-enterprise-docker-plain/* $SOURCE_DIR"
+      cp -v -r -f --update --backup=numbered $SOURCE_DIR/*rhodecode-enterprise-docker-plain/* $SOURCE_DIR
+
+      echo "removing $SOURCE_DIR/*rhodecode-enterprise-docker-plain"
+      rm -r $SOURCE_DIR/*rhodecode-enterprise-docker-plain
+    else
+      curl -s --header "X-Rc-Auth-Token: $AUTH_TOKEN" -L $SERVER_URL/rhodecode-enterprise-docker/archive/$RHODECODE_DOCKER_HASH.tgz?with_hash=0 | tar -xz -C $SOURCE_DIR
+
+      cp -r -f --update --backup=numbered $SOURCE_DIR/*rhodecode-enterprise-docker-plain/* $SOURCE_DIR
+
+      rm -r $SOURCE_DIR/*rhodecode-enterprise-docker-plain
+    fi
+
+    echo "$(green_bold DONE: docker definitions extracted to $SOURCE_DIR)"
+  }
+
+  config_bootstrap() {
+
+    if [[ ! -f "$CONFIG_FILE" ]]; then
+      echo "init config at: $CONFIG_FILE"
+      config_init
+    else
+      echo "re-using config at: $CONFIG_FILE"
+    fi
+
+    if ! config_has_key "rc_encrypted_secret" ; then
+     key=$(echo $RANDOM | md5sum | head -c 32)
+     config_set "rc_encrypted_secret" $key
+    fi
+
+    if ! config_has_key "rc_db_url" ; then
+     key=$(echo $RANDOM | md5sum | head -c 32)
+     config_set "rc_db_url" "postgresql://$DB_USER:$key@database/$DB_NAME"
+    fi
+
+    if ! config_has_key "rc_license_token" ; then
+     config_set "rc_license_token" abra-cada-bra1-rce4
+    fi
+
+    if ! config_has_key "rc_base_url" ; then
+     config_set "rc_base_url" http://docker-dev
+    fi
+
+    if ! config_has_key "rc_log_formatter" ; then
+     # json is another option
+     config_set "rc_log_formatter" generic
+    fi
+
+    if ! config_has_key "rc_use_celery" ; then
+     config_set "rc_use_celery" true
+    fi
+
+    BOOTSTRAP_RUNTIME_ENV=$PWD/.custom/.runtime.env
+    if [[ ! -f "$BOOTSTRAP_RUNTIME_ENV" ]]; then
+      echo "init runtime env config at: $BOOTSTRAP_RUNTIME_ENV"
+      touch BOOTSTRAP_RUNTIME_ENV
+
+      #ENV_EXPAND=""
+      for k in $(config_keys); do
+        k_upper=${k^^}
+        echo "$k_upper='$(config_get "$k")'" >> $BOOTSTRAP_RUNTIME_ENV
+      done
+
+    fi
+  }
+
+  cur_date=$(date '+%Y-%m-%d %H:%M:%S')
+
+  check_bash_version
+
+  if [[ ! -e $BOOTSTRAP_FILE ]]; then
+    echo "initial bootstrap file $BOOTSTRAP_FILE not found !"
+
+    docker_bootstrap
+    definitions_bootstrap
+    config_bootstrap
+
+    echo "$cur_date" > "$BOOTSTRAP_FILE"
+
+  else
+    if [ $force ]; then
+
+      docker_bootstrap $force
+      definitions_bootstrap $force ## TODO: remove old
+      config_bootstrap $force
+
+      echo "$cur_date" > "$BOOTSTRAP_FILE"
+
+      exit
+    fi
+
+    echo "bootstrap file $BOOTSTRAP_FILE was found add --force to force bootstrap"
+  fi
+
+  get_started
+}
+
+# :command.function
+rccontrol_get_build_artifacts_command() {
+  # src/get_build_artifacts_command.sh
+  check_bootstrap
+
+  DEBUG=${args[--debug]}
+  AUTH=${args[--auth]}
+  INSTALLER_URL=${args[--installer-url]}
+  MANIFEST_URL=${args[--manifest-url]}
+  RC_VERSION=${args[--version-name]}
+  VER=$RC_VERSION
+
+  CACHE_DIR=$PWD/.cache
+  VER_REGEX="$VER+x86_64"
+
+  echo "Downloading Artifacts for version: $VER"
+
+  echo "1/4 Checking available downloads from MANIFEST file"
+
+  ARTS=$(curl -s $AUTH $MANIFEST_URL | grep --ignore-case "$VER_REGEX" | cut -d ' ' -f 2)
+
+  if [[ $DEBUG ]]; then
+    echo "DEBUG START"
+    curl -s $AUTH $MANIFEST_URL | grep --ignore-case "$VER_REGEX" || echo "no regex match"
+    curl -s $AUTH $MANIFEST_URL | grep --ignore-case "$VER_REGEX" | cut -d ' ' -f 2
+    echo "Found following artifacts:"
+    echo $ARTS
+    echo "DEBUG END"
+  fi
+
+  if [[ $ARTS == "" ]]; then
+    MSG="Failed to found any MANIFEST entries for version $VER make sure there exists release with that version or use --version to specify different version"
+    echo "$(red $MSG)"
+    exit
+  fi
+
+  echo "2/4 Downloading locale-archive"
+  curl -L https://dls.rhodecode.com/assets/locale-archive -J -O
+  mv -v locale-archive "$CACHE_DIR"
+
+  # vcsserver/ce/ee
+  echo "3/4 Downloading installer artifacts"
+  for url in $ARTS; do
+      echo "Downloading $url with $AUTH"
+      curl $AUTH --fail-early -L ${url} -J -O
+  done
+
+  #for url in $(curl -s $MANIFEST_URL | grep --ignore-case -E 'control.+\+x86_64' | cut -d ' ' -f 2); do
+  #    echo "Downloading $url"
+  #    curl -L ${url} -J -O
+  #done
+
+  echo "4/4 Downloading installer from $INSTALLER_URL"
+  curl $AUTH -L $INSTALLER_URL -J -O
+
+  INSTALLER=$(ls -Art RhodeCode-installer-* | tail -n 1)
+  if [[ -n $INSTALLER ]]; then
+    chmod +x "${INSTALLER}"
+  fi
+
+  echo "Copying artifacts into $CACHE_DIR"
+
+  mv -v "${INSTALLER}" $CACHE_DIR
+  mv -v *.bz2 $CACHE_DIR
+  ls -lh $CACHE_DIR
+
+}
+
+# :command.function
+rccontrol_build_command() {
+  # src/build_command.sh
+  check_bootstrap
+
+  rc_version=${args[--version-name]}
+  export RC_VERSION=$rc_version
+  eval "echo INSTALLER BASED BUILDING${RC_VERSION}"
+
+  RC_VERSION=$rc_version ./rccontrol stack rhodecode build --progress plain rhodecode
+
+}
+
+# :command.function
+rccontrol_get_build_source_command() {
+  # src/get_build_source_command.sh
+  check_bootstrap
+
+  AUTH_TOKEN=${args[--auth-token]}
+  SERVER_URL=${args[--server-url]}
+  revision=${args[revision]}
+
+  SOURCE_DIR=$PWD/.source
+
+  RHODECODE_VCS_HASH=$revision
+  RHODECODE_CE_HASH=$revision
+  RHODECODE_EE_HASH=$revision
+
+  # download sources
+  echo "** download rhodecode source for build from $SERVER_URL **"
+
+  curl --header "X-Rc-Auth-Token: $AUTH_TOKEN" -L $SERVER_URL/rhodecode-vcsserver/archive/$RHODECODE_VCS_HASH.tgz?with_hash=0 | tar -xz -C $SOURCE_DIR
+  curl --header "X-Rc-Auth-Token: $AUTH_TOKEN" -L $SERVER_URL/rhodecode-enterprise-ce/archive/$RHODECODE_CE_HASH.tgz?with_hash=0 | tar -xz -C $SOURCE_DIR
+  #TODO: fix just CE build...
+  curl --header "X-Rc-Auth-Token: $AUTH_TOKEN" -L $SERVER_URL/rhodecode-enterprise-ee/archive/$RHODECODE_EE_HASH.tgz?with_hash=0 | tar -xz -C $SOURCE_DIR
+
+  rm -rf $SOURCE_DIR/rhodecode-vcsserver     && mv    $SOURCE_DIR/*rhodecode-vcsserver-plain     $SOURCE_DIR/rhodecode-vcsserver
+  rm -rf $SOURCE_DIR/rhodecode-enterprise-ce && mv    $SOURCE_DIR/*rhodecode-enterprise-ce-plain $SOURCE_DIR/rhodecode-enterprise-ce
+  rm -rf $SOURCE_DIR/rhodecode-enterprise-ee && cp -r $SOURCE_DIR/*rhodecode-enterprise-ee-plain $SOURCE_DIR/rhodecode-enterprise-ee
+
+  echo "downloading sources done to $SOURCE_DIR"
+
+}
+
+# :command.function
+rccontrol_build_source_command() {
+  # src/build_source_command.sh
+  check_bootstrap
+
+  rc_version=${args[--version-name]}
+  export RC_VERSION=$rc_version
+  eval "echo SOURCE BASED BUILDING${RC_VERSION}"
+
+  RC_VERSION=$rc_version ./rccontrol stack rhodecode -f docker-compose-apps.source.yaml build --progress plain rhodecode
+
+}
+
+# :command.function
+rccontrol_stack_command() {
+  # src/stack_command.sh
+  check_bootstrap
+
+  DEBUG=${args[--debug]}
+  service_name=${args[name]}
+
+  if [[ ! -f $RC_STACK_ROUTER_EXT ]]; then
+    RC_STACK_ROUTER_EXT=""
+  else
+    RC_STACK_ROUTER_EXT="-f $RC_STACK_ROUTER_EXT"
+  fi
+
+  CMD_ROUTER="\
+  docker compose \
+  --env-file $ENV_FILE \
+  $ENV_EXPAND \
+  -p rc_cluster_router \
+  -f docker-compose-base.yaml \
+  -f docker-compose-router.yaml $RC_STACK_ROUTER_EXT"
+
+  if [[ ! -f $RC_STACK_SERVICES_EXT ]]; then
+    RC_STACK_SERVICES_EXT_LCL=""
+  else
+    RC_STACK_SERVICES_EXT_LCL="-f $RC_STACK_SERVICES_EXT"
+  fi
+
+  RC_STACK_PROFILES="--profile postgres --profile redis --profile elasticsearch --profile channelstream"
+
+  CMD_SERVICES="\
+  docker compose \
+  --env-file $ENV_FILE \
+  $ENV_EXPAND \
+  $RC_STACK_PROFILES \
+  -p rc_cluster_services \
+  -f docker-compose-base.yaml \
+  -f docker-compose-services.yaml $RC_STACK_SERVICES_EXT_LCL"
+
+  if [[ ! -f $RC_STACK_METRICS_EXT ]]; then
+    RC_STACK_METRICS_EXT_LCL=""
+  else
+    RC_STACK_METRICS_EXT_LCL="-f $RC_STACK_METRICS_EXT"
+  fi
+
+  CMD_METRICS="\
+  docker compose \
+  --env-file $ENV_FILE \
+  $ENV_EXPAND \
+  -p rc_cluster_metrics \
+  -f docker-compose-base.yaml \
+  -f docker-compose-metrics.yaml $RC_STACK_METRICS_EXT_LCL"
+
+  if [[ ! -f $RC_STACK_RHODECODE_EXT ]]; then
+    RC_STACK_RHODECODE_EXT_LCL=""
+  else
+    RC_STACK_RHODECODE_EXT_LCL="-f $RC_STACK_RHODECODE_EXT"
+  fi
+
+  CMD_RHODECODE="\
+  docker compose \
+  --env-file $ENV_FILE \
+  $ENV_EXPAND \
+  -p rc_cluster_apps \
+  -f docker-compose-base.yaml \
+  -f docker-compose-apps.yaml $RC_STACK_RHODECODE_EXT_LCL"
+
+  CMD_RHODECODE_SOURCE="\
+  docker compose \
+  --env-file $ENV_FILE \
+  $ENV_EXPAND \
+  -p rc_cluster_apps \
+  -f docker-compose-base.yaml \
+  -f docker-compose-apps.yaml \
+  -f docker-compose-apps.source.yaml $RC_STACK_RHODECODE_EXT_LCL"
+
+  case $service_name in
+
+      services )
+          if [[ $DEBUG ]]; then
+            echo "---"
+            echo "stacks docker: $RC_STACK_SERVICES_EXT_LCL"
+            echo "running command: ${CMD_SERVICES}"
+            echo "ARGS: ${other_args[*]}"
+            echo "---"
+          fi
+
+          eval "${CMD_SERVICES} ${other_args[*]}"
+          exit
+          ;;
+      router )
+          if [[ $DEBUG ]]; then
+            echo "---"
+            echo "stacks docker: $RC_STACK_ROUTER_EXT_LCL"
+            echo "running command: ${CMD_ROUTER}"
+            echo "ARGS: ${other_args[*]}"
+            echo "---"
+          fi
+          eval "${CMD_ROUTER} ${other_args[*]}"
+          exit
+          ;;
+      metrics )
+          if [[ $DEBUG ]]; then
+            echo "---"
+            echo "stacks docker: $RC_STACK_METRICS_EXT_LCL"
+            echo "running command: ${CMD_METRICS}"
+            echo "ARGS: ${other_args[*]}"
+            echo "---"
+          fi
+          eval "${CMD_METRICS} ${other_args[*]}"
+          exit
+          ;;
+      rhodecode )
+          if [[ $DEBUG ]]; then
+            echo "---"
+            echo "stacks docker: $RC_STACK_RHODECODE_EXT_LCL"
+            echo "running command: ${CMD_RHODECODE}"
+            echo "ARGS: ${other_args[*]}"
+            echo "---"
+          fi
+          eval "${CMD_RHODECODE} ${other_args[*]}"
+          exit
+          ;;
+  esac
+
+}
+
+# :command.function
+rccontrol_stack_status_command() {
+  # src/stack_status_command.sh
+  check_bootstrap
+  DEBUG=${args[--debug]}
+  if [[ $DEBUG ]]; then
+    echo "---"
+
+      ps_cmd=$(docker ps --filter=name=rc_cluster --format="{{.ID}}")
+
+      for service in $ps_cmd; do
+
+        servicename=`docker inspect --format '{{ .Name }}' $service`
+        servicename=${servicename:1}
+        echo $servicename
+        docker inspect $service --format='{{.State.Status}}: {{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'
+        echo ""
+
+      done
+    fi
+    echo "---"
+  docker ps --filter=name=rc_cluster --format="table {{.ID}}\\t{{.Image}}\\t{{.Status}}\\t{{.Names}}\\t{{.Ports}}"
+}
+
+# :command.function
+rccontrol_stack_upgrade_command() {
+  # src/stack_upgrade_command.sh
+  check_bootstrap
+
+  echo "# this file is located in 'src/stack_upgrade_command.sh'"
+  echo "# code for 'rccontrol stack-upgrade' goes here"
+  echo "# you can edit it freely and regenerate (it will not be overwritten)"
+  inspect_args
+
+}
+
+# :command.function
+rccontrol_cli_redis_command() {
+  # src/cli_redis_command.sh
+  check_bootstrap
+
+  DEBUG=${args[--debug]}
+
+  target_container=rc_cluster_services-redis-1
+  docker_id=$(docker ps --filter name=$target_container -q)
+
+  if [[ $DEBUG ]]; then
+    echo "container id: $docker_id, based on $target_container filter"
+    docker ps
+  fi
+
+  if [ "$docker_id" == "" ]; then
+    MSG="Cannot find container ID with name $target_container"
+    echo "$(red $MSG)"
+    exit
+  fi
+
+  if [[ $DEBUG ]]; then
+    echo "Running |docker exec --interactive --tty $docker_id $CMD|"
+    echo "docker exec --interactive --tty $docker_id /bin/bash -c 'redis-cli'"
+  fi
+
+  eval "docker exec --interactive --tty $docker_id /bin/bash -c 'redis-cli'"
+
+}
+
+# :command.function
+rccontrol_cli_db_command() {
+  # src/cli_db_command.sh
+  check_bootstrap
+
+  DEBUG=${args[--debug]}
+
+  target_container=rc_cluster_services-database-1
+  docker_id=$(docker ps --filter name=$target_container -q)
+
+  if [[ $DEBUG ]]; then
+    echo "container id: $docker_id, based on $target_container filter"
+    docker ps
+  fi
+
+  if [ "$docker_id" == "" ]; then
+    MSG="Cannot find container ID with name $target_container"
+    echo "$(red $MSG)"
+    exit
+  fi
+
+  if [[ $DEBUG ]]; then
+    echo "Running |docker exec --interactive --tty $docker_id $CMD|"
+    echo "docker exec --interactive --tty $docker_id  /bin/bash -c 'PGPASSWORD=$DB_PASSWORD psql --username=$DB_USER --dbname=$DB_NAME'"
+  fi
+
+  eval "docker exec --interactive --tty $docker_id  /bin/bash -c 'PGPASSWORD=$DB_PASSWORD psql --username=$DB_USER --dbname=$DB_NAME'"
+
+}
+
+# :command.function
+rccontrol_cli_db_upgrade_command() {
+  # src/cli_db_upgrade_command.sh
+  check_bootstrap
+
+  DEBUG=${args[--debug]}
+
+  target_container=rc_cluster_apps-rhodecode-1
+  docker_id=$(docker ps --filter name=$target_container -q)
+
+  if [[ $DEBUG ]]; then
+    echo "container id: $docker_id, based on $target_container filter"
+    docker ps
+  fi
+
+  if [ "$docker_id" == "" ]; then
+    MSG="Cannot find container ID with name $target_container"
+    echo "$(red $MSG)"
+    exit
+  fi
+
+  if [[ $DEBUG ]]; then
+    echo "./rccontrol stack rhodecode exec rhodecode /usr/local/bin/rhodecode_bin/bin/rc-upgrade-db /etc/rhodecode/conf/rhodecode.optimized.ini --force-yes"
+  fi
+
+  ./rccontrol stack rhodecode exec rhodecode /usr/local/bin/rhodecode_bin/bin/rc-upgrade-db /etc/rhodecode/conf/rhodecode.optimized.ini --force-yes
+}
+
+# :command.function
+rccontrol__completions_command() {
+  # src/_completions_command.sh
+  send_completions
+}
+
+# :command.function
+rccontrol_backup_db_command() {
+  # src/backup_db_command.sh
+  check_bootstrap
+
+  DEBUG=${args[--debug]}
+  DESTINATION=${args[destination]}
+
+  target_container=rc_cluster_services-database-1
+
+  docker_id=$(docker ps --filter name=$target_container -q)
+  backup_name=rc_db_dump-$(date +%Y-%m-%d).tar.gz
+
+  echo "creating backup $backup_name"
+
+  if [[ $DEBUG ]]; then
+    echo "container id: $docker_id, based on $target_container filter"
+    docker ps
+    echo "---"
+  fi
+
+  #image_id=$(docker inspect "$docker_id" --format {{.Image}} | cut -c 8-)
+  #
+  #if [[ $DEBUG ]]; then
+  #  echo "image id: $image_id, based on $target_container filter"
+  #  docker image ls
+  #  echo "---"
+  #fi
+
+  if [ "$docker_id" == "" ]; then
+    MSG="Cannot find container ID with name $target_container"
+    echo "$(red $MSG)"
+    exit
+  fi
+
+  #if [ "image_id" == "" ]; then
+  #  MSG="Cannot find image ID with name $target_container"
+  #  echo "$(red $MSG)"
+  #  exit
+  #fi
+
+  if [[ $DEBUG ]]; then
+    echo "docker exec -e PGPASSWORD=$DB_PASSWORD $docker_id /bin/bash -c 'pg_dump --inserts -U $DB_USER -h 127.0.0.1 --dbname=$DB_NAME | gzip > /var/rc-data-dump/$backup_name'"
+  fi
+
+  eval "docker exec -e PGPASSWORD=$DB_PASSWORD $docker_id /bin/bash -c 'pg_dump --inserts -U $DB_USER -h 127.0.0.1 --dbname=$DB_NAME | gzip > /var/rc-data-dump/$backup_name'"
+  echo "$(green Backup created in /var/rc-data-dump/ mount !)"
+
+}
+
+# :command.function
+rccontrol_backup_data_command() {
+  # src/backup_data_command.sh
+  echo "# this file is located in 'src/backup_data_command.sh'"
+  echo "# code for 'rccontrol backup-data' goes here"
+  echo "# you can edit it freely and regenerate (it will not be overwritten)"
+  inspect_args
+
+}
+
+# :command.parse_requirements
+parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --version | -v )
+    version_command
+    exit
+    ;;
+
+  --help | -h )
+    long_usage=yes
+    rccontrol_usage
+    exit
+    ;;
+
+  # :flag.case
+  --debug )
+
+    # :flag.case_no_arg
+    args[--debug]=1
+    shift
+    ;;
+
+  esac
+
+  # :command.environment_variables_filter
+  # :command.environment_variables_default
+  export RC_CLI_VERSION_NAME="${RC_CLI_VERSION_NAME:-4.27.0}"
+  export RC_STACK_ROUTER_EXT="${RC_STACK_ROUTER_EXT:-.custom/docker-compose-router.override.yaml}"
+  export RC_STACK_METRICS_EXT="${RC_STACK_METRICS_EXT:-.custom/docker-compose-metrics.override.yaml}"
+  export RC_STACK_SERVICES_EXT="${RC_STACK_SERVICES_EXT:-.custom/docker-compose-services.override.yaml}"
+  export RC_STACK_RHODECODE_EXT="${RC_STACK_RHODECODE_EXT:-.custom/docker-compose-apps.override.yaml}"
+
+  # :command.command_filter
+  action=${1:-}
+
+  case $action in
+  -* )
+    ;;
+
+  self-update )
+    action="self-update"
+    shift
+    rccontrol_self_update_parse_requirements "$@"
+    shift $#
+    ;;
+
+  bootstrap | install )
+    action="bootstrap"
+    shift
+    rccontrol_bootstrap_parse_requirements "$@"
+    shift $#
+    ;;
+
+  get-build-artifacts )
+    action="get-build-artifacts"
+    shift
+    rccontrol_get_build_artifacts_parse_requirements "$@"
+    shift $#
+    ;;
+
+  build )
+    action="build"
+    shift
+    rccontrol_build_parse_requirements "$@"
+    shift $#
+    ;;
+
+  get-build-source )
+    action="get-build-source"
+    shift
+    rccontrol_get_build_source_parse_requirements "$@"
+    shift $#
+    ;;
+
+  build-source )
+    action="build-source"
+    shift
+    rccontrol_build_source_parse_requirements "$@"
+    shift $#
+    ;;
+
+  stack )
+    action="stack"
+    shift
+    rccontrol_stack_parse_requirements "$@"
+    shift $#
+    ;;
+
+  stack-status | status )
+    action="stack-status"
+    shift
+    rccontrol_stack_status_parse_requirements "$@"
+    shift $#
+    ;;
+
+  stack-upgrade )
+    action="stack-upgrade"
+    shift
+    rccontrol_stack_upgrade_parse_requirements "$@"
+    shift $#
+    ;;
+
+  cli-redis )
+    action="cli-redis"
+    shift
+    rccontrol_cli_redis_parse_requirements "$@"
+    shift $#
+    ;;
+
+  cli-db )
+    action="cli-db"
+    shift
+    rccontrol_cli_db_parse_requirements "$@"
+    shift $#
+    ;;
+
+  cli-db-upgrade )
+    action="cli-db-upgrade"
+    shift
+    rccontrol_cli_db_upgrade_parse_requirements "$@"
+    shift $#
+    ;;
+
+  _completions )
+    action="_completions"
+    shift
+    rccontrol__completions_parse_requirements "$@"
+    shift $#
+    ;;
+
+  backup-db )
+    action="backup-db"
+    shift
+    rccontrol_backup_db_parse_requirements "$@"
+    shift $#
+    ;;
+
+  backup-data )
+    action="backup-data"
+    shift
+    rccontrol_backup_data_parse_requirements "$@"
+    shift $#
+    ;;
+
+  # :command.command_fallback
+  "" )
+    rccontrol_usage >&2
+    exit 1
+    ;;
+
+  * )
+    printf "invalid command: %s\n" "$action" >&2
+    exit 1
+    ;;
+
+  esac
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
+rccontrol_self_update_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_self_update_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.dependencies_filter
+  if ! [[ -x "$(command -v curl)" ]]; then
+    printf "missing dependency: curl\n" >&2
+    exit 1
+  fi
+  if ! [[ -x "$(command -v tar)" ]]; then
+    printf "missing dependency: tar\n" >&2
+    exit 1
+  fi
+
+  # :command.command_filter
+  action="self-update"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+    # :flag.case
+    --auth-token )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--auth-token]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--auth-token requires an argument: --auth-token AUTH_TOKEN" >&2
+        exit 1
+      fi
+      ;;
+
+    # :flag.case
+    --server-url )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--server-url]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--server-url requires an argument: --server-url SERVER_URL" >&2
+        exit 1
+      fi
+      ;;
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+  # :command.default_assignments
+  [[ -n ${args[--server-url]:-} ]] || args[--server-url]="https://code.rhodecode.com"
+
+}
+
+# :command.parse_requirements
+rccontrol_bootstrap_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_bootstrap_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.dependencies_filter
+  if ! [[ -x "$(command -v curl)" ]]; then
+    printf "missing dependency: curl\n" >&2
+    exit 1
+  fi
+  if ! [[ -x "$(command -v tar)" ]]; then
+    printf "missing dependency: tar\n" >&2
+    exit 1
+  fi
+  if ! [[ -x "$(command -v md5sum)" ]]; then
+    printf "missing dependency: md5sum\n" >&2
+    exit 1
+  fi
+
+  # :command.command_filter
+  action="bootstrap"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+    # :flag.case
+    --force | -f )
+
+      # :flag.case_no_arg
+      args[--force]=1
+      shift
+      ;;
+
+    # :flag.case
+    --auth-token )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--auth-token]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--auth-token requires an argument: --auth-token AUTH_TOKEN" >&2
+        exit 1
+      fi
+      ;;
+
+    # :flag.case
+    --server-url )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--server-url]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--server-url requires an argument: --server-url SERVER_URL" >&2
+        exit 1
+      fi
+      ;;
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+  # :command.default_assignments
+  [[ -n ${args[--server-url]:-} ]] || args[--server-url]="https://code.rhodecode.com"
+
+}
+
+# :command.parse_requirements
+rccontrol_get_build_artifacts_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_get_build_artifacts_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="get-build-artifacts"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+    # :flag.case
+    --auth )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--auth]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--auth requires an argument: --auth AUTH" >&2
+        exit 1
+      fi
+      ;;
+
+    # :flag.case
+    --installer-url )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--installer-url]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--installer-url requires an argument: --installer-url INSTALLER_URL" >&2
+        exit 1
+      fi
+      ;;
+
+    # :flag.case
+    --manifest-url )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--manifest-url]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--manifest-url requires an argument: --manifest-url MANIFEST_URL" >&2
+        exit 1
+      fi
+      ;;
+
+    # :flag.case
+    --version-name )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--version-name]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--version-name requires an argument: --version-name VERSION_NAME" >&2
+        exit 1
+      fi
+      ;;
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+  # :command.default_assignments
+  [[ -n ${args[--auth]:-} ]] || args[--auth]=""
+  [[ -n ${args[--installer-url]:-} ]] || args[--installer-url]="https://dls.rhodecode.com/dls/N2E2ZTY1NzA3NjYxNDA2NTc1NjI3MTcyNzA2MjcxNzIyZTcwNjI3YQ==/rhodecode-control/latest-linux-ee"
+  [[ -n ${args[--manifest-url]:-} ]] || args[--manifest-url]="https://dls.rhodecode.com/linux/MANIFEST"
+  [[ -n ${args[--version-name]:-} ]] || args[--version-name]="$RC_CLI_VERSION_NAME"
+
+}
+
+# :command.parse_requirements
+rccontrol_build_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_build_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="build"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+    # :flag.case
+    --version-name )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--version-name]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--version-name requires an argument: --version-name VERSION_NAME" >&2
+        exit 1
+      fi
+      ;;
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+  # :command.default_assignments
+  [[ -n ${args[--version-name]:-} ]] || args[--version-name]="$RC_CLI_VERSION_NAME"
+
+}
+
+# :command.parse_requirements
+rccontrol_get_build_source_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_get_build_source_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.dependencies_filter
+  if ! [[ -x "$(command -v curl)" ]]; then
+    printf "missing dependency: curl\n" >&2
+    exit 1
+  fi
+  if ! [[ -x "$(command -v tar)" ]]; then
+    printf "missing dependency: tar\n" >&2
+    exit 1
+  fi
+
+  # :command.command_filter
+  action="get-build-source"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+    # :flag.case
+    --auth-token )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--auth-token]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--auth-token requires an argument: --auth-token AUTH_TOKEN" >&2
+        exit 1
+      fi
+      ;;
+
+    # :flag.case
+    --server-url )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--server-url]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--server-url requires an argument: --server-url SERVER_URL" >&2
+        exit 1
+      fi
+      ;;
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      if [[ -z ${args[revision]+x} ]]; then
+
+        args[revision]=$1
+        shift
+      else
+        printf "invalid argument: %s\n" "$key" >&2
+        exit 1
+      fi
+
+      ;;
+
+    esac
+  done
+
+  # :command.required_args_filter
+  if [[ -z ${args[revision]+x} ]]; then
+    printf "missing required argument: REVISION\nusage: rccontrol get-build-source REVISION [OPTIONS]\n" >&2
+    exit 1
+  fi
+
+  # :command.default_assignments
+  [[ -n ${args[--server-url]:-} ]] || args[--server-url]="https://code.rhodecode.com"
+
+}
+
+# :command.parse_requirements
+rccontrol_build_source_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_build_source_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="build-source"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+    # :flag.case
+    --version-name )
+
+      # :flag.case_arg
+      if [[ -n ${2+x} ]]; then
+
+        args[--version-name]="$2"
+        shift
+        shift
+      else
+        printf "%s\n" "--version-name requires an argument: --version-name VERSION_NAME" >&2
+        exit 1
+      fi
+      ;;
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+  # :command.default_assignments
+  [[ -n ${args[--version-name]:-} ]] || args[--version-name]="$RC_CLI_VERSION_NAME"
+
+}
+
+# :command.parse_requirements
+rccontrol_stack_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_stack_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="stack"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      other_args+=("$1")
+      shift
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_catch_all
+      if [[ -z ${args[name]+x} ]]; then
+
+        args[name]=$1
+        shift
+      else
+        other_args+=("$1")
+        shift
+      fi
+
+      ;;
+
+    esac
+  done
+
+  # :command.required_args_filter
+  if [[ -z ${args[name]+x} ]]; then
+    printf "missing required argument: NAME\nusage: rccontrol stack NAME [SERVICES PARAMS...]\n" >&2
+    exit 1
+  fi
+
+  # :command.whitelist_filter
+  if [[ ! ${args[name]} =~ ^(router|metrics|services|rhodecode)$ ]]; then
+    printf "%s\n" "name must be one of: router, metrics, services, rhodecode" >&2
+    exit 1
+  fi
+
+}
+
+# :command.parse_requirements
+rccontrol_stack_status_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_stack_status_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="stack-status"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
+rccontrol_stack_upgrade_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_stack_upgrade_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="stack-upgrade"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
+rccontrol_cli_redis_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_cli_redis_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="cli-redis"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
+rccontrol_cli_db_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_cli_db_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="cli-db"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
+rccontrol_cli_db_upgrade_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_cli_db_upgrade_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="cli-db-upgrade"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
+rccontrol__completions_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol__completions_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.command_filter
+  action="_completions"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
+rccontrol_backup_db_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_backup_db_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.dependencies_filter
+  if ! [[ -x "$(command -v tar)" ]]; then
+    printf "missing dependency: tar\n" >&2
+    exit 1
+  fi
+  if ! [[ -x "$(command -v gzip)" ]]; then
+    printf "missing dependency: gzip\n" >&2
+    exit 1
+  fi
+
+  # :command.command_filter
+  action="backup-db"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.parse_requirements
+rccontrol_backup_data_parse_requirements() {
+  # :command.fixed_flags_filter
+  case "${1:-}" in
+  --help | -h )
+    long_usage=yes
+    rccontrol_backup_data_usage
+    exit
+    ;;
+
+  esac
+
+  # :command.dependencies_filter
+  if ! [[ -x "$(command -v tar)" ]]; then
+    printf "missing dependency: tar\n" >&2
+    exit 1
+  fi
+
+  # :command.command_filter
+  action="backup-data"
+
+  # :command.parse_requirements_while
+  while [[ $# -gt 0 ]]; do
+    key="$1"
+    case "$key" in
+
+    -?* )
+      printf "invalid option: %s\n" "$key" >&2
+      exit 1
+      ;;
+
+    * )
+      # :command.parse_requirements_case
+      # :command.parse_requirements_case_simple
+      printf "invalid argument: %s\n" "$key" >&2
+      exit 1
+
+      ;;
+
+    esac
+  done
+
+}
+
+# :command.initialize
+initialize() {
+  version="4.28.0.REL20221101"
+  long_usage=''
+  set -e
+
+  # :command.environment_variables_default
+  export RC_CLI_VERSION_NAME="${RC_CLI_VERSION_NAME:-4.27.0}"
+  export RC_STACK_ROUTER_EXT="${RC_STACK_ROUTER_EXT:-.custom/docker-compose-router.override.yaml}"
+  export RC_STACK_METRICS_EXT="${RC_STACK_METRICS_EXT:-.custom/docker-compose-metrics.override.yaml}"
+  export RC_STACK_SERVICES_EXT="${RC_STACK_SERVICES_EXT:-.custom/docker-compose-services.override.yaml}"
+  export RC_STACK_RHODECODE_EXT="${RC_STACK_RHODECODE_EXT:-.custom/docker-compose-apps.override.yaml}"
+
+  # src/initialize.sh
+
+  ENV_FILE=$PWD/.env
+
+  # bootstrap file is a config file at the same time
+  BOOTSTRAP_FILE='.rccontrol-bootstrap'
+  CONFIG_FILE='.rccontrol.ini'
+
+  VALID_SERVICES="router metrics services rhodecode"
+  DOCKER_DEFS_WORK_DIR="docker_defs"
+
+  #echo "1 ----"
+  #echo $RC_STACK_SERVICES_EXT
+  #echo $RC_STACK_METRICS_EXT
+  #echo "1 -----"
+
+  #echo '2 ----'
+  #grep -v -e '^#' "$ENV_FILE" | xargs -I {} echo \'{}\'
+  #echo '2 ----'
+
+  #expose env vars from rccontrol donfig
+  #if [[ -f $ENV_FILE ]]; then
+  #  eval $(grep -v -e '^#' "$ENV_FILE" | xargs -I {} echo export \'{}\')
+  #fi
+
+  #ENV_EXPAND=""
+  #for k in $(config_keys); do
+  #  k_upper=${k^^}
+  #  env_entry="-e $k_upper='$(config_get "$k")' "
+  #  ENV_EXPAND+=$env_entry;
+  #  #echo $env_expand
+  #done
+
+  #
+  #echo "3 ----"
+  #echo $RC_STACK_SERVICES_EXT
+  #echo $RC_STACK_METRICS_EXT
+  #echo $RC_STACK_RHODECODE_EXT
+  #echo "3 -----"
+
+  #env | grep RC_
+
+  # backup files from a docker volume into /tmp/backup.tar.gz
+  docker-volume-backup-compressed() {
+    docker run --rm -v /tmp:/backup --volumes-from "$1" debian:jessie tar -czvf /backup/backup.tar.gz "${@:2}"
+  }
+
+  # restore files from /tmp/backup.tar.gz into a docker volume
+  docker-volume-restore-compressed() {
+    docker run --rm -v /tmp:/backup --volumes-from "$1" debian:jessie tar -xzvf /backup/backup.tar.gz "${@:2}"
+    echo "Double checking files..."
+    docker run --rm -v /tmp:/backup --volumes-from "$1" debian:jessie ls -lh "${@:2}"
+  }
+
+  # backup files from a docker volume into /tmp/backup.tar
+  docker-volume-backup() {
+    docker run --rm -v /tmp:/backup --volumes-from "$1" busybox tar -cvf /backup/backup.tar "${@:2}"
+  }
+
+  # restore files from /tmp/backup.tar into a docker volume
+  docker-volume-restore() {
+    docker run --rm -v /tmp:/backup --volumes-from "$1" busybox tar -xvf /backup/backup.tar "${@:2}"
+    echo "Double checking files..."
+    docker run --rm -v /tmp:/backup --volumes-from "$1" busybox ls -lh "${@:2}"
+  }
+
+  get_started() {
+    echo ""
+    echo "~~~~ $(green Bootstrap completed) ~~~~"
+    echo "To start using RhodeCode run the following stacks using ./rccontrol stack [STACK_NAME]"
+    echo ""
+    echo "$(yellow_bold [Optional]): run the edge router to control domain and SSL"
+    echo "./rccontrol stack router up --detach"
+    echo ""
+    echo "$(green_bold [Mandatory]): run the services, like database, redis, channelstream etc..."
+    echo "./rccontrol stack services up --detach"
+    echo ""
+    echo "$(green_bold [Mandatory]): run the rhodecode app stack"
+    echo "./rccontrol stack rhodecode up --detach"
+    echo ""
+    echo "$(yellow_bold [Optional]): run the monitoring stack, this includes grafana/promethues logging/metrics system"
+    echo "./rccontrol stack metrics up --detach"
+    echo ""
+    echo "check services status/ports"
+    echo "./rccontrol status"
+  }
+}
+
+# :command.run
+run() {
+  declare -A args=()
+  declare -a other_args=()
+  declare -a input=()
+  normalize_input "$@"
+  parse_requirements "${input[@]}"
+
+  if [[ $action == "self-update" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_self_update_usage
+    else
+      rccontrol_self_update_command
+    fi
+
+  elif [[ $action == "bootstrap" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_bootstrap_usage
+    else
+      rccontrol_bootstrap_command
+    fi
+
+  elif [[ $action == "get-build-artifacts" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_get_build_artifacts_usage
+    else
+      rccontrol_get_build_artifacts_command
+    fi
+
+  elif [[ $action == "build" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_build_usage
+    else
+      rccontrol_build_command
+    fi
+
+  elif [[ $action == "get-build-source" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_get_build_source_usage
+    else
+      rccontrol_get_build_source_command
+    fi
+
+  elif [[ $action == "build-source" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_build_source_usage
+    else
+      rccontrol_build_source_command
+    fi
+
+  elif [[ $action == "stack" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_stack_usage
+    else
+      rccontrol_stack_command
+    fi
+
+  elif [[ $action == "stack-status" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_stack_status_usage
+    else
+      rccontrol_stack_status_command
+    fi
+
+  elif [[ $action == "stack-upgrade" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_stack_upgrade_usage
+    else
+      rccontrol_stack_upgrade_command
+    fi
+
+  elif [[ $action == "cli-redis" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_cli_redis_usage
+    else
+      rccontrol_cli_redis_command
+    fi
+
+  elif [[ $action == "cli-db" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_cli_db_usage
+    else
+      rccontrol_cli_db_command
+    fi
+
+  elif [[ $action == "cli-db-upgrade" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_cli_db_upgrade_usage
+    else
+      rccontrol_cli_db_upgrade_command
+    fi
+
+  elif [[ $action == "_completions" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol__completions_usage
+    else
+      rccontrol__completions_command
+    fi
+
+  elif [[ $action == "backup-db" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_backup_db_usage
+    else
+      rccontrol_backup_db_command
+    fi
+
+  elif [[ $action == "backup-data" ]]; then
+    if [[ ${args[--help]:-} ]]; then
+      long_usage=yes
+      rccontrol_backup_data_usage
+    else
+      rccontrol_backup_data_command
+    fi
+
+  elif [[ $action == "root" ]]; then
+    root_command
+  fi
+}
+
+initialize
+run "$@"

.env

@@ -1,31 +1,56 b''
-COMPOSE_PROJECT_NAME=rc_cluster
+#COMPOSE_PROJECT_NAME=rc_cluster
 TZ="UTC"
 
+
 # Version to deploy and run
-RC_VERSION="4.28.0"
+## VERSION_INFO
+RC_VERSION="4.28.0.REL20221120_SOURCE"
+#RC_CLI_VERSION_NAME="4.27.0"
+
+# ce, or ee
+RC_EDITION=ee
+RC_IMAGE_CE="rhodecode/rhodecode-ee:$RC_VERSION"
+RC_IMAGE_EE="rhodecode/rhodecode-ce:$RC_VERSION"
 
-# Database access credentials
+# Database bootstrap/access credentials
 DB_NAME=rhodecode
 DB_USER=rhodecode
-DB_PASSWORD=hUc1adS7oDd6Oj3in3
 
-# base url for running app
-RHODECODE_BASE_URL=http://localhost:8888
+# Bootstrap container with specific password
+# This password will be used to generate new account and password for the database
+DB_PASSWORD=[GENERATED_AT_BOOTSTRAP]
 
-# HTTP and HTTPS ports for running app
-RC_HTTP_PORT=8888
-RC_HTTPS_PORT=8443
+# set limit of redis in-memory cache before keys get evicted using LRU cache
+RC_REDIS_MAXMEMORY=1024mb
+
+# set the size of ramdisk used for locking files
+RC_DATA_RAMDISK_SIZE=1G
+
+# base url for running app, this is used for traefik hasname matching, so accessing this host will redirect
+# traffic to the running instance
+# replace this with your name of host. e.g http://yourdomain.com or https://rc.company.local
+RHODECODE_HOSTNAME=docker-dev
 
-# SSH Port exposed, increased security is to not used default 22
-RC_SSH_PORT=9022
 
 # user/password for first admin user created for access
-RHODECODE_USER_EMAIL=[e-mail]
+# this is a bootstrap super-admin account to access the web interface
+RHODECODE_USER_EMAIL=admin@server-com
 RHODECODE_USER_NAME=admin
 RHODECODE_USER_PASS=secret4
 
+
+
+
+# HTTP and HTTPS ports for running app
+RC_HTTP_PORT=8888
+
+# SSH Port exposed, increased security is to not used default 22
+RC_SSH_PORT=3022
+
+
+## RHODECODE RUNTIME VARS
+
 ## New since 4.27.0, default GIT branch name can be changed
 GIT_DEFAULT_BRANCH_NAME=master
 
-## Source build version for image
-SOURCE_VER=4.28.0.REL1
+

.gitignore

@@ -1,21 +1,23 b''
 # CACHE FILES
 .cache/RhodeCode-installer*
 .cache/*.tar.bz2
 .cache/locale-archive
 
+# Source code downloaded
+.source/*
+
+ # Custom / override wont be tracked
+.custom/*
+
 # LOGS
 logs/*.log
 logs/nginx/*.log
 logs/svn/*.log
 logs/apps/*.log
 logs/postgres/*.log
 
 .idea
 config/_shared/.rcmetadata.json
 
-.source/*
-scripts/download-artifacts-secret.sh
-
-scripts/download-source-secret.sh
-
-.rccontrol-bootstrap
  No newline at end of file
+.rccontrol-bootstrap
+.rccontrol.ini
  No newline at end of file

README.md

@@ -1,258 +1,298 b''
 # RhodeCode Cluster
 
-RhodeCode Cluster is a multi-node highly-scalable setup to run RhodeCode and
+RhodeCode Cluster is a multi-node highly-scalable setup to run 
+RhodeCode, Edge Router(Traefik + SSL) and Metrics Stack (Prometheus, Loki, Grafana) and
 all its additional components in single environment using Docker.
 
 Using a docker-compose this setup creates following services for RhodeCode:
 
-- Nginx HTTP Server for load balancing and reverse proxy
-- RhodeCode HTTP
-- VCSServer for GIT/SVN/HG support
-- SSH Server for cloning over SSH
-- SVN webserver for HTTP support over SVN
-- Celery workers for asynchronous tasks
-- Celery beat for automation tasks
-- Redis Database for caching
-- Postgres database for persistent storage
-- Channelstream websocket server for live components
+Edge-Router:
+ - Traefik, Edge Router, SSL termination etc
+
+Core Services:
+ - Database (defaults to PostgreSQL)
+ - Redis, acts as cache and queue exchange
+ - ChannelStream - live websocket communications
+ - Nginx (static/channelstream) proxy serving RhodeCode APPS and channelstream communication
+ - Elasticsearch (full text search backend)
+
+RhodeCode
+ - RhodeCode CE/EE
+ - VCSServer for GIT/SVN/HG support
+ - SSH Server for cloning over SSH
+ - SVN webserver for HTTP support over SVN
+ - Celery workers for asynchronous tasks
+ - Celery beat for automation tasks
+
+Metrics
+ - Loki, logs aggregation
+ - Grafana, Metrics Dashboard
+ - Promethues, Metrics time-series
+ - statsd-exporter - statsd to promethues bridge
+ - node-exporter - machine stats
+ - promtail - log scraping
 
 
 ## Pre requisites
 
+To Run this stack Docker engine and Docker Compose needs to be installed on the host machine.
 Visit docker site and install docker (min version 20.10) and docker compose:
 
-- https://docs.docker.com/engine/install/ 
-- https://docs.docker.com/compose/install/
+- https://docs.docker.com/engine/install/
+- https://docs.docker.com/compose/install/ 
 
 The instructions below outline installation of the current stable release (v1.29.2) of Compose. 
 
 ## Data structure
 
 There are 4 volumes defined:
 
 
 - `/etc/rhodecode/conf`
   
-  Used for configuration files for rhodecode, vcsserver and supervisord, and some cache data
+  Shared volume used for configuration files for rhodecode, vcsserver and supervisord, and some cache data
 
 - `/var/opt/rhodecode_repo_store` 
 
-   Used for main repository storage where repositories would be stored
+  Used for main repository storage where repositories would be stored
   
 - `/var/opt/rhodecode_data` 
   
-   data dir for rhodecode cache/lock files, or user sessions (for file backend)
+  Data dir for rhodecode cache/lock files, or user sessions (for file backend)
 
 - `/var/log/rhodecode`
 
-   Used to store all logs from RhodeCode
+  Used to store all logs from RhodeCode
 
 
 ## Setup/Build options
 
 There are 3 options to run the docker stack.
 
 - [Standalone cluster build from installer](#standalone-cluster-build-from-installer) 
 - [Standalone cluster build from source](#standalone-cluster-build-from-source) 
-- [dev enviroment setup](#like-this-one)
+- [dev environment setup](#dev-env-build)
+
 
 
 # Standalone cluster build from installer
 
 Follow these steps to build and run the RhodeCode Cluster via Docker-compose.
 Get the repository:
 
 git clone https://code.rhodecode.com/rhodecode-enterprise-docker && cd rhodecode-enterprise-docker
 
 ## Download installer binaries
 
 First start by fetching required installer binaries. This is required to create both
 simple build and full compose setup.
 Please check the `.env` file to adjust RhodeCode version if needed.
 (e.g. RC_VERSION="4.24.1")
 
 ```shell
 cd .bootstrap/ && ./download-artifacts.sh && cd ../
 ```
 
 This will download required installer files and put them into the `.cache` directory. 
 This directory should look similar to that after downloads have finish:
 
 ```shell
 drwxr-xr-x   8 rcdev  rcdev   256B Feb  8 13:35 .
 drwxr-xr-x  14 rcdev  rcdev   448B Feb  8 10:40 ..
 -rw-r--r--   1 rcdev  rcdev     0B Feb  8 20:44 .dirkeep
 -rwxr-xr-x   1 rcdev  rcdev   241M Feb  8 13:35 RhodeCode-installer-linux-build20210208_0800
 -rw-r--r--   1 rcdev  rcdev   156M Feb  8 13:35 RhodeCodeCommunity-4.24.1+x86_64-linux_build20210208_0800.tar.bz2
 -rw-r--r--   1 rcdev  rcdev   171M Feb  8 13:35 RhodeCodeEnterprise-4.24.1+x86_64-linux_build20210208_0800.tar.bz2
 -rw-r--r--   1 rcdev  rcdev   145M Feb  8 13:35 RhodeCodeVCSServer-4.24.1+x86_64-linux_build20210208_0800.tar.bz2
 -rw-r--r--   1 rcdev  rcdev   109M Feb  8 13:35 locale-archive
 ```
 
 ## Set License for EE version
 
-In order to install EE edition a valid license is required. 
+In order to install EE edition a license file is required to be present.
+It can contain your current license, or when empty license can be applied via Web interface.
+
 To apply it during build phase save your raw license data into a file 
 
-`config/compose/rhodecode_enterprise.license` 
+`config/rhodecode_enterprise.license` 
 
 If this file is present build phase will read it and license will be applied at creation.
 This file can also be empty and license can be applied via a WEB interface after first login.
 
 ## Run Docker compose build:
 
 *This will build RhodeCode based on downloaded installer packages.*
 
 To create a full stack we need to run the database container, so it's ready to
 build the docker image.
 
 _Disk space problems?_
      
 ```shell
 docker system df
 docker builder prune
+# optionally
+docker image prune -a
 ```
+### Creating & building images
 
 1) start with running the required database for the build stage in the background.
    
     ```shell
     docker-compose up --detach database
     ```
    
     This will start our postgres database, and expose it to the network.
+    Postgres DB is configured to output logs into a file `/var/log/rhodecode/postgres`
 
 2) We can now run the full installation. Database needs to be running for the next build command.
-    
+   This will build the rhodecode base image used for rhodecode, vcsserver, celery, ssh, svn
+   Then it will build all other components required.
+
     ```shell
     docker-compose build rhodecode
     docker-compose build
     ```
 
-3) Once we build the rhodecode app, we can run the whole stack using `docker-compose up`
+4) Once we build all required containers, we can run the whole stack using `docker-compose up`
 
     ```shell
     docker-compose up
     ```
 
 If running locally you can access Running RhodeCode via Nginx under:
 http://localhost:8888
 
 localhost can be changed to the server IP where docker is running.
 
 
 In case for bigger setups docker-compose can scale more rhodecode/vcsserver workers:
 
 ```shell
 docker-compose up --scale vcsserver=3 rhodecode=3
 ```
 
+Logging is pushed to stdout from all services.
+
 
-Upgrade:
+### Upgrade procedure:
 
 - pull the latest rhodecode-docker repo
 - check .env file for correct update version
 - re-build rhodecode
 - docker-compose build rhodecode
+- docker-compose build
 - docker-compose stop
 - docker-compose up
 
 # Standalone cluster build from source
 
-There's an option to build the latest branches as a docker installation.
+There's an option to build the latest release from the source code as a docker installation.
+
+If you have the 3 required projects source code already, the next step can be omitted, and the 
+sources can be copied to the `.source/` directory. note: symlinks don't work.
 
-Download the source:
+  - https://code.rhodecode.com/rhodecode-vcsserver
+  - https://code.rhodecode.com/rhodecode-enterprise-ce
+  - https://code.rhodecode.com/rhodecode-enterprise-ee (assuming access is granted to this)
+
+Download the source using bootstrap script:
 
 ```shell
 cd .boostrap/ && ./download-source.sh && cd ../
 ```
 
 This step will create source code copies into the `.source/` path. e.g
 ```
 -rw-r--r-- 1 docker docker    0 Nov 25 12:27 .dirkeep
 drwxr-xr-x 1 docker docker 1184 Nov 25 12:27 rhodecode-enterprise-ce
 drwxr-xr-x 1 docker docker 1120 Nov 25 12:27 rhodecode-enterprise-ee
 drwxr-xr-x 1 docker docker  800 Nov 25 12:27 rhodecode-vcsserver
 ```
 
-If you have the source already, this step can be omitted, and the 
-sources can be linked or copied to this directory
-
+With this done, you can now proceed with every step of normal source installation (Creating & building images), but instead of using
+just `docker-compose` command it needs to be replaced with `docker-compose -f docker-compose.yaml -f docker-compose.source.yaml`
 
-Build the source based image
+For example to override the installer build with the source `rhodecode` based image, and also setting proper version, run:
 
 ```shell
-docker-compose -f docker-compose.yaml -f docker-compose.source.yaml build --no-cache --progress=plain rhodecode
+RC_VERSION="4.27.0.REL202221020" docker-compose -f docker-compose-apps.yaml -f docker-compose.source.yaml build --no-cache --progress=plain rhodecode
 ```
 
-to create a source install override and build based on the downloaded sources.
-
-
-Logging is pushed to stdout from all services.
+NOTE THAT it's recommended to keep rc_version and source_Ver the same
 
 ## Simple build
 
 Build docker RhodeCode `Community` without any dependencies (redis, external db) using 
 simple sqlite database and file based caches. 
 This is a fully running instance good for small use with 3-5 users.
 
 ```shell
-docker build -t rhodecode:4.23.2 -f rhodecode.dockerfile \
+docker build -t rhodecode/rhodecode-ce:4.23.2 -f rhodecode.dockerfile \
 -e RHODECODE_TYPE=Community \
 -e RHODECODE_VERSION=4.23.2 \
 -e RHODECODE_DB=sqlite \
 -e RHODECODE_USER_NAME=admin \
 -e RHODECODE_USER_PASS=secret4 \
 -e RHODECODE_USER_EMAIL=[e-mail] \
 .
 ```
 
 note: for debugging better to add `--progress plain` into the build command to obtain all the output from the build.
 To Build against existing running Postgres or MySQL you can specify:
 
     --build-arg RHODECODE_DB=postgresql://postgres:secret@database/rhodecode
     --build-arg RHODECODE_DB=mysql://root:secret@localhost/rhodecode?charset=utf8
 
 
 To copy over the data into volumes use such command:
 ```shell
 docker run -v logvolume:/data --name data_vol busybox true
 docker cp . data_vol:/data
 docker rm data_vol
 ```
 
 Run the container, mounting the required volumes. By default the application would be
 available at http://localhost:10020, and default login is (unless specified differently in the build command)
 
 ```
 user: admin
 password: secret4
 ```
 
 We've not built our image using specific version. It's time to run it:
+We specify the run.ini by selecting config option we have locally
 
 ```shell
 docker run \
   --name rhodecode-container \
   --publish 10020:10020 \
   --restart unless-stopped \
   --volume $PWD/config:/etc/rhodecode/conf \
+  --volume $PWD/config/rhodecode.optimized.ini:/etc/rhodecode/conf_build/run.ini \
   --volume $PWD/logs:/var/log/rhodecode \
-  'rhodecode:4.23.2'
+  'rhodecode/rhodecode-ee:4.23.2'
 ```
 
 Enter container
 
 ```shell
 docker exec -it rhodecode-container /bin/bash
 ```
 
 Enter interactive shell
 
 ```shell
-docker exec -it rhodecode-container /var/opt/rhodecode_bin/bin/rc-ishell /etc/rhodecode/conf/rhodecode.ini
+docker exec -it rhodecode-container /usr/local/bin/rhodecode_bin/bin/rc-ishell /etc/rhodecode/conf/rhodecode.ini
 ```
 
 Run Database migrations
 ```shell
-docker exec -it rhodecode-container /var/opt/rhodecode_bin/bin/rc-upgrade-db /etc/rhodecode/conf/rhodecode.ini --force-yes
-```
  No newline at end of file
+docker exec -it rhodecode-container /usr/local/bin/rhodecode_bin/bin/rc-upgrade-db /etc/rhodecode/conf/rhodecode.ini --force-yes
+```
+
+
+
+### Registry for docker swarm
+
+docker run -d -p 5000:5000 --restart always --name registry registry:2
  No newline at end of file

config/database/pg_customized.conf

@@ -1,808 +1,810 b''
+## docker run -i --rm postgres cat /usr/share/postgresql/postgresql.conf.sample > my-postgres.conf
 # -----------------------------
 # PostgreSQL configuration file
 # -----------------------------
 #
 # This file consists of lines of the form:
 #
 #   name = value
 #
 # (The "=" is optional.)  Whitespace may be used.  Comments are introduced with
 # "#" anywhere on a line.  The complete list of parameter names and allowed
 # values can be found in the PostgreSQL documentation.
 #
 # The commented-out settings shown in this file represent the default values.
 # Re-commenting a setting is NOT sufficient to revert it to the default value;
 # you need to reload the server.
 #
 # This file is read on server startup and when the server receives a SIGHUP
 # signal.  If you edit the file on a running system, you have to SIGHUP the
 # server for the changes to take effect, run "pg_ctl reload", or execute
 # "SELECT pg_reload_conf()".  Some parameters, which are marked below,
 # require a server shutdown and restart to take effect.
 #
 # Any parameter can also be given as a command-line option to the server, e.g.,
 # "postgres -c log_connections=on".  Some parameters can be changed at run time
 # with the "SET" SQL command.
 #
 # Memory units:  B  = bytes            Time units:  us  = microseconds
 #                kB = kilobytes                     ms  = milliseconds
 #                MB = megabytes                     s   = seconds
 #                GB = gigabytes                     min = minutes
 #                TB = terabytes                     h   = hours
 #                                                   d   = days
 
 
 #------------------------------------------------------------------------------
 # FILE LOCATIONS
 #------------------------------------------------------------------------------
 
 # The default values of these variables are driven from the -D command-line
 # option or PGDATA environment variable, represented here as ConfigDir.
 
 #data_directory = 'ConfigDir'		# use data in another directory
 					# (change requires restart)
 #hba_file = 'ConfigDir/pg_hba.conf'	# host-based authentication file
 					# (change requires restart)
 #ident_file = 'ConfigDir/pg_ident.conf'	# ident configuration file
 					# (change requires restart)
 
 # If external_pid_file is not explicitly set, no extra PID file is written.
 #external_pid_file = ''			# write an extra PID file
 					# (change requires restart)
 
 
 #------------------------------------------------------------------------------
 # CONNECTIONS AND AUTHENTICATION
 #------------------------------------------------------------------------------
 
 # - Connection Settings -
 
 listen_addresses = '*'
 					# comma-separated list of addresses;
 					# defaults to 'localhost'; use '*' for all
 					# (change requires restart)
 #port = 5432				# (change requires restart)
 #max_connections = 100			# (change requires restart)
 #superuser_reserved_connections = 3	# (change requires restart)
 #unix_socket_directories = '/tmp'	# comma-separated list of directories
 					# (change requires restart)
 #unix_socket_group = ''			# (change requires restart)
 #unix_socket_permissions = 0777		# begin with 0 to use octal notation
 					# (change requires restart)
 #bonjour = off				# advertise server via Bonjour
 					# (change requires restart)
 #bonjour_name = ''			# defaults to the computer name
 					# (change requires restart)
 
 # - TCP settings -
 # see "man tcp" for details
 
 #tcp_keepalives_idle = 0		# TCP_KEEPIDLE, in seconds;
 					# 0 selects the system default
 #tcp_keepalives_interval = 0		# TCP_KEEPINTVL, in seconds;
 					# 0 selects the system default
 #tcp_keepalives_count = 0		# TCP_KEEPCNT;
 					# 0 selects the system default
 #tcp_user_timeout = 0			# TCP_USER_TIMEOUT, in milliseconds;
 					# 0 selects the system default
 
 #client_connection_check_interval = 0	# time between checks for client
 					# disconnection while running queries;
 					# 0 for never
 
 # - Authentication -
 
 #authentication_timeout = 1min		# 1s-600s
-#password_encryption = scram-sha-256	# scram-sha-256 or md5
+#note; Rhodecode needs to use old md5 for backward compat
+password_encryption = md5	# scram-sha-256 or md5
 #db_user_namespace = off
 
 # GSSAPI using Kerberos
 #krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
 #krb_caseins_users = off
 
 # - SSL -
 
 #ssl = off
 #ssl_ca_file = ''
 #ssl_cert_file = 'server.crt'
 #ssl_crl_file = ''
 #ssl_crl_dir = ''
 #ssl_key_file = 'server.key'
 #ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
 #ssl_prefer_server_ciphers = on
 #ssl_ecdh_curve = 'prime256v1'
 #ssl_min_protocol_version = 'TLSv1.2'
 #ssl_max_protocol_version = ''
 #ssl_dh_params_file = ''
 #ssl_passphrase_command = ''
 #ssl_passphrase_command_supports_reload = off
 
 
 #------------------------------------------------------------------------------
 # RESOURCE USAGE (except WAL)
 #------------------------------------------------------------------------------
 
 # - Memory -
 
 #shared_buffers = 32MB			# min 128kB
 					# (change requires restart)
 #huge_pages = try			# on, off, or try
 					# (change requires restart)
 #huge_page_size = 0			# zero for system default
 					# (change requires restart)
 #temp_buffers = 8MB			# min 800kB
 #max_prepared_transactions = 0		# zero disables the feature
 					# (change requires restart)
 # Caution: it is not advisable to set max_prepared_transactions nonzero unless
 # you actively intend to use prepared transactions.
 #work_mem = 4MB				# min 64kB
 #hash_mem_multiplier = 1.0		# 1-1000.0 multiplier on hash table work_mem
 #maintenance_work_mem = 64MB		# min 1MB
 #autovacuum_work_mem = -1		# min 1MB, or -1 to use maintenance_work_mem
 #logical_decoding_work_mem = 64MB	# min 64kB
 #max_stack_depth = 2MB			# min 100kB
 #shared_memory_type = mmap		# the default is the first option
 					# supported by the operating system:
 					#   mmap
 					#   sysv
 					#   windows
 					# (change requires restart)
 #dynamic_shared_memory_type = posix	# the default is the first option
 					# supported by the operating system:
 					#   posix
 					#   sysv
 					#   windows
 					#   mmap
 					# (change requires restart)
 #min_dynamic_shared_memory = 0MB	# (change requires restart)
 
 # - Disk -
 
 #temp_file_limit = -1			# limits per-process temp file space
 					# in kilobytes, or -1 for no limit
 
 # - Kernel Resources -
 
 #max_files_per_process = 1000		# min 64
 					# (change requires restart)
 
 # - Cost-Based Vacuum Delay -
 
 #vacuum_cost_delay = 0			# 0-100 milliseconds (0 disables)
 #vacuum_cost_page_hit = 1		# 0-10000 credits
 #vacuum_cost_page_miss = 2		# 0-10000 credits
 #vacuum_cost_page_dirty = 20		# 0-10000 credits
 #vacuum_cost_limit = 200		# 1-10000 credits
 
 # - Background Writer -
 
 #bgwriter_delay = 200ms			# 10-10000ms between rounds
 #bgwriter_lru_maxpages = 100		# max buffers written/round, 0 disables
 #bgwriter_lru_multiplier = 2.0		# 0-10.0 multiplier on buffers scanned/round
 #bgwriter_flush_after = 0		# measured in pages, 0 disables
 
 # - Asynchronous Behavior -
 
 #backend_flush_after = 0		# measured in pages, 0 disables
 #effective_io_concurrency = 1		# 1-1000; 0 disables prefetching
 #maintenance_io_concurrency = 10	# 1-1000; 0 disables prefetching
 #max_worker_processes = 8		# (change requires restart)
 #max_parallel_workers_per_gather = 2	# taken from max_parallel_workers
 #max_parallel_maintenance_workers = 2	# taken from max_parallel_workers
 #max_parallel_workers = 8		# maximum number of max_worker_processes that
 					# can be used in parallel operations
 #parallel_leader_participation = on
 #old_snapshot_threshold = -1		# 1min-60d; -1 disables; 0 is immediate
 					# (change requires restart)
 
 
 #------------------------------------------------------------------------------
 # WRITE-AHEAD LOG
 #------------------------------------------------------------------------------
 
 # - Settings -
 
 #wal_level = replica			# minimal, replica, or logical
 					# (change requires restart)
 #fsync = on				# flush data to disk for crash safety
 					# (turning this off can cause
 					# unrecoverable data corruption)
 #synchronous_commit = on		# synchronization level;
 					# off, local, remote_write, remote_apply, or on
 #wal_sync_method = fsync		# the default is the first option
 					# supported by the operating system:
 					#   open_datasync
 					#   fdatasync (default on Linux and FreeBSD)
 					#   fsync
 					#   fsync_writethrough
 					#   open_sync
 #full_page_writes = on			# recover from partial page writes
 #wal_log_hints = off			# also do full page writes of non-critical updates
 					# (change requires restart)
 #wal_compression = off			# enable compression of full-page writes
 #wal_init_zero = on			# zero-fill new WAL files
 #wal_recycle = on			# recycle WAL files
 #wal_buffers = -1			# min 32kB, -1 sets based on shared_buffers
 					# (change requires restart)
 #wal_writer_delay = 200ms		# 1-10000 milliseconds
 #wal_writer_flush_after = 1MB		# measured in pages, 0 disables
 #wal_skip_threshold = 2MB
 
 #commit_delay = 0			# range 0-100000, in microseconds
 #commit_siblings = 5			# range 1-1000
 
 # - Checkpoints -
 
 #checkpoint_timeout = 5min		# range 30s-1d
 #checkpoint_completion_target = 0.9	# checkpoint target duration, 0.0 - 1.0
 #checkpoint_flush_after = 0		# measured in pages, 0 disables
 #checkpoint_warning = 30s		# 0 disables
 #max_wal_size = 1GB
 #min_wal_size = 80MB
 
 # - Archiving -
 
 #archive_mode = off		# enables archiving; off, on, or always
 				# (change requires restart)
 #archive_command = ''		# command to use to archive a logfile segment
 				# placeholders: %p = path of file to archive
 				#               %f = file name only
 				# e.g. 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f'
 #archive_timeout = 0		# force a logfile segment switch after this
 				# number of seconds; 0 disables
 
 # - Archive Recovery -
 
 # These are only used in recovery mode.
 
 #restore_command = ''		# command to use to restore an archived logfile segment
 				# placeholders: %p = path of file to restore
 				#               %f = file name only
 				# e.g. 'cp /mnt/server/archivedir/%f %p'
 #archive_cleanup_command = ''	# command to execute at every restartpoint
 #recovery_end_command = ''	# command to execute at completion of recovery
 
 # - Recovery Target -
 
 # Set these only when performing a targeted recovery.
 
 #recovery_target = ''		# 'immediate' to end recovery as soon as a
                                 # consistent state is reached
 				# (change requires restart)
 #recovery_target_name = ''	# the named restore point to which recovery will proceed
 				# (change requires restart)
 #recovery_target_time = ''	# the time stamp up to which recovery will proceed
 				# (change requires restart)
 #recovery_target_xid = ''	# the transaction ID up to which recovery will proceed
 				# (change requires restart)
 #recovery_target_lsn = ''	# the WAL LSN up to which recovery will proceed
 				# (change requires restart)
 #recovery_target_inclusive = on # Specifies whether to stop:
 				# just after the specified recovery target (on)
 				# just before the recovery target (off)
 				# (change requires restart)
 #recovery_target_timeline = 'latest'	# 'current', 'latest', or timeline ID
 				# (change requires restart)
 #recovery_target_action = 'pause'	# 'pause', 'promote', 'shutdown'
 				# (change requires restart)
 
 
 #------------------------------------------------------------------------------
 # REPLICATION
 #------------------------------------------------------------------------------
 
 # - Sending Servers -
 
 # Set these on the primary and on any standby that will send replication data.
 
 #max_wal_senders = 10		# max number of walsender processes
 				# (change requires restart)
 #max_replication_slots = 10	# max number of replication slots
 				# (change requires restart)
 #wal_keep_size = 0		# in megabytes; 0 disables
 #max_slot_wal_keep_size = -1	# in megabytes; -1 disables
 #wal_sender_timeout = 60s	# in milliseconds; 0 disables
 #track_commit_timestamp = off	# collect timestamp of transaction commit
 				# (change requires restart)
 
 # - Primary Server -
 
 # These settings are ignored on a standby server.
 
 #synchronous_standby_names = ''	# standby servers that provide sync rep
 				# method to choose sync standbys, number of sync standbys,
 				# and comma-separated list of application_name
 				# from standby(s); '*' = all
 #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
 
 # - Standby Servers -
 
 # These settings are ignored on a primary server.
 
 #primary_conninfo = ''			# connection string to sending server
 #primary_slot_name = ''			# replication slot on sending server
 #promote_trigger_file = ''		# file name whose presence ends recovery
 #hot_standby = on			# "off" disallows queries during recovery
 					# (change requires restart)
 #max_standby_archive_delay = 30s	# max delay before canceling queries
 					# when reading WAL from archive;
 					# -1 allows indefinite delay
 #max_standby_streaming_delay = 30s	# max delay before canceling queries
 					# when reading streaming WAL;
 					# -1 allows indefinite delay
 #wal_receiver_create_temp_slot = off	# create temp slot if primary_slot_name
 					# is not set
 #wal_receiver_status_interval = 10s	# send replies at least this often
 					# 0 disables
 #hot_standby_feedback = off		# send info from standby to prevent
 					# query conflicts
 #wal_receiver_timeout = 60s		# time that receiver waits for
 					# communication from primary
 					# in milliseconds; 0 disables
 #wal_retrieve_retry_interval = 5s	# time to wait before retrying to
 					# retrieve WAL after a failed attempt
 #recovery_min_apply_delay = 0		# minimum delay for applying changes during recovery
 
 # - Subscribers -
 
 # These settings are ignored on a publisher.
 
 #max_logical_replication_workers = 4	# taken from max_worker_processes
 					# (change requires restart)
 #max_sync_workers_per_subscription = 2	# taken from max_logical_replication_workers
 
 
 #------------------------------------------------------------------------------
 # QUERY TUNING
 #------------------------------------------------------------------------------
 
 # - Planner Method Configuration -
 
 #enable_async_append = on
 #enable_bitmapscan = on
 #enable_gathermerge = on
 #enable_hashagg = on
 #enable_hashjoin = on
 #enable_incremental_sort = on
 #enable_indexscan = on
 #enable_indexonlyscan = on
 #enable_material = on
 #enable_memoize = on
 #enable_mergejoin = on
 #enable_nestloop = on
 #enable_parallel_append = on
 #enable_parallel_hash = on
 #enable_partition_pruning = on
 #enable_partitionwise_join = off
 #enable_partitionwise_aggregate = off
 #enable_seqscan = on
 #enable_sort = on
 #enable_tidscan = on
 
 # - Planner Cost Constants -
 
 #seq_page_cost = 1.0			# measured on an arbitrary scale
 #random_page_cost = 4.0			# same scale as above
 #cpu_tuple_cost = 0.01			# same scale as above
 #cpu_index_tuple_cost = 0.005		# same scale as above
 #cpu_operator_cost = 0.0025		# same scale as above
 #parallel_setup_cost = 1000.0	# same scale as above
 #parallel_tuple_cost = 0.1		# same scale as above
 #min_parallel_table_scan_size = 8MB
 #min_parallel_index_scan_size = 512kB
 #effective_cache_size = 4GB
 
 #jit_above_cost = 100000		# perform JIT compilation if available
 					# and query more expensive than this;
 					# -1 disables
 #jit_inline_above_cost = 500000		# inline small functions if query is
 					# more expensive than this; -1 disables
 #jit_optimize_above_cost = 500000	# use expensive JIT optimizations if
 					# query is more expensive than this;
 					# -1 disables
 
 # - Genetic Query Optimizer -
 
 #geqo = on
 #geqo_threshold = 12
 #geqo_effort = 5			# range 1-10
 #geqo_pool_size = 0			# selects default based on effort
 #geqo_generations = 0			# selects default based on effort
 #geqo_selection_bias = 2.0		# range 1.5-2.0
 #geqo_seed = 0.0			# range 0.0-1.0
 
 # - Other Planner Options -
 
 #default_statistics_target = 100	# range 1-10000
 #constraint_exclusion = partition	# on, off, or partition
 #cursor_tuple_fraction = 0.1		# range 0.0-1.0
 #from_collapse_limit = 8
 #jit = on				# allow JIT compilation
 #join_collapse_limit = 8		# 1 disables collapsing of explicit
 					# JOIN clauses
 #plan_cache_mode = auto			# auto, force_generic_plan or
 					# force_custom_plan
 
 
 #------------------------------------------------------------------------------
 # REPORTING AND LOGGING
 #------------------------------------------------------------------------------
 
 # - Where to Log -
 
 log_destination = 'stderr'		# Valid values are combinations of
 					# stderr, csvlog, syslog, and eventlog,
 					# depending on platform.  csvlog
 					# requires logging_collector to be on.
 
 # This is used when logging to stderr:
-logging_collector = on		# Enable capturing of stderr and csvlog
+#logging_collector = on		# Enable capturing of stderr and csvlog
 					# into log files. Required to be on for
 					# csvlogs.
 					# (change requires restart)
 
 # These are only used if logging_collector is on:
-log_directory = '/var/log/rhodecode/postgres'			# directory where log files are written,
+#log_directory = '/var/log/rhodecode/postgres'			# directory where log files are written,
 					# can be absolute or relative to PGDATA
-log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'	# log file name pattern,
+#log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'	# log file name pattern,
 					# can include strftime() escapes
 #log_file_mode = 0600			# creation mode for log files,
 					# begin with 0 to use octal notation
 #log_rotation_age = 1d			# Automatic rotation of logfiles will
 					# happen after that time.  0 disables.
-log_rotation_size = 512MB		# Automatic rotation of logfiles will
+#log_rotation_size = 512MB		# Automatic rotation of logfiles will
 					# happen after that much log output.
 					# 0 disables.
 #log_truncate_on_rotation = off		# If on, an existing log file with the
 					# same name as the new log file will be
 					# truncated rather than appended to.
 					# But such truncation only occurs on
 					# time-driven rotation, not on restarts
 					# or size-driven rotation.  Default is
 					# off, meaning append to existing files
 					# in all cases.
 
 # These are relevant when logging to syslog:
 #syslog_facility = 'LOCAL0'
 #syslog_ident = 'postgres'
 #syslog_sequence_numbers = on
 #syslog_split_messages = on
 
 # This is only relevant when logging to eventlog (Windows):
 # (change requires restart)
 #event_source = 'PostgreSQL'
 
 # - When to Log -
 
 #log_min_messages = warning		# values in order of decreasing detail:
 					#   debug5
 					#   debug4
 					#   debug3
 					#   debug2
 					#   debug1
 					#   info
 					#   notice
 					#   warning
 					#   error
 					#   log
 					#   fatal
 					#   panic
 
 #log_min_error_statement = error	# values in order of decreasing detail:
 					#   debug5
 					#   debug4
 					#   debug3
 					#   debug2
 					#   debug1
 					#   info
 					#   notice
 					#   warning
 					#   error
 					#   log
 					#   fatal
 					#   panic (effectively off)
 
 log_min_duration_statement = 1000	# -1 is disabled, 0 logs all statements
 					# and their durations, > 0 logs only
 					# statements running at least this number
 					# of milliseconds
 
 #log_min_duration_sample = -1		# -1 is disabled, 0 logs a sample of statements
 					# and their durations, > 0 logs only a sample of
 					# statements running at least this number
 					# of milliseconds;
 					# sample fraction is determined by log_statement_sample_rate
 
 #log_statement_sample_rate = 1.0	# fraction of logged statements exceeding
 					# log_min_duration_sample to be logged;
 					# 1.0 logs all such statements, 0.0 never logs
 
 
 #log_transaction_sample_rate = 0.0	# fraction of transactions whose statements
 					# are logged regardless of their duration; 1.0 logs all
 					# statements from all transactions, 0.0 never logs
 
 # - What to Log -
 
 #debug_print_parse = off
 #debug_print_rewritten = off
 #debug_print_plan = off
 #debug_pretty_print = on
 #log_autovacuum_min_duration = -1	# log autovacuum activity;
 					# -1 disables, 0 logs all actions and
 					# their durations, > 0 logs only
 					# actions running at least this number
 					# of milliseconds.
 #log_checkpoints = off
-#log_connections = off
+log_connections = off
 #log_disconnections = off
 #log_duration = off
 #log_error_verbosity = default		# terse, default, or verbose messages
 #log_hostname = off
 #log_line_prefix = '%m [%p] '		# special values:
 					#   %a = application name
 					#   %u = user name
 					#   %d = database name
 					#   %r = remote host and port
 					#   %h = remote host
 					#   %b = backend type
 					#   %p = process ID
 					#   %P = process ID of parallel group leader
 					#   %t = timestamp without milliseconds
 					#   %m = timestamp with milliseconds
 					#   %n = timestamp with milliseconds (as a Unix epoch)
 					#   %Q = query ID (0 if none or not computed)
 					#   %i = command tag
 					#   %e = SQL state
 					#   %c = session ID
 					#   %l = session line number
 					#   %s = session start timestamp
 					#   %v = virtual transaction ID
 					#   %x = transaction ID (0 if none)
 					#   %q = stop here in non-session
 					#        processes
 					#   %% = '%'
 					# e.g. '<%u%%%d> '
 #log_lock_waits = off			# log lock waits >= deadlock_timeout
 #log_recovery_conflict_waits = off	# log standby recovery conflict waits
 					# >= deadlock_timeout
 #log_parameter_max_length = -1		# when logging statements, limit logged
 					# bind-parameter values to N bytes;
 					# -1 means print in full, 0 disables
 #log_parameter_max_length_on_error = 0	# when logging an error, limit logged
 					# bind-parameter values to N bytes;
 					# -1 means print in full, 0 disables
 #log_statement = 'none'			# none, ddl, mod, all
 #log_replication_commands = off
 #log_temp_files = -1			# log temporary files equal or larger
 					# than the specified size in kilobytes;
 					# -1 disables, 0 logs all temp files
 #log_timezone = 'GMT'
 
 
 #------------------------------------------------------------------------------
 # PROCESS TITLE
 #------------------------------------------------------------------------------
 
 #cluster_name = ''			# added to process titles if nonempty
 					# (change requires restart)
 #update_process_title = on
 
 
 #------------------------------------------------------------------------------
 # STATISTICS
 #------------------------------------------------------------------------------
 
 # - Query and Index Statistics Collector -
 
 #track_activities = on
 #track_activity_query_size = 1024	# (change requires restart)
 #track_counts = on
 #track_io_timing = off
 #track_wal_io_timing = off
 #track_functions = none			# none, pl, all
 #stats_temp_directory = 'pg_stat_tmp'
 
 
 # - Monitoring -
 
 #compute_query_id = auto
 #log_statement_stats = off
 #log_parser_stats = off
 #log_planner_stats = off
 #log_executor_stats = off
 
 
 #------------------------------------------------------------------------------
 # AUTOVACUUM
 #------------------------------------------------------------------------------
 
 #autovacuum = on			# Enable autovacuum subprocess?  'on'
 					# requires track_counts to also be on.
 #autovacuum_max_workers = 3		# max number of autovacuum subprocesses
 					# (change requires restart)
 #autovacuum_naptime = 1min		# time between autovacuum runs
 #autovacuum_vacuum_threshold = 50	# min number of row updates before
 					# vacuum
 #autovacuum_vacuum_insert_threshold = 1000	# min number of row inserts
 					# before vacuum; -1 disables insert
 					# vacuums
 #autovacuum_analyze_threshold = 50	# min number of row updates before
 					# analyze
 #autovacuum_vacuum_scale_factor = 0.2	# fraction of table size before vacuum
 #autovacuum_vacuum_insert_scale_factor = 0.2	# fraction of inserts over table
 					# size before insert vacuum
 #autovacuum_analyze_scale_factor = 0.1	# fraction of table size before analyze
 #autovacuum_freeze_max_age = 200000000	# maximum XID age before forced vacuum
 					# (change requires restart)
 #autovacuum_multixact_freeze_max_age = 400000000	# maximum multixact age
 					# before forced vacuum
 					# (change requires restart)
 #autovacuum_vacuum_cost_delay = 2ms	# default vacuum cost delay for
 					# autovacuum, in milliseconds;
 					# -1 means use vacuum_cost_delay
 #autovacuum_vacuum_cost_limit = -1	# default vacuum cost limit for
 					# autovacuum, -1 means use
 					# vacuum_cost_limit
 
 
 #------------------------------------------------------------------------------
 # CLIENT CONNECTION DEFAULTS
 #------------------------------------------------------------------------------
 
 # - Statement Behavior -
 
 #client_min_messages = notice		# values in order of decreasing detail:
 					#   debug5
 					#   debug4
 					#   debug3
 					#   debug2
 					#   debug1
 					#   log
 					#   notice
 					#   warning
 					#   error
 #search_path = '"$user", public'	# schema names
 #row_security = on
 #default_table_access_method = 'heap'
 #default_tablespace = ''		# a tablespace name, '' uses the default
 #default_toast_compression = 'pglz'	# 'pglz' or 'lz4'
 #temp_tablespaces = ''			# a list of tablespace names, '' uses
 					# only default tablespace
 #check_function_bodies = on
 #default_transaction_isolation = 'read committed'
 #default_transaction_read_only = off
 #default_transaction_deferrable = off
 #session_replication_role = 'origin'
 #statement_timeout = 0			# in milliseconds, 0 is disabled
 #lock_timeout = 0			# in milliseconds, 0 is disabled
 #idle_in_transaction_session_timeout = 0	# in milliseconds, 0 is disabled
 #idle_session_timeout = 0		# in milliseconds, 0 is disabled
 #vacuum_freeze_table_age = 150000000
 #vacuum_freeze_min_age = 50000000
 #vacuum_failsafe_age = 1600000000
 #vacuum_multixact_freeze_table_age = 150000000
 #vacuum_multixact_freeze_min_age = 5000000
 #vacuum_multixact_failsafe_age = 1600000000
 #bytea_output = 'hex'			# hex, escape
 #xmlbinary = 'base64'
 #xmloption = 'content'
 #gin_pending_list_limit = 4MB
 
 # - Locale and Formatting -
 
 #datestyle = 'iso, mdy'
 #intervalstyle = 'postgres'
 #timezone = 'GMT'
 #timezone_abbreviations = 'Default'     # Select the set of available time zone
 					# abbreviations.  Currently, there are
 					#   Default
 					#   Australia (historical usage)
 					#   India
 					# You can create your own file in
 					# share/timezonesets/.
 #extra_float_digits = 1			# min -15, max 3; any value >0 actually
 					# selects precise output mode
 #client_encoding = sql_ascii		# actually, defaults to database
 					# encoding
 
 # These settings are initialized by initdb, but they can be changed.
 #lc_messages = 'C'			# locale for system error message
 					# strings
 #lc_monetary = 'C'			# locale for monetary formatting
 #lc_numeric = 'C'			# locale for number formatting
 #lc_time = 'C'				# locale for time formatting
 
 # default configuration for text search
 #default_text_search_config = 'pg_catalog.simple'
 
 # - Shared Library Preloading -
 
 #local_preload_libraries = ''
 #session_preload_libraries = ''
 #shared_preload_libraries = ''	# (change requires restart)
 #jit_provider = 'llvmjit'		# JIT library to use
 
 # - Other Defaults -
 
 #dynamic_library_path = '$libdir'
 #extension_destdir = ''			# prepend path when loading extensions
 					# and shared objects (added by Debian)
 #gin_fuzzy_search_limit = 0
 
 
 #------------------------------------------------------------------------------
 # LOCK MANAGEMENT
 #------------------------------------------------------------------------------
 
 #deadlock_timeout = 1s
 #max_locks_per_transaction = 64		# min 10
 					# (change requires restart)
 #max_pred_locks_per_transaction = 64	# min 10
 					# (change requires restart)
 #max_pred_locks_per_relation = -2	# negative values mean
 					# (max_pred_locks_per_transaction
 					#  / -max_pred_locks_per_relation) - 1
 #max_pred_locks_per_page = 2            # min 0
 
 
 #------------------------------------------------------------------------------
 # VERSION AND PLATFORM COMPATIBILITY
 #------------------------------------------------------------------------------
 
 # - Previous PostgreSQL Versions -
 
 #array_nulls = on
 #backslash_quote = safe_encoding	# on, off, or safe_encoding
 #escape_string_warning = on
 #lo_compat_privileges = off
 #quote_all_identifiers = off
 #standard_conforming_strings = on
 #synchronize_seqscans = on
 
 # - Other Platforms and Clients -
 
 #transform_null_equals = off
 
 
 #------------------------------------------------------------------------------
 # ERROR HANDLING
 #------------------------------------------------------------------------------
 
 #exit_on_error = off			# terminate session on any error?
 #restart_after_crash = on		# reinitialize after backend crash?
 #data_sync_retry = off			# retry or panic on failure to fsync
 					# data?
 					# (change requires restart)
 #recovery_init_sync_method = fsync	# fsync, syncfs (Linux 5.8+)
 
 
 #------------------------------------------------------------------------------
 # CONFIG FILE INCLUDES
 #------------------------------------------------------------------------------
 
 # These options allow settings to be loaded from files other than the
 # default postgresql.conf.  Note that these are directives, not variable
 # assignments, so they can usefully be given more than once.
 
 #include_dir = '...'			# include files ending in '.conf' from
 					# a directory, e.g., 'conf.d'
 #include_if_exists = '...'		# include file only if it exists
 #include = '...'			# include file
 
 
 #------------------------------------------------------------------------------
 # CUSTOMIZED OPTIONS
 #------------------------------------------------------------------------------
 
 # Add settings for extensions here
 
 max_connections = 400
 shared_buffers = 1GB
 effective_cache_size = 3GB
 work_mem = 2621kB
 maintenance_work_mem = 256MB
 checkpoint_completion_target = 0.9
 wal_buffers = 16MB
 default_statistics_target = 100
 password_encryption = md5

config/nginx/http.conf

@@ -1,132 +1,135 b''
 # read more here http://tautt.com/best-nginx-configuration-for-security/
 
 # config to don't allow the browser to render the page inside an frame or iframe
 # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
 # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
 # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
 #add_header X-Frame-Options SAMEORIGIN;
 
 # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
 # to disable content-type sniffing on some browsers.
 # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
 # currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
 # http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
 # 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
 #add_header X-Content-Type-Options nosniff;
 
 # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
 # It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
 # this particular website if it was disabled by the user.
 # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
 #add_header X-XSS-Protection "1; mode=block";
 
 # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
 # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
 # directives for css and js(if you have inline css or js, you will need to keep it too).
 # more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 #add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 
 ## rate limiter for certain pages to prevent brute force attacks
 limit_req_zone  $binary_remote_addr  zone=http_req_limit:10m   rate=1r/s;
 
 ## custom log format
 log_format http_log_custom '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time $pipe';
 
 log_format json_log_custom escape=json
   '{'
     '"source":"nginx",'
     '"remote_user":"$remote_user",'
     '"time_local":"$time_local",'
     '"remote_addr":"$remote_addr",'
     '"proxy_x_forwarded_for":"$proxy_add_x_forwarded_for",'
     '"request":"$request",'
     '"status": "$status",'
     '"request_method": "$request_method",'
     '"body_bytes_sent":"$body_bytes_sent",'
     '"request_time":"$request_time",'
     '"upstream_response_time":"$upstream_response_time",'
     '"http_referrer":"$http_referer",'
     '"http_user_agent":"$http_user_agent"'
   '}';
 
 
 server {
   listen 80 default;
   # ensure we get the proper Docker DNS resolver for load balancing.
   resolver 127.0.0.11 ipv6=off;
   server_name localhost 127.0.0.1;
-  access_log      /var/log/rhodecode/nginx/rhodecode.http.access.log json_log_custom;
-  error_log       /var/log/rhodecode/nginx/rhodecode.http.error.log;
+  access_log      /dev/stdout json_log_custom;
+  error_log       /dev/stdout;
 
-  # uncomment to redirect http traffic to https
+  # uncomment to redirect http traffic to https (not applicable in Docker setup)
   #return 301 https://$host$request_uri;
 
   client_body_buffer_size     128k;
   # maximum number and size of buffers for large headers to read from client request
   large_client_header_buffers 16 256k;
 
   ## serve static files by nginx, recommended
   location /_static/rhodecode {
       gzip on;
       gzip_min_length  500;
       gzip_proxied     any;
       gzip_comp_level 4;
       gzip_types  text/css text/javascript text/xml text/plain text/x-component application/javascript application/json application/xml application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
       gzip_vary on;
       gzip_disable     "msie6";
       expires 60d;
 
       alias /var/opt/rhodecode_data/static;
   }
 
   ## channelstream location handler, if channelstream live chat and notifications
   ## are enable this will proxy the requests to channelstream websocket server
   location /_channelstream {
       rewrite /_channelstream/(.*) /$1 break;
       gzip                         off;
       tcp_nodelay                  off;
 
       proxy_connect_timeout        10;
       proxy_send_timeout           10m;
       proxy_read_timeout           10m;
 
       proxy_set_header             Host $host;
       proxy_set_header             X-Real-IP $remote_addr;
       proxy_set_header             X-Url-Scheme $scheme;
       proxy_set_header             X-Forwarded-Proto $scheme;
       proxy_set_header             X-Forwarded-For $proxy_add_x_forwarded_for;
 
       proxy_http_version           1.1;
       proxy_set_header Upgrade     $http_upgrade;
       proxy_set_header Connection  "upgrade";
 
-      proxy_pass                   http://channelstream:9800;
+      set $upstream_channelstream  http://channelstream:8000;
+      proxy_pass                   $upstream_channelstream;
   }
 
-  ## rate limit this endpoint to prevent login page brute-force attacks
-  location /_admin/login {
-      limit_req  zone=http_req_limit  burst=10  nodelay;
-      try_files $uri @rhodecode_http;
-  }
+#   ## rate limit this endpoint to prevent login page brute-force attacks
+#   location /_admin/login {
+#       limit_req  zone=http_req_limit  burst=10  nodelay;
+#       try_files $uri @rhodecode_http;
+#   }
 
   location / {
-      include     /etc/nginx/proxy.conf;
-      try_files $uri @rhodecode_http;
+      include    /etc/nginx/proxy.conf;
+      try_files  $uri @rhodecode_http;
   }
 
   location @rhodecode_http {
-      include     /etc/nginx/proxy.conf;
-      proxy_pass  http://rhodecode:10020;
+      set $upstream  http://rhodecode:10020;
+      include        /etc/nginx/proxy.conf;
+      proxy_pass     $upstream;
   }
 
   ## Custom 502 error page.
   ## Will be displayed while RhodeCode server is turned off
   error_page 502 /502.html;
   location = /502.html {
-      root /var/opt/static;
+      root /var/opt/rhodecode_data/static;
+      internal;
   }
 
 }

config/nginx/nginx.conf

@@ -1,30 +1,31 b''
 user  root;
 worker_processes  2;
 
 pid        /var/run/nginx.pid;
-error_log  /var/log/rhodecode/nginx/default.error.log warn;
+error_log  /dev/stdout info;
 
 events {
     worker_connections  1024;
     # multi_accept on;
 }
 
 http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
+    server_tokens off;
 
     log_format main '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     '$request_time $upstream_response_time $pipe';
 
-    access_log  /var/log/rhodecode/nginx/default.access.log  main;
+    access_log /dev/stdout main;
 
     sendfile on;
     tcp_nopush on;
     tcp_nodelay on;
     keepalive_timeout 65;
     types_hash_max_size 2048;
 
-    include /etc/nginx/sites-enabled/*.conf;
+    include /etc/nginx/http.conf;
 }

config/prometheus/prometheus.yml

@@ -1,17 +1,23 b''
 global:
   scrape_interval: 15s
   evaluation_interval: 15s
 
 scrape_configs:
 
   # Scrape statsd exporter from RhodeCode
   - job_name: "rhodecode_metrics"
     metrics_path: "/metrics"
     static_configs:
       - targets: ["statsd-exporter:9102"]
 
   # scrape node exporter
   - job_name: node_metrics
     metrics_path: "/metrics"
     static_configs:
       - targets: ["node-exporter:9100"]
+
+  # scrape traefik node
+  - job_name: traefik_metrics
+    metrics_path: "/metrics"
+    static_configs:
+      - targets: ["traefik:7000"]

config/promtail/promtail-config.yaml

@@ -1,38 +1,38 b''
 server:
   http_listen_port: 9080
   grpc_listen_port: 0
 
 # Describes how to save read file offsets to disk
 positions:
   filename: /tmp/positions.yaml
 
 clients:
   - url: http://loki:3100/loki/api/v1/push
     tenant_id: docker
 
 ## Definition to what to scrape
 scrape_configs:
 
-- job_name: scraping_nginx
-  static_configs:
-  - targets:
-      - localhost
-    labels:
-      __path__: /var/log_volume/nginx/rhodecode*
-      job: nginx
-
-- job_name: scraping_vcsserver
-  static_configs:
-  - targets:
-      - localhost
-    labels:
-      __path__: /var/log_volume/apps/rhodecode*
-      job: rhodecode
-
-- job_name: scraping_rhodecode
-  static_configs:
-  - targets:
-      - localhost
-    labels:
-      __path__: /var/log_volume/apps/vcsserver*
-      job: vcsserver
  No newline at end of file
+#- job_name: scraping_nginx
+#  static_configs:
+#  - targets:
+#      - localhost
+#    labels:
+#      __path__: /var/log_volume/nginx/rhodecode*
+#      job: nginx
+#
+#- job_name: scraping_vcsserver
+#  static_configs:
+#  - targets:
+#      - localhost
+#    labels:
+#      __path__: /var/log_volume/apps/rhodecode*
+#      job: rhodecode
+#
+#- job_name: scraping_rhodecode
+#  static_configs:
+#  - targets:
+#      - localhost
+#    labels:
+#      __path__: /var/log_volume/apps/vcsserver*
+#      job: vcsserver
  No newline at end of file

config/redis/redis.conf

@@ -1,1865 +1,1865 b''
 # Redis configuration file example.
 #
 # Note that in order to read the configuration file, Redis must be
 # started with the file path as first argument:
 #
 # ./redis-server /path/to/redis.conf
 
 # Note on units: when memory size is needed, it is possible to specify
 # it in the usual form of 1k 5GB 4M and so forth:
 #
 # 1k => 1000 bytes
 # 1kb => 1024 bytes
 # 1m => 1000000 bytes
 # 1mb => 1024*1024 bytes
 # 1g => 1000000000 bytes
 # 1gb => 1024*1024*1024 bytes
 #
 # units are case insensitive so 1GB 1Gb 1gB are all the same.
 
 ################################## INCLUDES ###################################
 
 # Include one or more other config files here.  This is useful if you
 # have a standard template that goes to all Redis servers but also need
 # to customize a few per-server settings.  Include files can include
 # other files, so use this wisely.
 #
 # Note that option "include" won't be rewritten by command "CONFIG REWRITE"
 # from admin or Redis Sentinel. Since Redis always uses the last processed
 # line as value of a configuration directive, you'd better put includes
 # at the beginning of this file to avoid overwriting config change at runtime.
 #
 # If instead you are interested in using includes to override configuration
 # options, it is better to use include as the last line.
 #
 # include /path/to/local.conf
 # include /path/to/other.conf
 
 ################################## MODULES #####################################
 
 # Load modules at startup. If the server is not able to load modules
 # it will abort. It is possible to use multiple loadmodule directives.
 #
 # loadmodule /path/to/my_module.so
 # loadmodule /path/to/other_module.so
 
 ################################## NETWORK #####################################
 
 # By default, if no "bind" configuration directive is specified, Redis listens
 # for connections from all available network interfaces on the host machine.
 # It is possible to listen to just one or multiple selected interfaces using
 # the "bind" configuration directive, followed by one or more IP addresses.
 #
 # Examples:
 #
 # bind 192.168.1.100 10.0.0.1
 # bind 127.0.0.1 ::1
 #
 # ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the
 # internet, binding to all the interfaces is dangerous and will expose the
 # instance to everybody on the internet. So by default we uncomment the
 # following bind directive, that will force Redis to listen only on the
 # IPv4 loopback interface address (this means Redis will only be able to
 # accept client connections from the same host that it is running on).
 #
 # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES
 # JUST COMMENT OUT THE FOLLOWING LINE.
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #bind 127.0.0.1
 
 # Protected mode is a layer of security protection, in order to avoid that
 # Redis instances left open on the internet are accessed and exploited.
 #
 # When protected mode is on and if:
 #
 # 1) The server is not binding explicitly to a set of addresses using the
 #    "bind" directive.
 # 2) No password is configured.
 #
 # The server only accepts connections from clients connecting from the
 # IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain
 # sockets.
 #
 # By default protected mode is enabled. You should disable it only if
 # you are sure you want clients from other hosts to connect to Redis
 # even if no authentication is configured, nor a specific set of interfaces
 # are explicitly listed using the "bind" directive.
 protected-mode no
 
 # Accept connections on the specified port, default is 6379 (IANA #815344).
 # If port 0 is specified Redis will not listen on a TCP socket.
 port 6379
 
 # TCP listen() backlog.
 #
 # In high requests-per-second environments you need a high backlog in order
 # to avoid slow clients connection issues. Note that the Linux kernel
 # will silently truncate it to the value of /proc/sys/net/core/somaxconn so
 # make sure to raise both the value of somaxconn and tcp_max_syn_backlog
 # in order to get the desired effect.
 tcp-backlog 511
 
 # Unix socket.
 #
 # Specify the path for the Unix socket that will be used to listen for
 # incoming connections. There is no default, so Redis will not listen
 # on a unix socket when not specified.
 #
 # unixsocket /tmp/redis.sock
 # unixsocketperm 700
 
 # Close the connection after a client is idle for N seconds (0 to disable)
 timeout 0
 
 # TCP keepalive.
 #
 # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence
 # of communication. This is useful for two reasons:
 #
 # 1) Detect dead peers.
 # 2) Force network equipment in the middle to consider the connection to be
 #    alive.
 #
 # On Linux, the specified value (in seconds) is the period used to send ACKs.
 # Note that to close the connection the double of the time is needed.
 # On other kernels the period depends on the kernel configuration.
 #
 # A reasonable value for this option is 300 seconds, which is the new
 # Redis default starting with Redis 3.2.1.
 tcp-keepalive 300
 
 ################################# TLS/SSL #####################################
 
 # By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration
 # directive can be used to define TLS-listening ports. To enable TLS on the
 # default port, use:
 #
 # port 0
 # tls-port 6379
 
 # Configure a X.509 certificate and private key to use for authenticating the
 # server to connected clients, masters or cluster peers.  These files should be
 # PEM formatted.
 #
 # tls-cert-file redis.crt
 # tls-key-file redis.key
 
 # Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange:
 #
 # tls-dh-params-file redis.dh
 
 # Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL
 # clients and peers.  Redis requires an explicit configuration of at least one
 # of these, and will not implicitly use the system wide configuration.
 #
 # tls-ca-cert-file ca.crt
 # tls-ca-cert-dir /etc/ssl/certs
 
 # By default, clients (including replica servers) on a TLS port are required
 # to authenticate using valid client side certificates.
 #
 # If "no" is specified, client certificates are not required and not accepted.
 # If "optional" is specified, client certificates are accepted and must be
 # valid if provided, but are not required.
 #
 # tls-auth-clients no
 # tls-auth-clients optional
 
 # By default, a Redis replica does not attempt to establish a TLS connection
 # with its master.
 #
 # Use the following directive to enable TLS on replication links.
 #
 # tls-replication yes
 
 # By default, the Redis Cluster bus uses a plain TCP connection. To enable
 # TLS for the bus protocol, use the following directive:
 #
 # tls-cluster yes
 
 # Explicitly specify TLS versions to support. Allowed values are case insensitive
 # and include "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" (OpenSSL >= 1.1.1) or
 # any combination. To enable only TLSv1.2 and TLSv1.3, use:
 #
 # tls-protocols "TLSv1.2 TLSv1.3"
 
 # Configure allowed ciphers.  See the ciphers(1ssl) manpage for more information
 # about the syntax of this string.
 #
 # Note: this configuration applies only to <= TLSv1.2.
 #
 # tls-ciphers DEFAULT:!MEDIUM
 
 # Configure allowed TLSv1.3 ciphersuites.  See the ciphers(1ssl) manpage for more
 # information about the syntax of this string, and specifically for TLSv1.3
 # ciphersuites.
 #
 # tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256
 
 # When choosing a cipher, use the server's preference instead of the client
 # preference. By default, the server follows the client's preference.
 #
 # tls-prefer-server-ciphers yes
 
 # By default, TLS session caching is enabled to allow faster and less expensive
 # reconnections by clients that support it. Use the following directive to disable
 # caching.
 #
 # tls-session-caching no
 
 # Change the default number of TLS sessions cached. A zero value sets the cache
 # to unlimited size. The default size is 20480.
 #
 # tls-session-cache-size 5000
 
 # Change the default timeout of cached TLS sessions. The default timeout is 300
 # seconds.
 #
 # tls-session-cache-timeout 60
 
 ################################# GENERAL #####################################
 
 # By default Redis does not run as a daemon. Use 'yes' if you need it.
 # Note that Redis will write a pid file in /var/run/redis.pid when daemonized.
 daemonize no
 
 # If you run Redis from upstart or systemd, Redis can interact with your
 # supervision tree. Options:
 #   supervised no      - no supervision interaction
 #   supervised upstart - signal upstart by putting Redis into SIGSTOP mode
 #                        requires "expect stop" in your upstart job config
 #   supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET
 #   supervised auto    - detect upstart or systemd method based on
 #                        UPSTART_JOB or NOTIFY_SOCKET environment variables
 # Note: these supervision methods only signal "process is ready."
 #       They do not enable continuous pings back to your supervisor.
 supervised no
 
 # If a pid file is specified, Redis writes it where specified at startup
 # and removes it at exit.
 #
 # When the server runs non daemonized, no pid file is created if none is
 # specified in the configuration. When the server is daemonized, the pid file
 # is used even if not specified, defaulting to "/var/run/redis.pid".
 #
 # Creating a pid file is best effort: if Redis is not able to create it
 # nothing bad happens, the server will start and run normally.
 pidfile /var/run/redis_6379.pid
 
 # Specify the server verbosity level.
 # This can be one of:
 # debug (a lot of information, useful for development/testing)
 # verbose (many rarely useful info, but not a mess like the debug level)
 # notice (moderately verbose, what you want in production probably)
 # warning (only very important / critical messages are logged)
 loglevel notice
 
 # Specify the log file name. Also the empty string can be used to force
 # Redis to log on the standard output. Note that if you use standard
 # output for logging but daemonize, logs will be sent to /dev/null
 logfile ""
 
 # To enable logging to the system logger, just set 'syslog-enabled' to yes,
 # and optionally update the other syslog parameters to suit your needs.
 # syslog-enabled no
 
 # Specify the syslog identity.
 # syslog-ident redis
 
 # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.
 # syslog-facility local0
 
 # Set the number of databases. The default database is DB 0, you can select
 # a different one on a per-connection basis using SELECT <dbid> where
 # dbid is a number between 0 and 'databases'-1
 databases 16
 
 # By default Redis shows an ASCII art logo only when started to log to the
 # standard output and if the standard output is a TTY. Basically this means
 # that normally a logo is displayed only in interactive sessions.
 #
 # However it is possible to force the pre-4.0 behavior and always show a
 # ASCII art logo in startup logs by setting the following option to yes.
-always-show-logo yes
+always-show-logo no
 
 ################################ SNAPSHOTTING  ################################
 #
 # Save the DB on disk:
 #
 #   save <seconds> <changes>
 #
 #   Will save the DB if both the given number of seconds and the given
 #   number of write operations against the DB occurred.
 #
 #   In the example below the behavior will be to save:
 #   after 900 sec (15 min) if at least 1 key changed
 #   after 300 sec (5 min) if at least 10 keys changed
 #   after 60 sec if at least 10000 keys changed
 #
 #   Note: you can disable saving completely by commenting out all "save" lines.
 #
 #   It is also possible to remove all the previously configured save
 #   points by adding a save directive with a single empty string argument
 #   like in the following example:
 #
 #   save ""
 
 save 900 1
 save 300 10
 save 60 10000
 
 # By default Redis will stop accepting writes if RDB snapshots are enabled
 # (at least one save point) and the latest background save failed.
 # This will make the user aware (in a hard way) that data is not persisting
 # on disk properly, otherwise chances are that no one will notice and some
 # disaster will happen.
 #
 # If the background saving process will start working again Redis will
 # automatically allow writes again.
 #
 # However if you have setup your proper monitoring of the Redis server
 # and persistence, you may want to disable this feature so that Redis will
 # continue to work as usual even if there are problems with disk,
 # permissions, and so forth.
 stop-writes-on-bgsave-error yes
 
 # Compress string objects using LZF when dump .rdb databases?
 # By default compression is enabled as it's almost always a win.
 # If you want to save some CPU in the saving child set it to 'no' but
 # the dataset will likely be bigger if you have compressible values or keys.
 rdbcompression yes
 
 # Since version 5 of RDB a CRC64 checksum is placed at the end of the file.
 # This makes the format more resistant to corruption but there is a performance
 # hit to pay (around 10%) when saving and loading RDB files, so you can disable it
 # for maximum performances.
 #
 # RDB files created with checksum disabled have a checksum of zero that will
 # tell the loading code to skip the check.
 rdbchecksum yes
 
 # The filename where to dump the DB
 dbfilename redis_dump.rdb
 
 # Remove RDB files used by replication in instances without persistence
 # enabled. By default this option is disabled, however there are environments
 # where for regulations or other security concerns, RDB files persisted on
 # disk by masters in order to feed replicas, or stored on disk by replicas
 # in order to load them for the initial synchronization, should be deleted
 # ASAP. Note that this option ONLY WORKS in instances that have both AOF
 # and RDB persistence disabled, otherwise is completely ignored.
 #
 # An alternative (and sometimes better) way to obtain the same effect is
 # to use diskless replication on both master and replicas instances. However
 # in the case of replicas, diskless is not always an option.
 rdb-del-sync-files no
 
 # The working directory.
 #
 # The DB will be written inside this directory, with the filename specified
 # above using the 'dbfilename' configuration directive.
 #
 # The Append Only File will also be created inside this directory.
 #
 # Note that you must specify a directory here, not a file name.
-dir /var/opt/rhodecode_data/
+dir /data
 
 ################################# REPLICATION #################################
 
 # Master-Replica replication. Use replicaof to make a Redis instance a copy of
 # another Redis server. A few things to understand ASAP about Redis replication.
 #
 #   +------------------+      +---------------+
 #   |      Master      | ---> |    Replica    |
 #   | (receive writes) |      |  (exact copy) |
 #   +------------------+      +---------------+
 #
 # 1) Redis replication is asynchronous, but you can configure a master to
 #    stop accepting writes if it appears to be not connected with at least
 #    a given number of replicas.
 # 2) Redis replicas are able to perform a partial resynchronization with the
 #    master if the replication link is lost for a relatively small amount of
 #    time. You may want to configure the replication backlog size (see the next
 #    sections of this file) with a sensible value depending on your needs.
 # 3) Replication is automatic and does not need user intervention. After a
 #    network partition replicas automatically try to reconnect to masters
 #    and resynchronize with them.
 #
 # replicaof <masterip> <masterport>
 
 # If the master is password protected (using the "requirepass" configuration
 # directive below) it is possible to tell the replica to authenticate before
 # starting the replication synchronization process, otherwise the master will
 # refuse the replica request.
 #
 # masterauth <master-password>
 #
 # However this is not enough if you are using Redis ACLs (for Redis version
 # 6 or greater), and the default user is not capable of running the PSYNC
 # command and/or other commands needed for replication. In this case it's
 # better to configure a special user to use with replication, and specify the
 # masteruser configuration as such:
 #
 # masteruser <username>
 #
 # When masteruser is specified, the replica will authenticate against its
 # master using the new AUTH form: AUTH <username> <password>.
 
 # When a replica loses its connection with the master, or when the replication
 # is still in progress, the replica can act in two different ways:
 #
 # 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will
 #    still reply to client requests, possibly with out of date data, or the
 #    data set may just be empty if this is the first synchronization.
 #
 # 2) If replica-serve-stale-data is set to 'no' the replica will reply with
 #    an error "SYNC with master in progress" to all commands except:
 #    INFO, REPLICAOF, AUTH, PING, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE,
 #    UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST,
 #    HOST and LATENCY.
 #
 replica-serve-stale-data yes
 
 # You can configure a replica instance to accept writes or not. Writing against
 # a replica instance may be useful to store some ephemeral data (because data
 # written on a replica will be easily deleted after resync with the master) but
 # may also cause problems if clients are writing to it because of a
 # misconfiguration.
 #
 # Since Redis 2.6 by default replicas are read-only.
 #
 # Note: read only replicas are not designed to be exposed to untrusted clients
 # on the internet. It's just a protection layer against misuse of the instance.
 # Still a read only replica exports by default all the administrative commands
 # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve
 # security of read only replicas using 'rename-command' to shadow all the
 # administrative / dangerous commands.
 replica-read-only yes
 
 # Replication SYNC strategy: disk or socket.
 #
 # New replicas and reconnecting replicas that are not able to continue the
 # replication process just receiving differences, need to do what is called a
 # "full synchronization". An RDB file is transmitted from the master to the
 # replicas.
 #
 # The transmission can happen in two different ways:
 #
 # 1) Disk-backed: The Redis master creates a new process that writes the RDB
 #                 file on disk. Later the file is transferred by the parent
 #                 process to the replicas incrementally.
 # 2) Diskless: The Redis master creates a new process that directly writes the
 #              RDB file to replica sockets, without touching the disk at all.
 #
 # With disk-backed replication, while the RDB file is generated, more replicas
 # can be queued and served with the RDB file as soon as the current child
 # producing the RDB file finishes its work. With diskless replication instead
 # once the transfer starts, new replicas arriving will be queued and a new
 # transfer will start when the current one terminates.
 #
 # When diskless replication is used, the master waits a configurable amount of
 # time (in seconds) before starting the transfer in the hope that multiple
 # replicas will arrive and the transfer can be parallelized.
 #
 # With slow disks and fast (large bandwidth) networks, diskless replication
 # works better.
 repl-diskless-sync no
 
 # When diskless replication is enabled, it is possible to configure the delay
 # the server waits in order to spawn the child that transfers the RDB via socket
 # to the replicas.
 #
 # This is important since once the transfer starts, it is not possible to serve
 # new replicas arriving, that will be queued for the next RDB transfer, so the
 # server waits a delay in order to let more replicas arrive.
 #
 # The delay is specified in seconds, and by default is 5 seconds. To disable
 # it entirely just set it to 0 seconds and the transfer will start ASAP.
 repl-diskless-sync-delay 5
 
 # -----------------------------------------------------------------------------
 # WARNING: RDB diskless load is experimental. Since in this setup the replica
 # does not immediately store an RDB on disk, it may cause data loss during
 # failovers. RDB diskless load + Redis modules not handling I/O reads may also
 # cause Redis to abort in case of I/O errors during the initial synchronization
 # stage with the master. Use only if your do what you are doing.
 # -----------------------------------------------------------------------------
 #
 # Replica can load the RDB it reads from the replication link directly from the
 # socket, or store the RDB to a file and read that file after it was completely
 # received from the master.
 #
 # In many cases the disk is slower than the network, and storing and loading
 # the RDB file may increase replication time (and even increase the master's
 # Copy on Write memory and salve buffers).
 # However, parsing the RDB file directly from the socket may mean that we have
 # to flush the contents of the current database before the full rdb was
 # received. For this reason we have the following options:
 #
 # "disabled"    - Don't use diskless load (store the rdb file to the disk first)
 # "on-empty-db" - Use diskless load only when it is completely safe.
 # "swapdb"      - Keep a copy of the current db contents in RAM while parsing
 #                 the data directly from the socket. note that this requires
 #                 sufficient memory, if you don't have it, you risk an OOM kill.
 repl-diskless-load disabled
 
 # Replicas send PINGs to server in a predefined interval. It's possible to
 # change this interval with the repl_ping_replica_period option. The default
 # value is 10 seconds.
 #
 # repl-ping-replica-period 10
 
 # The following option sets the replication timeout for:
 #
 # 1) Bulk transfer I/O during SYNC, from the point of view of replica.
 # 2) Master timeout from the point of view of replicas (data, pings).
 # 3) Replica timeout from the point of view of masters (REPLCONF ACK pings).
 #
 # It is important to make sure that this value is greater than the value
 # specified for repl-ping-replica-period otherwise a timeout will be detected
 # every time there is low traffic between the master and the replica. The default
 # value is 60 seconds.
 #
 # repl-timeout 60
 
 # Disable TCP_NODELAY on the replica socket after SYNC?
 #
 # If you select "yes" Redis will use a smaller number of TCP packets and
 # less bandwidth to send data to replicas. But this can add a delay for
 # the data to appear on the replica side, up to 40 milliseconds with
 # Linux kernels using a default configuration.
 #
 # If you select "no" the delay for data to appear on the replica side will
 # be reduced but more bandwidth will be used for replication.
 #
 # By default we optimize for low latency, but in very high traffic conditions
 # or when the master and replicas are many hops away, turning this to "yes" may
 # be a good idea.
 repl-disable-tcp-nodelay no
 
 # Set the replication backlog size. The backlog is a buffer that accumulates
 # replica data when replicas are disconnected for some time, so that when a
 # replica wants to reconnect again, often a full resync is not needed, but a
 # partial resync is enough, just passing the portion of data the replica
 # missed while disconnected.
 #
 # The bigger the replication backlog, the longer the replica can endure the
 # disconnect and later be able to perform a partial resynchronization.
 #
 # The backlog is only allocated if there is at least one replica connected.
 #
 # repl-backlog-size 1mb
 
 # After a master has no connected replicas for some time, the backlog will be
 # freed. The following option configures the amount of seconds that need to
 # elapse, starting from the time the last replica disconnected, for the backlog
 # buffer to be freed.
 #
 # Note that replicas never free the backlog for timeout, since they may be
 # promoted to masters later, and should be able to correctly "partially
 # resynchronize" with other replicas: hence they should always accumulate backlog.
 #
 # A value of 0 means to never release the backlog.
 #
 # repl-backlog-ttl 3600
 
 # The replica priority is an integer number published by Redis in the INFO
 # output. It is used by Redis Sentinel in order to select a replica to promote
 # into a master if the master is no longer working correctly.
 #
 # A replica with a low priority number is considered better for promotion, so
 # for instance if there are three replicas with priority 10, 100, 25 Sentinel
 # will pick the one with priority 10, that is the lowest.
 #
 # However a special priority of 0 marks the replica as not able to perform the
 # role of master, so a replica with priority of 0 will never be selected by
 # Redis Sentinel for promotion.
 #
 # By default the priority is 100.
 replica-priority 100
 
 # It is possible for a master to stop accepting writes if there are less than
 # N replicas connected, having a lag less or equal than M seconds.
 #
 # The N replicas need to be in "online" state.
 #
 # The lag in seconds, that must be <= the specified value, is calculated from
 # the last ping received from the replica, that is usually sent every second.
 #
 # This option does not GUARANTEE that N replicas will accept the write, but
 # will limit the window of exposure for lost writes in case not enough replicas
 # are available, to the specified number of seconds.
 #
 # For example to require at least 3 replicas with a lag <= 10 seconds use:
 #
 # min-replicas-to-write 3
 # min-replicas-max-lag 10
 #
 # Setting one or the other to 0 disables the feature.
 #
 # By default min-replicas-to-write is set to 0 (feature disabled) and
 # min-replicas-max-lag is set to 10.
 
 # A Redis master is able to list the address and port of the attached
 # replicas in different ways. For example the "INFO replication" section
 # offers this information, which is used, among other tools, by
 # Redis Sentinel in order to discover replica instances.
 # Another place where this info is available is in the output of the
 # "ROLE" command of a master.
 #
 # The listed IP address and port normally reported by a replica is
 # obtained in the following way:
 #
 #   IP: The address is auto detected by checking the peer address
 #   of the socket used by the replica to connect with the master.
 #
 #   Port: The port is communicated by the replica during the replication
 #   handshake, and is normally the port that the replica is using to
 #   listen for connections.
 #
 # However when port forwarding or Network Address Translation (NAT) is
 # used, the replica may actually be reachable via different IP and port
 # pairs. The following two options can be used by a replica in order to
 # report to its master a specific set of IP and port, so that both INFO
 # and ROLE will report those values.
 #
 # There is no need to use both the options if you need to override just
 # the port or the IP address.
 #
 # replica-announce-ip 5.5.5.5
 # replica-announce-port 1234
 
 ############################### KEYS TRACKING #################################
 
 # Redis implements server assisted support for client side caching of values.
 # This is implemented using an invalidation table that remembers, using
 # 16 millions of slots, what clients may have certain subsets of keys. In turn
 # this is used in order to send invalidation messages to clients. Please
 # check this page to understand more about the feature:
 #
 #   https://redis.io/topics/client-side-caching
 #
 # When tracking is enabled for a client, all the read only queries are assumed
 # to be cached: this will force Redis to store information in the invalidation
 # table. When keys are modified, such information is flushed away, and
 # invalidation messages are sent to the clients. However if the workload is
 # heavily dominated by reads, Redis could use more and more memory in order
 # to track the keys fetched by many clients.
 #
 # For this reason it is possible to configure a maximum fill value for the
 # invalidation table. By default it is set to 1M of keys, and once this limit
 # is reached, Redis will start to evict keys in the invalidation table
 # even if they were not modified, just to reclaim memory: this will in turn
 # force the clients to invalidate the cached values. Basically the table
 # maximum size is a trade off between the memory you want to spend server
 # side to track information about who cached what, and the ability of clients
 # to retain cached objects in memory.
 #
 # If you set the value to 0, it means there are no limits, and Redis will
 # retain as many keys as needed in the invalidation table.
 # In the "stats" INFO section, you can find information about the number of
 # keys in the invalidation table at every given moment.
 #
 # Note: when key tracking is used in broadcasting mode, no memory is used
 # in the server side so this setting is useless.
 #
 # tracking-table-max-keys 1000000
 
 ################################## SECURITY ###################################
 
 # Warning: since Redis is pretty fast, an outside user can try up to
 # 1 million passwords per second against a modern box. This means that you
 # should use very strong passwords, otherwise they will be very easy to break.
 # Note that because the password is really a shared secret between the client
 # and the server, and should not be memorized by any human, the password
 # can be easily a long string from /dev/urandom or whatever, so by using a
 # long and unguessable password no brute force attack will be possible.
 
 # Redis ACL users are defined in the following format:
 #
 #   user <username> ... acl rules ...
 #
 # For example:
 #
 #   user worker +@list +@connection ~jobs:* on >ffa9203c493aa99
 #
 # The special username "default" is used for new connections. If this user
 # has the "nopass" rule, then new connections will be immediately authenticated
 # as the "default" user without the need of any password provided via the
 # AUTH command. Otherwise if the "default" user is not flagged with "nopass"
 # the connections will start in not authenticated state, and will require
 # AUTH (or the HELLO command AUTH option) in order to be authenticated and
 # start to work.
 #
 # The ACL rules that describe what a user can do are the following:
 #
 #  on           Enable the user: it is possible to authenticate as this user.
 #  off          Disable the user: it's no longer possible to authenticate
 #               with this user, however the already authenticated connections
 #               will still work.
 #  +<command>   Allow the execution of that command
 #  -<command>   Disallow the execution of that command
 #  +@<category> Allow the execution of all the commands in such category
 #               with valid categories are like @admin, @set, @sortedset, ...
 #               and so forth, see the full list in the server.c file where
 #               the Redis command table is described and defined.
 #               The special category @all means all the commands, but currently
 #               present in the server, and that will be loaded in the future
 #               via modules.
 #  +<command>|subcommand    Allow a specific subcommand of an otherwise
 #                           disabled command. Note that this form is not
 #                           allowed as negative like -DEBUG|SEGFAULT, but
 #                           only additive starting with "+".
 #  allcommands  Alias for +@all. Note that it implies the ability to execute
 #               all the future commands loaded via the modules system.
 #  nocommands   Alias for -@all.
 #  ~<pattern>   Add a pattern of keys that can be mentioned as part of
 #               commands. For instance ~* allows all the keys. The pattern
 #               is a glob-style pattern like the one of KEYS.
 #               It is possible to specify multiple patterns.
 #  allkeys      Alias for ~*
 #  resetkeys    Flush the list of allowed keys patterns.
 #  ><password>  Add this password to the list of valid password for the user.
 #               For example >mypass will add "mypass" to the list.
 #               This directive clears the "nopass" flag (see later).
 #  <<password>  Remove this password from the list of valid passwords.
 #  nopass       All the set passwords of the user are removed, and the user
 #               is flagged as requiring no password: it means that every
 #               password will work against this user. If this directive is
 #               used for the default user, every new connection will be
 #               immediately authenticated with the default user without
 #               any explicit AUTH command required. Note that the "resetpass"
 #               directive will clear this condition.
 #  resetpass    Flush the list of allowed passwords. Moreover removes the
 #               "nopass" status. After "resetpass" the user has no associated
 #               passwords and there is no way to authenticate without adding
 #               some password (or setting it as "nopass" later).
 #  reset        Performs the following actions: resetpass, resetkeys, off,
 #               -@all. The user returns to the same state it has immediately
 #               after its creation.
 #
 # ACL rules can be specified in any order: for instance you can start with
 # passwords, then flags, or key patterns. However note that the additive
 # and subtractive rules will CHANGE MEANING depending on the ordering.
 # For instance see the following example:
 #
 #   user alice on +@all -DEBUG ~* >somepassword
 #
 # This will allow "alice" to use all the commands with the exception of the
 # DEBUG command, since +@all added all the commands to the set of the commands
 # alice can use, and later DEBUG was removed. However if we invert the order
 # of two ACL rules the result will be different:
 #
 #   user alice on -DEBUG +@all ~* >somepassword
 #
 # Now DEBUG was removed when alice had yet no commands in the set of allowed
 # commands, later all the commands are added, so the user will be able to
 # execute everything.
 #
 # Basically ACL rules are processed left-to-right.
 #
 # For more information about ACL configuration please refer to
 # the Redis web site at https://redis.io/topics/acl
 
 # ACL LOG
 #
 # The ACL Log tracks failed commands and authentication events associated
 # with ACLs. The ACL Log is useful to troubleshoot failed commands blocked
 # by ACLs. The ACL Log is stored in memory. You can reclaim memory with
 # ACL LOG RESET. Define the maximum entry length of the ACL Log below.
 acllog-max-len 128
 
 # Using an external ACL file
 #
 # Instead of configuring users here in this file, it is possible to use
 # a stand-alone file just listing users. The two methods cannot be mixed:
 # if you configure users here and at the same time you activate the external
 # ACL file, the server will refuse to start.
 #
 # The format of the external ACL user file is exactly the same as the
 # format that is used inside redis.conf to describe users.
 #
 # aclfile /etc/redis/users.acl
 
 # IMPORTANT NOTE: starting with Redis 6 "requirepass" is just a compatibility
 # layer on top of the new ACL system. The option effect will be just setting
 # the password for the default user. Clients will still authenticate using
 # AUTH <password> as usually, or more explicitly with AUTH default <password>
 # if they follow the new protocol: both will work.
 #
 # requirepass foobared
 
 # Command renaming (DEPRECATED).
 #
 # ------------------------------------------------------------------------
 # WARNING: avoid using this option if possible. Instead use ACLs to remove
 # commands from the default user, and put them only in some admin user you
 # create for administrative purposes.
 # ------------------------------------------------------------------------
 #
 # It is possible to change the name of dangerous commands in a shared
 # environment. For instance the CONFIG command may be renamed into something
 # hard to guess so that it will still be available for internal-use tools
 # but not available for general clients.
 #
 # Example:
 #
 # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52
 #
 # It is also possible to completely kill a command by renaming it into
 # an empty string:
 #
 # rename-command CONFIG ""
 #
 # Please note that changing the name of commands that are logged into the
 # AOF file or transmitted to replicas may cause problems.
 
 ################################### CLIENTS ####################################
 
 # Set the max number of connected clients at the same time. By default
 # this limit is set to 10000 clients, however if the Redis server is not
 # able to configure the process file limit to allow for the specified limit
 # the max number of allowed clients is set to the current file limit
 # minus 32 (as Redis reserves a few file descriptors for internal uses).
 #
 # Once the limit is reached Redis will close all the new connections sending
 # an error 'max number of clients reached'.
 #
 # IMPORTANT: When Redis Cluster is used, the max number of connections is also
 # shared with the cluster bus: every node in the cluster will use two
 # connections, one incoming and another outgoing. It is important to size the
 # limit accordingly in case of very large clusters.
 #
 # maxclients 10000
 
 ############################## MEMORY MANAGEMENT ################################
 
 # Set a memory usage limit to the specified amount of bytes.
 # When the memory limit is reached Redis will try to remove keys
 # according to the eviction policy selected (see maxmemory-policy).
 #
 # If Redis can't remove keys according to the policy, or if the policy is
 # set to 'noeviction', Redis will start to reply with errors to commands
 # that would use more memory, like SET, LPUSH, and so on, and will continue
 # to reply to read-only commands like GET.
 #
 # This option is usually useful when using Redis as an LRU or LFU cache, or to
 # set a hard memory limit for an instance (using the 'noeviction' policy).
 #
 # WARNING: If you have replicas attached to an instance with maxmemory on,
 # the size of the output buffers needed to feed the replicas are subtracted
 # from the used memory count, so that network problems / resyncs will
 # not trigger a loop where keys are evicted, and in turn the output
 # buffer of replicas is full with DELs of keys evicted triggering the deletion
 # of more keys, and so forth until the database is completely emptied.
 #
 # In short... if you have replicas attached it is suggested that you set a lower
 # limit for maxmemory so that there is some free RAM on the system for replica
 # output buffers (but this is not needed if the policy is 'noeviction').
 #
-maxmemory 8192mb
+#maxmemory 8192mb
 
 # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory
 # is reached. You can select one from the following behaviors:
 #
 # volatile-lru -> Evict using approximated LRU, only keys with an expire set.
 # allkeys-lru -> Evict any key using approximated LRU.
 # volatile-lfu -> Evict using approximated LFU, only keys with an expire set.
 # allkeys-lfu -> Evict any key using approximated LFU.
 # volatile-random -> Remove a random key having an expire set.
 # allkeys-random -> Remove a random key, any key.
 # volatile-ttl -> Remove the key with the nearest expire time (minor TTL)
 # noeviction -> Don't evict anything, just return an error on write operations.
 #
 # LRU means Least Recently Used
 # LFU means Least Frequently Used
 #
 # Both LRU, LFU and volatile-ttl are implemented using approximated
 # randomized algorithms.
 #
 # Note: with any of the above policies, Redis will return an error on write
 #       operations, when there are no suitable keys for eviction.
 #
 #       At the date of writing these commands are: set setnx setex append
 #       incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd
 #       sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby
 #       zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby
 #       getset mset msetnx exec sort
 #
 # The default is:
 #
-maxmemory-policy volatile-lru
+#maxmemory-policy volatile-lru
 
 # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated
 # algorithms (in order to save memory), so you can tune it for speed or
 # accuracy. By default Redis will check five keys and pick the one that was
 # used least recently, you can change the sample size using the following
 # configuration directive.
 #
 # The default of 5 produces good enough results. 10 Approximates very closely
 # true LRU but costs more CPU. 3 is faster but not very accurate.
 #
-maxmemory-samples 5
+maxmemory-samples 10
 
 # Starting from Redis 5, by default a replica will ignore its maxmemory setting
 # (unless it is promoted to master after a failover or manually). It means
 # that the eviction of keys will be just handled by the master, sending the
 # DEL commands to the replica as keys evict in the master side.
 #
 # This behavior ensures that masters and replicas stay consistent, and is usually
 # what you want, however if your replica is writable, or you want the replica
 # to have a different memory setting, and you are sure all the writes performed
 # to the replica are idempotent, then you may change this default (but be sure
 # to understand what you are doing).
 #
 # Note that since the replica by default does not evict, it may end using more
 # memory than the one set via maxmemory (there are certain buffers that may
 # be larger on the replica, or data structures may sometimes take more memory
 # and so forth). So make sure you monitor your replicas and make sure they
 # have enough memory to never hit a real out-of-memory condition before the
 # master hits the configured maxmemory setting.
 #
 # replica-ignore-maxmemory yes
 
 # Redis reclaims expired keys in two ways: upon access when those keys are
 # found to be expired, and also in background, in what is called the
 # "active expire key". The key space is slowly and interactively scanned
 # looking for expired keys to reclaim, so that it is possible to free memory
 # of keys that are expired and will never be accessed again in a short time.
 #
 # The default effort of the expire cycle will try to avoid having more than
 # ten percent of expired keys still in memory, and will try to avoid consuming
 # more than 25% of total memory and to add latency to the system. However
 # it is possible to increase the expire "effort" that is normally set to
 # "1", to a greater value, up to the value "10". At its maximum value the
 # system will use more CPU, longer cycles (and technically may introduce
 # more latency), and will tolerate less already expired keys still present
 # in the system. It's a tradeoff between memory, CPU and latency.
 #
 # active-expire-effort 1
 
 ############################# LAZY FREEING ####################################
 
 # Redis has two primitives to delete keys. One is called DEL and is a blocking
 # deletion of the object. It means that the server stops processing new commands
 # in order to reclaim all the memory associated with an object in a synchronous
 # way. If the key deleted is associated with a small object, the time needed
 # in order to execute the DEL command is very small and comparable to most other
 # O(1) or O(log_N) commands in Redis. However if the key is associated with an
 # aggregated value containing millions of elements, the server can block for
 # a long time (even seconds) in order to complete the operation.
 #
 # For the above reasons Redis also offers non blocking deletion primitives
 # such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and
 # FLUSHDB commands, in order to reclaim memory in background. Those commands
 # are executed in constant time. Another thread will incrementally free the
 # object in the background as fast as possible.
 #
 # DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled.
 # It's up to the design of the application to understand when it is a good
 # idea to use one or the other. However the Redis server sometimes has to
 # delete keys or flush the whole database as a side effect of other operations.
 # Specifically Redis deletes objects independently of a user call in the
 # following scenarios:
 #
 # 1) On eviction, because of the maxmemory and maxmemory policy configurations,
 #    in order to make room for new data, without going over the specified
 #    memory limit.
 # 2) Because of expire: when a key with an associated time to live (see the
 #    EXPIRE command) must be deleted from memory.
 # 3) Because of a side effect of a command that stores data on a key that may
 #    already exist. For example the RENAME command may delete the old key
 #    content when it is replaced with another one. Similarly SUNIONSTORE
 #    or SORT with STORE option may delete existing keys. The SET command
 #    itself removes any old content of the specified key in order to replace
 #    it with the specified string.
 # 4) During replication, when a replica performs a full resynchronization with
 #    its master, the content of the whole database is removed in order to
 #    load the RDB file just transferred.
 #
 # In all the above cases the default is to delete objects in a blocking way,
 # like if DEL was called. However you can configure each case specifically
 # in order to instead release memory in a non-blocking way like if UNLINK
 # was called, using the following configuration directives.
 
 lazyfree-lazy-eviction no
 lazyfree-lazy-expire no
 lazyfree-lazy-server-del no
 replica-lazy-flush no
 
 # It is also possible, for the case when to replace the user code DEL calls
 # with UNLINK calls is not easy, to modify the default behavior of the DEL
 # command to act exactly like UNLINK, using the following configuration
 # directive:
 
 lazyfree-lazy-user-del no
 
 ################################ THREADED I/O #################################
 
 # Redis is mostly single threaded, however there are certain threaded
 # operations such as UNLINK, slow I/O accesses and other things that are
 # performed on side threads.
 #
 # Now it is also possible to handle Redis clients socket reads and writes
 # in different I/O threads. Since especially writing is so slow, normally
 # Redis users use pipelining in order to speed up the Redis performances per
 # core, and spawn multiple instances in order to scale more. Using I/O
 # threads it is possible to easily speedup two times Redis without resorting
 # to pipelining nor sharding of the instance.
 #
 # By default threading is disabled, we suggest enabling it only in machines
 # that have at least 4 or more cores, leaving at least one spare core.
 # Using more than 8 threads is unlikely to help much. We also recommend using
 # threaded I/O only if you actually have performance problems, with Redis
 # instances being able to use a quite big percentage of CPU time, otherwise
 # there is no point in using this feature.
 #
 # So for instance if you have a four cores boxes, try to use 2 or 3 I/O
 # threads, if you have a 8 cores, try to use 6 threads. In order to
 # enable I/O threads use the following configuration directive:
 #
 # io-threads 4
 #
 # Setting io-threads to 1 will just use the main thread as usual.
 # When I/O threads are enabled, we only use threads for writes, that is
 # to thread the write(2) syscall and transfer the client buffers to the
 # socket. However it is also possible to enable threading of reads and
 # protocol parsing using the following configuration directive, by setting
 # it to yes:
 #
 # io-threads-do-reads no
 #
 # Usually threading reads doesn't help much.
 #
 # NOTE 1: This configuration directive cannot be changed at runtime via
 # CONFIG SET. Aso this feature currently does not work when SSL is
 # enabled.
 #
 # NOTE 2: If you want to test the Redis speedup using redis-benchmark, make
 # sure you also run the benchmark itself in threaded mode, using the
 # --threads option to match the number of Redis threads, otherwise you'll not
 # be able to notice the improvements.
 
 ############################ KERNEL OOM CONTROL ##############################
 
 # On Linux, it is possible to hint the kernel OOM killer on what processes
 # should be killed first when out of memory.
 #
 # Enabling this feature makes Redis actively control the oom_score_adj value
 # for all its processes, depending on their role. The default scores will
 # attempt to have background child processes killed before all others, and
 # replicas killed before masters.
 
 oom-score-adj no
 
 # When oom-score-adj is used, this directive controls the specific values used
 # for master, replica and background child processes. Values range -1000 to
 # 1000 (higher means more likely to be killed).
 #
 # Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities)
 # can freely increase their value, but not decrease it below its initial
 # settings.
 #
 # Values are used relative to the initial value of oom_score_adj when the server
 # starts. Because typically the initial value is 0, they will often match the
 # absolute values.
 
 oom-score-adj-values 0 200 800
 
 ############################## APPEND ONLY MODE ###############################
 
 # By default Redis asynchronously dumps the dataset on disk. This mode is
 # good enough in many applications, but an issue with the Redis process or
 # a power outage may result into a few minutes of writes lost (depending on
 # the configured save points).
 #
 # The Append Only File is an alternative persistence mode that provides
 # much better durability. For instance using the default data fsync policy
 # (see later in the config file) Redis can lose just one second of writes in a
 # dramatic event like a server power outage, or a single write if something
 # wrong with the Redis process itself happens, but the operating system is
 # still running correctly.
 #
 # AOF and RDB persistence can be enabled at the same time without problems.
 # If the AOF is enabled on startup Redis will load the AOF, that is the file
 # with the better durability guarantees.
 #
 # Please check http://redis.io/topics/persistence for more information.
 
 appendonly no
 
 # The name of the append only file (default: "appendonly.aof")
 
 appendfilename "appendonly.aof"
 
 # The fsync() call tells the Operating System to actually write data on disk
 # instead of waiting for more data in the output buffer. Some OS will really flush
 # data on disk, some other OS will just try to do it ASAP.
 #
 # Redis supports three different modes:
 #
 # no: don't fsync, just let the OS flush the data when it wants. Faster.
 # always: fsync after every write to the append only log. Slow, Safest.
 # everysec: fsync only one time every second. Compromise.
 #
 # The default is "everysec", as that's usually the right compromise between
 # speed and data safety. It's up to you to understand if you can relax this to
 # "no" that will let the operating system flush the output buffer when
 # it wants, for better performances (but if you can live with the idea of
 # some data loss consider the default persistence mode that's snapshotting),
 # or on the contrary, use "always" that's very slow but a bit safer than
 # everysec.
 #
 # More details please check the following article:
 # http://antirez.com/post/redis-persistence-demystified.html
 #
 # If unsure, use "everysec".
 
 # appendfsync always
 appendfsync everysec
 # appendfsync no
 
 # When the AOF fsync policy is set to always or everysec, and a background
 # saving process (a background save or AOF log background rewriting) is
 # performing a lot of I/O against the disk, in some Linux configurations
 # Redis may block too long on the fsync() call. Note that there is no fix for
 # this currently, as even performing fsync in a different thread will block
 # our synchronous write(2) call.
 #
 # In order to mitigate this problem it's possible to use the following option
 # that will prevent fsync() from being called in the main process while a
 # BGSAVE or BGREWRITEAOF is in progress.
 #
 # This means that while another child is saving, the durability of Redis is
 # the same as "appendfsync none". In practical terms, this means that it is
 # possible to lose up to 30 seconds of log in the worst scenario (with the
 # default Linux settings).
 #
 # If you have latency problems turn this to "yes". Otherwise leave it as
 # "no" that is the safest pick from the point of view of durability.
 
 no-appendfsync-on-rewrite no
 
 # Automatic rewrite of the append only file.
 # Redis is able to automatically rewrite the log file implicitly calling
 # BGREWRITEAOF when the AOF log size grows by the specified percentage.
 #
 # This is how it works: Redis remembers the size of the AOF file after the
 # latest rewrite (if no rewrite has happened since the restart, the size of
 # the AOF at startup is used).
 #
 # This base size is compared to the current size. If the current size is
 # bigger than the specified percentage, the rewrite is triggered. Also
 # you need to specify a minimal size for the AOF file to be rewritten, this
 # is useful to avoid rewriting the AOF file even if the percentage increase
 # is reached but it is still pretty small.
 #
 # Specify a percentage of zero in order to disable the automatic AOF
 # rewrite feature.
 
 auto-aof-rewrite-percentage 100
 auto-aof-rewrite-min-size 64mb
 
 # An AOF file may be found to be truncated at the end during the Redis
 # startup process, when the AOF data gets loaded back into memory.
 # This may happen when the system where Redis is running
 # crashes, especially when an ext4 filesystem is mounted without the
 # data=ordered option (however this can't happen when Redis itself
 # crashes or aborts but the operating system still works correctly).
 #
 # Redis can either exit with an error when this happens, or load as much
 # data as possible (the default now) and start if the AOF file is found
 # to be truncated at the end. The following option controls this behavior.
 #
 # If aof-load-truncated is set to yes, a truncated AOF file is loaded and
 # the Redis server starts emitting a log to inform the user of the event.
 # Otherwise if the option is set to no, the server aborts with an error
 # and refuses to start. When the option is set to no, the user requires
 # to fix the AOF file using the "redis-check-aof" utility before to restart
 # the server.
 #
 # Note that if the AOF file will be found to be corrupted in the middle
 # the server will still exit with an error. This option only applies when
 # Redis will try to read more data from the AOF file but not enough bytes
 # will be found.
 aof-load-truncated yes
 
 # When rewriting the AOF file, Redis is able to use an RDB preamble in the
 # AOF file for faster rewrites and recoveries. When this option is turned
 # on the rewritten AOF file is composed of two different stanzas:
 #
 #   [RDB file][AOF tail]
 #
 # When loading, Redis recognizes that the AOF file starts with the "REDIS"
 # string and loads the prefixed RDB file, then continues loading the AOF
 # tail.
 aof-use-rdb-preamble yes
 
 ################################ LUA SCRIPTING  ###############################
 
 # Max execution time of a Lua script in milliseconds.
 #
 # If the maximum execution time is reached Redis will log that a script is
 # still in execution after the maximum allowed time and will start to
 # reply to queries with an error.
 #
 # When a long running script exceeds the maximum execution time only the
 # SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be
 # used to stop a script that did not yet call any write commands. The second
 # is the only way to shut down the server in the case a write command was
 # already issued by the script but the user doesn't want to wait for the natural
 # termination of the script.
 #
 # Set it to 0 or a negative value for unlimited execution without warnings.
 lua-time-limit 5000
 
 ################################ REDIS CLUSTER  ###############################
 
 # Normal Redis instances can't be part of a Redis Cluster; only nodes that are
 # started as cluster nodes can. In order to start a Redis instance as a
 # cluster node enable the cluster support uncommenting the following:
 #
 # cluster-enabled yes
 
 # Every cluster node has a cluster configuration file. This file is not
 # intended to be edited by hand. It is created and updated by Redis nodes.
 # Every Redis Cluster node requires a different cluster configuration file.
 # Make sure that instances running in the same system do not have
 # overlapping cluster configuration file names.
 #
 # cluster-config-file nodes-6379.conf
 
 # Cluster node timeout is the amount of milliseconds a node must be unreachable
 # for it to be considered in failure state.
 # Most other internal time limits are a multiple of the node timeout.
 #
 # cluster-node-timeout 15000
 
 # A replica of a failing master will avoid to start a failover if its data
 # looks too old.
 #
 # There is no simple way for a replica to actually have an exact measure of
 # its "data age", so the following two checks are performed:
 #
 # 1) If there are multiple replicas able to failover, they exchange messages
 #    in order to try to give an advantage to the replica with the best
 #    replication offset (more data from the master processed).
 #    Replicas will try to get their rank by offset, and apply to the start
 #    of the failover a delay proportional to their rank.
 #
 # 2) Every single replica computes the time of the last interaction with
 #    its master. This can be the last ping or command received (if the master
 #    is still in the "connected" state), or the time that elapsed since the
 #    disconnection with the master (if the replication link is currently down).
 #    If the last interaction is too old, the replica will not try to failover
 #    at all.
 #
 # The point "2" can be tuned by user. Specifically a replica will not perform
 # the failover if, since the last interaction with the master, the time
 # elapsed is greater than:
 #
 #   (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period
 #
 # So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor
 # is 10, and assuming a default repl-ping-replica-period of 10 seconds, the
 # replica will not try to failover if it was not able to talk with the master
 # for longer than 310 seconds.
 #
 # A large cluster-replica-validity-factor may allow replicas with too old data to failover
 # a master, while a too small value may prevent the cluster from being able to
 # elect a replica at all.
 #
 # For maximum availability, it is possible to set the cluster-replica-validity-factor
 # to a value of 0, which means, that replicas will always try to failover the
 # master regardless of the last time they interacted with the master.
 # (However they'll always try to apply a delay proportional to their
 # offset rank).
 #
 # Zero is the only value able to guarantee that when all the partitions heal
 # the cluster will always be able to continue.
 #
 # cluster-replica-validity-factor 10
 
 # Cluster replicas are able to migrate to orphaned masters, that are masters
 # that are left without working replicas. This improves the cluster ability
 # to resist to failures as otherwise an orphaned master can't be failed over
 # in case of failure if it has no working replicas.
 #
 # Replicas migrate to orphaned masters only if there are still at least a
 # given number of other working replicas for their old master. This number
 # is the "migration barrier". A migration barrier of 1 means that a replica
 # will migrate only if there is at least 1 other working replica for its master
 # and so forth. It usually reflects the number of replicas you want for every
 # master in your cluster.
 #
 # Default is 1 (replicas migrate only if their masters remain with at least
 # one replica). To disable migration just set it to a very large value.
 # A value of 0 can be set but is useful only for debugging and dangerous
 # in production.
 #
 # cluster-migration-barrier 1
 
 # By default Redis Cluster nodes stop accepting queries if they detect there
 # is at least a hash slot uncovered (no available node is serving it).
 # This way if the cluster is partially down (for example a range of hash slots
 # are no longer covered) all the cluster becomes, eventually, unavailable.
 # It automatically returns available as soon as all the slots are covered again.
 #
 # However sometimes you want the subset of the cluster which is working,
 # to continue to accept queries for the part of the key space that is still
 # covered. In order to do so, just set the cluster-require-full-coverage
 # option to no.
 #
 # cluster-require-full-coverage yes
 
 # This option, when set to yes, prevents replicas from trying to failover its
 # master during master failures. However the master can still perform a
 # manual failover, if forced to do so.
 #
 # This is useful in different scenarios, especially in the case of multiple
 # data center operations, where we want one side to never be promoted if not
 # in the case of a total DC failure.
 #
 # cluster-replica-no-failover no
 
 # This option, when set to yes, allows nodes to serve read traffic while the
 # the cluster is in a down state, as long as it believes it owns the slots.
 #
 # This is useful for two cases.  The first case is for when an application
 # doesn't require consistency of data during node failures or network partitions.
 # One example of this is a cache, where as long as the node has the data it
 # should be able to serve it.
 #
 # The second use case is for configurations that don't meet the recommended
 # three shards but want to enable cluster mode and scale later. A
 # master outage in a 1 or 2 shard configuration causes a read/write outage to the
 # entire cluster without this option set, with it set there is only a write outage.
 # Without a quorum of masters, slot ownership will not change automatically.
 #
 # cluster-allow-reads-when-down no
 
 # In order to setup your cluster make sure to read the documentation
 # available at http://redis.io web site.
 
 ########################## CLUSTER DOCKER/NAT support  ########################
 
 # In certain deployments, Redis Cluster nodes address discovery fails, because
 # addresses are NAT-ted or because ports are forwarded (the typical case is
 # Docker and other containers).
 #
 # In order to make Redis Cluster working in such environments, a static
 # configuration where each node knows its public address is needed. The
 # following two options are used for this scope, and are:
 #
 # * cluster-announce-ip
 # * cluster-announce-port
 # * cluster-announce-bus-port
 #
 # Each instructs the node about its address, client port, and cluster message
 # bus port. The information is then published in the header of the bus packets
 # so that other nodes will be able to correctly map the address of the node
 # publishing the information.
 #
 # If the above options are not used, the normal Redis Cluster auto-detection
 # will be used instead.
 #
 # Note that when remapped, the bus port may not be at the fixed offset of
 # clients port + 10000, so you can specify any port and bus-port depending
 # on how they get remapped. If the bus-port is not set, a fixed offset of
 # 10000 will be used as usual.
 #
 # Example:
 #
 # cluster-announce-ip 10.1.1.5
 # cluster-announce-port 6379
 # cluster-announce-bus-port 6380
 
 ################################## SLOW LOG ###################################
 
 # The Redis Slow Log is a system to log queries that exceeded a specified
 # execution time. The execution time does not include the I/O operations
 # like talking with the client, sending the reply and so forth,
 # but just the time needed to actually execute the command (this is the only
 # stage of command execution where the thread is blocked and can not serve
 # other requests in the meantime).
 #
 # You can configure the slow log with two parameters: one tells Redis
 # what is the execution time, in microseconds, to exceed in order for the
 # command to get logged, and the other parameter is the length of the
 # slow log. When a new command is logged the oldest one is removed from the
 # queue of logged commands.
 
 # The following time is expressed in microseconds, so 1000000 is equivalent
 # to one second. Note that a negative number disables the slow log, while
 # a value of zero forces the logging of every command.
 slowlog-log-slower-than 10000
 
 # There is no limit to this length. Just be aware that it will consume memory.
 # You can reclaim memory used by the slow log with SLOWLOG RESET.
 slowlog-max-len 128
 
 ################################ LATENCY MONITOR ##############################
 
 # The Redis latency monitoring subsystem samples different operations
 # at runtime in order to collect data related to possible sources of
 # latency of a Redis instance.
 #
 # Via the LATENCY command this information is available to the user that can
 # print graphs and obtain reports.
 #
 # The system only logs operations that were performed in a time equal or
 # greater than the amount of milliseconds specified via the
 # latency-monitor-threshold configuration directive. When its value is set
 # to zero, the latency monitor is turned off.
 #
 # By default latency monitoring is disabled since it is mostly not needed
 # if you don't have latency issues, and collecting data has a performance
 # impact, that while very small, can be measured under big load. Latency
 # monitoring can easily be enabled at runtime using the command
 # "CONFIG SET latency-monitor-threshold <milliseconds>" if needed.
 latency-monitor-threshold 0
 
 ############################# EVENT NOTIFICATION ##############################
 
 # Redis can notify Pub/Sub clients about events happening in the key space.
 # This feature is documented at http://redis.io/topics/notifications
 #
 # For instance if keyspace events notification is enabled, and a client
 # performs a DEL operation on key "foo" stored in the Database 0, two
 # messages will be published via Pub/Sub:
 #
 # PUBLISH __keyspace@0__:foo del
 # PUBLISH __keyevent@0__:del foo
 #
 # It is possible to select the events that Redis will notify among a set
 # of classes. Every class is identified by a single character:
 #
 #  K     Keyspace events, published with __keyspace@<db>__ prefix.
 #  E     Keyevent events, published with __keyevent@<db>__ prefix.
 #  g     Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...
 #  $     String commands
 #  l     List commands
 #  s     Set commands
 #  h     Hash commands
 #  z     Sorted set commands
 #  x     Expired events (events generated every time a key expires)
 #  e     Evicted events (events generated when a key is evicted for maxmemory)
 #  t     Stream commands
 #  m     Key-miss events (Note: It is not included in the 'A' class)
 #  A     Alias for g$lshzxet, so that the "AKE" string means all the events
 #        (Except key-miss events which are excluded from 'A' due to their
 #         unique nature).
 #
 #  The "notify-keyspace-events" takes as argument a string that is composed
 #  of zero or multiple characters. The empty string means that notifications
 #  are disabled.
 #
 #  Example: to enable list and generic events, from the point of view of the
 #           event name, use:
 #
 #  notify-keyspace-events Elg
 #
 #  Example 2: to get the stream of the expired keys subscribing to channel
 #             name __keyevent@0__:expired use:
 #
 #  notify-keyspace-events Ex
 #
 #  By default all notifications are disabled because most users don't need
 #  this feature and the feature has some overhead. Note that if you don't
 #  specify at least one of K or E, no events will be delivered.
 notify-keyspace-events ""
 
 ############################### GOPHER SERVER #################################
 
 # Redis contains an implementation of the Gopher protocol, as specified in
 # the RFC 1436 (https://www.ietf.org/rfc/rfc1436.txt).
 #
 # The Gopher protocol was very popular in the late '90s. It is an alternative
 # to the web, and the implementation both server and client side is so simple
 # that the Redis server has just 100 lines of code in order to implement this
 # support.
 #
 # What do you do with Gopher nowadays? Well Gopher never *really* died, and
 # lately there is a movement in order for the Gopher more hierarchical content
 # composed of just plain text documents to be resurrected. Some want a simpler
 # internet, others believe that the mainstream internet became too much
 # controlled, and it's cool to create an alternative space for people that
 # want a bit of fresh air.
 #
 # Anyway for the 10nth birthday of the Redis, we gave it the Gopher protocol
 # as a gift.
 #
 # --- HOW IT WORKS? ---
 #
 # The Redis Gopher support uses the inline protocol of Redis, and specifically
 # two kind of inline requests that were anyway illegal: an empty request
 # or any request that starts with "/" (there are no Redis commands starting
 # with such a slash). Normal RESP2/RESP3 requests are completely out of the
 # path of the Gopher protocol implementation and are served as usual as well.
 #
 # If you open a connection to Redis when Gopher is enabled and send it
 # a string like "/foo", if there is a key named "/foo" it is served via the
 # Gopher protocol.
 #
 # In order to create a real Gopher "hole" (the name of a Gopher site in Gopher
 # talking), you likely need a script like the following:
 #
 #   https://github.com/antirez/gopher2redis
 #
 # --- SECURITY WARNING ---
 #
 # If you plan to put Redis on the internet in a publicly accessible address
 # to server Gopher pages MAKE SURE TO SET A PASSWORD to the instance.
 # Once a password is set:
 #
 #   1. The Gopher server (when enabled, not by default) will still serve
 #      content via Gopher.
 #   2. However other commands cannot be called before the client will
 #      authenticate.
 #
 # So use the 'requirepass' option to protect your instance.
 #
 # Note that Gopher is not currently supported when 'io-threads-do-reads'
 # is enabled.
 #
 # To enable Gopher support, uncomment the following line and set the option
 # from no (the default) to yes.
 #
 # gopher-enabled no
 
 ############################### ADVANCED CONFIG ###############################
 
 # Hashes are encoded using a memory efficient data structure when they have a
 # small number of entries, and the biggest entry does not exceed a given
 # threshold. These thresholds can be configured using the following directives.
 hash-max-ziplist-entries 512
 hash-max-ziplist-value 64
 
 # Lists are also encoded in a special way to save a lot of space.
 # The number of entries allowed per internal list node can be specified
 # as a fixed maximum size or a maximum number of elements.
 # For a fixed maximum size, use -5 through -1, meaning:
 # -5: max size: 64 Kb  <-- not recommended for normal workloads
 # -4: max size: 32 Kb  <-- not recommended
 # -3: max size: 16 Kb  <-- probably not recommended
 # -2: max size: 8 Kb   <-- good
 # -1: max size: 4 Kb   <-- good
 # Positive numbers mean store up to _exactly_ that number of elements
 # per list node.
 # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),
 # but if your use case is unique, adjust the settings as necessary.
 list-max-ziplist-size -2
 
 # Lists may also be compressed.
 # Compress depth is the number of quicklist ziplist nodes from *each* side of
 # the list to *exclude* from compression.  The head and tail of the list
 # are always uncompressed for fast push/pop operations.  Settings are:
 # 0: disable all list compression
 # 1: depth 1 means "don't start compressing until after 1 node into the list,
 #    going from either the head or tail"
 #    So: [head]->node->node->...->node->[tail]
 #    [head], [tail] will always be uncompressed; inner nodes will compress.
 # 2: [head]->[next]->node->node->...->node->[prev]->[tail]
 #    2 here means: don't compress head or head->next or tail->prev or tail,
 #    but compress all nodes between them.
 # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]
 # etc.
 list-compress-depth 0
 
 # Sets have a special encoding in just one case: when a set is composed
 # of just strings that happen to be integers in radix 10 in the range
 # of 64 bit signed integers.
 # The following configuration setting sets the limit in the size of the
 # set in order to use this special memory saving encoding.
 set-max-intset-entries 512
 
 # Similarly to hashes and lists, sorted sets are also specially encoded in
 # order to save a lot of space. This encoding is only used when the length and
 # elements of a sorted set are below the following limits:
 zset-max-ziplist-entries 128
 zset-max-ziplist-value 64
 
 # HyperLogLog sparse representation bytes limit. The limit includes the
 # 16 bytes header. When an HyperLogLog using the sparse representation crosses
 # this limit, it is converted into the dense representation.
 #
 # A value greater than 16000 is totally useless, since at that point the
 # dense representation is more memory efficient.
 #
 # The suggested value is ~ 3000 in order to have the benefits of
 # the space efficient encoding without slowing down too much PFADD,
 # which is O(N) with the sparse encoding. The value can be raised to
 # ~ 10000 when CPU is not a concern, but space is, and the data set is
 # composed of many HyperLogLogs with cardinality in the 0 - 15000 range.
 hll-sparse-max-bytes 3000
 
 # Streams macro node max size / items. The stream data structure is a radix
 # tree of big nodes that encode multiple items inside. Using this configuration
 # it is possible to configure how big a single node can be in bytes, and the
 # maximum number of items it may contain before switching to a new node when
 # appending new stream entries. If any of the following settings are set to
 # zero, the limit is ignored, so for instance it is possible to set just a
 # max entires limit by setting max-bytes to 0 and max-entries to the desired
 # value.
 stream-node-max-bytes 4096
 stream-node-max-entries 100
 
 # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in
 # order to help rehashing the main Redis hash table (the one mapping top-level
 # keys to values). The hash table implementation Redis uses (see dict.c)
 # performs a lazy rehashing: the more operation you run into a hash table
 # that is rehashing, the more rehashing "steps" are performed, so if the
 # server is idle the rehashing is never complete and some more memory is used
 # by the hash table.
 #
 # The default is to use this millisecond 10 times every second in order to
 # actively rehash the main dictionaries, freeing memory when possible.
 #
 # If unsure:
 # use "activerehashing no" if you have hard latency requirements and it is
 # not a good thing in your environment that Redis can reply from time to time
 # to queries with 2 milliseconds delay.
 #
 # use "activerehashing yes" if you don't have such hard requirements but
 # want to free memory asap when possible.
 activerehashing yes
 
 # The client output buffer limits can be used to force disconnection of clients
 # that are not reading data from the server fast enough for some reason (a
 # common reason is that a Pub/Sub client can't consume messages as fast as the
 # publisher can produce them).
 #
 # The limit can be set differently for the three different classes of clients:
 #
 # normal -> normal clients including MONITOR clients
 # replica  -> replica clients
 # pubsub -> clients subscribed to at least one pubsub channel or pattern
 #
 # The syntax of every client-output-buffer-limit directive is the following:
 #
 # client-output-buffer-limit <class> <hard limit> <soft limit> <soft seconds>
 #
 # A client is immediately disconnected once the hard limit is reached, or if
 # the soft limit is reached and remains reached for the specified number of
 # seconds (continuously).
 # So for instance if the hard limit is 32 megabytes and the soft limit is
 # 16 megabytes / 10 seconds, the client will get disconnected immediately
 # if the size of the output buffers reach 32 megabytes, but will also get
 # disconnected if the client reaches 16 megabytes and continuously overcomes
 # the limit for 10 seconds.
 #
 # By default normal clients are not limited because they don't receive data
 # without asking (in a push way), but just after a request, so only
 # asynchronous clients may create a scenario where data is requested faster
 # than it can read.
 #
 # Instead there is a default limit for pubsub and replica clients, since
 # subscribers and replicas receive data in a push fashion.
 #
 # Both the hard or the soft limit can be disabled by setting them to zero.
 client-output-buffer-limit normal 0 0 0
 client-output-buffer-limit replica 256mb 64mb 60
 client-output-buffer-limit pubsub 32mb 8mb 60
 
 # Client query buffers accumulate new commands. They are limited to a fixed
 # amount by default in order to avoid that a protocol desynchronization (for
 # instance due to a bug in the client) will lead to unbound memory usage in
 # the query buffer. However you can configure it here if you have very special
 # needs, such us huge multi/exec requests or alike.
 #
 # client-query-buffer-limit 1gb
 
 # In the Redis protocol, bulk requests, that are, elements representing single
 # strings, are normally limited to 512 mb. However you can change this limit
 # here, but must be 1mb or greater
 #
 # proto-max-bulk-len 512mb
 
 # Redis calls an internal function to perform many background tasks, like
 # closing connections of clients in timeout, purging expired keys that are
 # never requested, and so forth.
 #
 # Not all tasks are performed with the same frequency, but Redis checks for
 # tasks to perform according to the specified "hz" value.
 #
 # By default "hz" is set to 10. Raising the value will use more CPU when
 # Redis is idle, but at the same time will make Redis more responsive when
 # there are many keys expiring at the same time, and timeouts may be
 # handled with more precision.
 #
 # The range is between 1 and 500, however a value over 100 is usually not
 # a good idea. Most users should use the default of 10 and raise this up to
 # 100 only in environments where very low latency is required.
 hz 10
 
 # Normally it is useful to have an HZ value which is proportional to the
 # number of clients connected. This is useful in order, for instance, to
 # avoid too many clients are processed for each background task invocation
 # in order to avoid latency spikes.
 #
 # Since the default HZ value by default is conservatively set to 10, Redis
 # offers, and enables by default, the ability to use an adaptive HZ value
 # which will temporarily raise when there are many connected clients.
 #
 # When dynamic HZ is enabled, the actual configured HZ will be used
 # as a baseline, but multiples of the configured HZ value will be actually
 # used as needed once more clients are connected. In this way an idle
 # instance will use very little CPU time while a busy instance will be
 # more responsive.
 dynamic-hz yes
 
 # When a child rewrites the AOF file, if the following option is enabled
 # the file will be fsync-ed every 32 MB of data generated. This is useful
 # in order to commit the file to the disk more incrementally and avoid
 # big latency spikes.
 aof-rewrite-incremental-fsync yes
 
 # When redis saves RDB file, if the following option is enabled
 # the file will be fsync-ed every 32 MB of data generated. This is useful
 # in order to commit the file to the disk more incrementally and avoid
 # big latency spikes.
 rdb-save-incremental-fsync yes
 
 # Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good
 # idea to start with the default settings and only change them after investigating
 # how to improve the performances and how the keys LFU change over time, which
 # is possible to inspect via the OBJECT FREQ command.
 #
 # There are two tunable parameters in the Redis LFU implementation: the
 # counter logarithm factor and the counter decay time. It is important to
 # understand what the two parameters mean before changing them.
 #
 # The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis
 # uses a probabilistic increment with logarithmic behavior. Given the value
 # of the old counter, when a key is accessed, the counter is incremented in
 # this way:
 #
 # 1. A random number R between 0 and 1 is extracted.
 # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).
 # 3. The counter is incremented only if R < P.
 #
 # The default lfu-log-factor is 10. This is a table of how the frequency
 # counter changes with a different number of accesses with different
 # logarithmic factors:
 #
 # +--------+------------+------------+------------+------------+------------+
 # | factor | 100 hits   | 1000 hits  | 100K hits  | 1M hits    | 10M hits   |
 # +--------+------------+------------+------------+------------+------------+
 # | 0      | 104        | 255        | 255        | 255        | 255        |
 # +--------+------------+------------+------------+------------+------------+
 # | 1      | 18         | 49         | 255        | 255        | 255        |
 # +--------+------------+------------+------------+------------+------------+
 # | 10     | 10         | 18         | 142        | 255        | 255        |
 # +--------+------------+------------+------------+------------+------------+
 # | 100    | 8          | 11         | 49         | 143        | 255        |
 # +--------+------------+------------+------------+------------+------------+
 #
 # NOTE: The above table was obtained by running the following commands:
 #
 #   redis-benchmark -n 1000000 incr foo
 #   redis-cli object freq foo
 #
 # NOTE 2: The counter initial value is 5 in order to give new objects a chance
 # to accumulate hits.
 #
 # The counter decay time is the time, in minutes, that must elapse in order
 # for the key counter to be divided by two (or decremented if it has a value
 # less <= 10).
 #
 # The default value for the lfu-decay-time is 1. A special value of 0 means to
 # decay the counter every time it happens to be scanned.
 #
 # lfu-log-factor 10
 # lfu-decay-time 1
 
 ########################### ACTIVE DEFRAGMENTATION #######################
 #
 # What is active defragmentation?
 # -------------------------------
 #
 # Active (online) defragmentation allows a Redis server to compact the
 # spaces left between small allocations and deallocations of data in memory,
 # thus allowing to reclaim back memory.
 #
 # Fragmentation is a natural process that happens with every allocator (but
 # less so with Jemalloc, fortunately) and certain workloads. Normally a server
 # restart is needed in order to lower the fragmentation, or at least to flush
 # away all the data and create it again. However thanks to this feature
 # implemented by Oran Agra for Redis 4.0 this process can happen at runtime
 # in a "hot" way, while the server is running.
 #
 # Basically when the fragmentation is over a certain level (see the
 # configuration options below) Redis will start to create new copies of the
 # values in contiguous memory regions by exploiting certain specific Jemalloc
 # features (in order to understand if an allocation is causing fragmentation
 # and to allocate it in a better place), and at the same time, will release the
 # old copies of the data. This process, repeated incrementally for all the keys
 # will cause the fragmentation to drop back to normal values.
 #
 # Important things to understand:
 #
 # 1. This feature is disabled by default, and only works if you compiled Redis
 #    to use the copy of Jemalloc we ship with the source code of Redis.
 #    This is the default with Linux builds.
 #
 # 2. You never need to enable this feature if you don't have fragmentation
 #    issues.
 #
 # 3. Once you experience fragmentation, you can enable this feature when
 #    needed with the command "CONFIG SET activedefrag yes".
 #
 # The configuration parameters are able to fine tune the behavior of the
 # defragmentation process. If you are not sure about what they mean it is
 # a good idea to leave the defaults untouched.
 
 # Enabled active defragmentation
 # activedefrag no
 
 # Minimum amount of fragmentation waste to start active defrag
 # active-defrag-ignore-bytes 100mb
 
 # Minimum percentage of fragmentation to start active defrag
 # active-defrag-threshold-lower 10
 
 # Maximum percentage of fragmentation at which we use maximum effort
 # active-defrag-threshold-upper 100
 
 # Minimal effort for defrag in CPU percentage, to be used when the lower
 # threshold is reached
 # active-defrag-cycle-min 1
 
 # Maximal effort for defrag in CPU percentage, to be used when the upper
 # threshold is reached
 # active-defrag-cycle-max 25
 
 # Maximum number of set/hash/zset/list fields that will be processed from
 # the main dictionary scan
 # active-defrag-max-scan-fields 1000
 
 # Jemalloc background thread for purging will be enabled by default
 jemalloc-bg-thread yes
 
 # It is possible to pin different threads and processes of Redis to specific
 # CPUs in your system, in order to maximize the performances of the server.
 # This is useful both in order to pin different Redis threads in different
 # CPUs, but also in order to make sure that multiple Redis instances running
 # in the same host will be pinned to different CPUs.
 #
 # Normally you can do this using the "taskset" command, however it is also
 # possible to this via Redis configuration directly, both in Linux and FreeBSD.
 #
 # You can pin the server/IO threads, bio threads, aof rewrite child process, and
 # the bgsave child process. The syntax to specify the cpu list is the same as
 # the taskset command:
 #
 # Set redis server/io threads to cpu affinity 0,2,4,6:
 # server_cpulist 0-7:2
 #
 # Set bio threads to cpu affinity 1,3:
 # bio_cpulist 1,3
 #
 # Set aof rewrite child process to cpu affinity 8,9,10,11:
 # aof_rewrite_cpulist 8-11
 #
 # Set bgsave child process to cpu affinity 1,10,11
 # bgsave_cpulist 1,10-11
  No newline at end of file

docker-compose-apps.dev.yaml

@@ -1,56 +1,52 b''
 volumes:
   nixstore:
 
 
 services:
 
   rhodecode:
     volumes:
       - /media/psf/Home/workspace/rhodecode-vcsserver:/home/rhodecode/rhodecode-vcsserver:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ce:/home/rhodecode/rhodecode-enterprise-ce:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ee:/home/rhodecode/rhodecode-enterprise-ee:delegated
       - /media/psf/Home/workspace:/var/opt/rhodecode_repo_store:delegated
       - nixstore:/opt/nix/store
 
     ports:
-      - "8080:8080"
+      - "10020:10020"
 
   vcsserver:
     volumes:
       - /media/psf/Home/workspace/rhodecode-vcsserver:/home/rhodecode/rhodecode-vcsserver:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ce:/home/rhodecode/rhodecode-enterprise-ce:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ee:/home/rhodecode/rhodecode-enterprise-ee:delegated
       - /media/psf/Home/workspace:/var/opt/rhodecode_repo_store:delegated
       - nixstore:/opt/nix/store
 
   celery:
     volumes:
       - /media/psf/Home/workspace/rhodecode-vcsserver:/home/rhodecode/rhodecode-vcsserver:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ce:/home/rhodecode/rhodecode-enterprise-ce:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ee:/home/rhodecode/rhodecode-enterprise-ee:delegated
       - nixstore:/opt/nix/store
 
-  beat:
+  celery-beat:
     volumes:
       - /media/psf/Home/workspace/rhodecode-vcsserver:/home/rhodecode/rhodecode-vcsserver:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ce:/home/rhodecode/rhodecode-enterprise-ce:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ee:/home/rhodecode/rhodecode-enterprise-ee:delegated
       - nixstore:/opt/nix/store
 
   svn:
     volumes:
       - /media/psf/Home/workspace/rhodecode-vcsserver:/home/rhodecode/rhodecode-vcsserver:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ce:/home/rhodecode/rhodecode-enterprise-ce:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ee:/home/rhodecode/rhodecode-enterprise-ee:delegated
       - nixstore:/opt/nix/store
 
   sshd:
     volumes:
       - /media/psf/Home/workspace/rhodecode-vcsserver:/home/rhodecode/rhodecode-vcsserver:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ce:/home/rhodecode/rhodecode-enterprise-ce:delegated
       - /media/psf/Home/workspace/rhodecode-enterprise-ee:/home/rhodecode/rhodecode-enterprise-ee:delegated
       - nixstore:/opt/nix/store
-
-  database:
-    volumes:
-      - /tmp:/usr-tmp

docker-compose-apps.source.yaml

@@ -1,80 +1,64 b''
 volumes:
   bashhistory:
 
 
 services:
 
   rhodecode:
     environment:
       HISTFILE: /home/rhodecode/.bash_history_docker
       DB_UPGRADE: 0  # run the DB upgrade
 
     volumes:
-      - bashhistory:/home/rhodecode
+      - bashhistory:/home/rhodecode/.bash_history_docker
 
     build:
       context: .
       dockerfile: service/rhodecode/rhodecode_source.dockerfile
 
-    image: rhodecode/app_source:${SOURCE_VER:?specify-SOURCE_VER-env-var}
-
-    command: [
-      "/home/rhodecode/rhodecode-enterprise-ee/result/bin/gunicorn",
-      "--name=gunicorn-rhodecode-1",
-      "--error-logfile=-",
-      "--paster=/etc/rhodecode/conf/compose/rhodecode.optimized.ini",
-      "--config=/etc/rhodecode/conf/gunicorn_conf.py"
-    ]
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}_SOURCE
 
   vcsserver:
     environment:
       HISTFILE: /home/rhodecode/.bash_history_docker
 
     volumes:
-      - bashhistory:/home/rhodecode
+      - bashhistory:/home/rhodecode/.bash_history_docker
 
     build:
       context: .
       dockerfile: service/rhodecode/rhodecode_source.dockerfile
 
-    image: rhodecode/app_source:${SOURCE_VER:?specify-SOURCE_VER-env-var}
-
-    command: [
-       "/home/rhodecode/rhodecode-vcsserver/result/bin/gunicorn",
-       "--name=gunicorn-vcsserver-1",
-       "--error-logfile=-",
-       "--paster=/etc/rhodecode/conf/compose/vcsserver.optimized.ini",
-       "--config=/etc/rhodecode/conf/gunicorn_conf.py"
-    ]
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}_SOURCE
 
   celery:
 
     build:
       context: .
       dockerfile: service/rhodecode/rhodecode_source.dockerfile
 
-    image: rhodecode/app_source:${SOURCE_VER:?specify-SOURCE_VER-env-var}
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}_SOURCE
 
-  beat:
+  celery-beat:
 
     build:
       context: .
       dockerfile: service/rhodecode/rhodecode_source.dockerfile
 
-    image: rhodecode/app_source:${SOURCE_VER:?specify-SOURCE_VER-env-var}
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}_SOURCE
 
   svn:
 
     build:
       context: .
       dockerfile: service/rhodecode/rhodecode_source.dockerfile
 
-    image: rhodecode/app_source:${SOURCE_VER:?specify-SOURCE_VER-env-var}
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}_SOURCE
 
   sshd:
 
     build:
       context: .
       dockerfile: service/rhodecode/rhodecode_source.dockerfile
 
-    image: rhodecode/app_source:${SOURCE_VER:?specify-SOURCE_VER-env-var}
  No newline at end of file
+    image: rhodecode/rhodecode-${RC_EDITION}:${RC_VERSION:?specify-RC_VERSION-env-var}_SOURCE
  No newline at end of file

docker-compose-metrics.yaml

@@ -1,110 +1,128 b''
 version: '3.9'
 
 volumes:
-  prometheus_data: {}
-  grafana_data: {}
-  logvolume:
-   driver: local
-   driver_opts:
-    type: none
-    o: bind
-    device: $PWD/logs
 
-networks:
-  rhodecode_network:
-   name: rhodecode_network
+  prometheus_data:
+    labels:
+      "keep": 1
 
+  grafana_data:
+    labels:
+      "keep": 1
 
 services:
 
   statsd-exporter:
     image: prom/statsd-exporter:v0.22.8
-    restart: unless-stopped
+    restart: always
     command: [
       '--statsd.mapping-config=/etc/statsd/statsd.yaml',
       '--statsd.listen-udp=:9125',
       '--web.listen-address=:9102'
     ]
     networks:
       - rhodecode_network
-    ports:
-      - "127.0.0.1:9125:9125/udp"
-      - "127.0.0.1:9102:9102"
+#    ports:
+#      - "9125:9125/udp"
+#      - "9102:9102"
+
     volumes:
       - ./config/statsd-exporter:/etc/statsd
+    labels:
+      - "traefik.enable=false"
+      - "traefik.http.services.statsd-exporter.loadbalancer.server.port=9125"
+      - "traefik.http.services.statsd-exporter.loadbalancer.server.port=9102"
 
   node-exporter:
     image: prom/node-exporter:v1.4.0
     command:
       - "--path.procfs=/host/proc"
       - "--path.rootfs=/rootfs"
       - "--path.sysfs=/host/sys"
       - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
       - "--collector.systemd"
       - "--collector.processes"
     networks:
       - rhodecode_network
     pid: host
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:9100:9100"
+    restart: always
+#    ports:
+#      - "9100:9100"
     volumes:
       - "/proc:/host/proc:ro"
       - "/sys:/host/sys:ro"
       - "/:/rootfs:ro"
+    labels:
+      - "traefik.enable=false"
+      - "traefik.http.services.node-exporter.loadbalancer.server.port=9100"
 
   prometheus:
-    image: prom/prometheus:v2.39.1
-    restart: unless-stopped
+    image: prom/prometheus:v2.40.2
+    restart: always
     command:
       - "--config.file=/etc/prometheus/prometheus.yml"
       - "--storage.tsdb.path=/prometheus"
       - "--web.console.libraries=/etc/prometheus/console_libraries"
       - "--web.console.templates=/etc/prometheus/consoles"
       - "--storage.tsdb.retention.time=24h"
       - "--web.enable-lifecycle"
-    ports:
-      - "127.0.0.1:9090:9090"
+#    ports:
+#      - "9090:9090"
     networks:
       - rhodecode_network
     volumes:
       - ./config/prometheus:/etc/prometheus
       - prometheus_data:/prometheus
+    labels:
+      - "traefik.enable=false"
+      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
 
   grafana:
-    image: grafana/grafana:9.2.1-ubuntu
-    restart: unless-stopped
-    env_file:
-      - ./config/grafana/grafana.env
-    ports:
-      - "4000:3000"
+    image: grafana/grafana:9.2.5
+    restart: always
+#    ports:
+#      - "3000:3000"
     volumes:
       - grafana_data:/var/lib/grafana
+      - ./config/grafana:/etc/grafana
     networks:
       - rhodecode_network
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.grafana.entrypoints=http"
+      - "traefik.http.routers.grafana.rule=PathPrefix(`/_grafana`)"
+      - "traefik.http.routers.grafana.service=grafana-http"
+      - "traefik.http.services.grafana-http.loadbalancer.server.port=3000"
 
   loki:
-    image: grafana/loki:2.6.1
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:3100:3100"
-      - "127.0.0.1:9095:9095"
+    image: grafana/loki:2.7.0
+    restart: always
+#    ports:
+#      - "3100:3100"
+#      - "9095:9095"
     command: [
       "-config.file=/etc/loki/loki-config.yaml"
     ]
     networks:
       - rhodecode_network
     volumes:
       - ./config/loki:/etc/loki
 
+    labels:
+      - "traefik.enable=false"
+      - "traefik.http.services.loki.loadbalancer.server.port=3100"
+      - "traefik.http.services.loki.loadbalancer.server.port=9095"
+
   promtail:
     image: grafana/promtail:latest
     command: [
       "-config.file=/etc/promtail/promtail-config.yaml"
     ]
     networks:
       - rhodecode_network
     volumes:
       - /var/log:/var/log
       - logvolume:/var/log_volume
       - ./config/promtail:/etc/promtail
+    labels:
+      - "traefik.enable=false"

entrypoints.d/entrypoint.sh

@@ -1,151 +1,152 b''
 #!/usr/bin/env bash
 set -Eeo pipefail
 
 function config_copy() {
   # copy over the configs if they don't exist
   for f in /etc/rhodecode/conf_build/*; do
     fname=${f##*/}
     if [ ! -f "/etc/rhodecode/conf/$fname" ]; then
         echo "$fname not exists copying over as default conf..."
         cp -v $f /etc/rhodecode/conf/$fname
     fi
   done
 
 }
 
 function db_upgrade() {
   echo 'ENTRYPOINT: Upgrading database.'
-  /var/opt/rhodecode_bin/bin/rc-upgrade-db $MAIN_INI_PATH --force-yes
+  /usr/local/bin/rhodecode_bin/bin/rc-upgrade-db $MAIN_INI_PATH --force-yes
 }
 
 function db_init() {
 
   gosu $RC_USER \
-    /home/$RC_USER/.rccontrol/$RC_TYPE_ID/profile/bin/rc-setup-app \
+    /usr/local/bin/rhodecode_bin/bin/rc-setup-app \
     $MAIN_INI_PATH \
     --force-yes \
     --skip-existing-db \
     --user=$RHODECODE_USER_NAME \
     --password=$RHODECODE_USER_PASS \
     --email=$RHODECODE_USER_EMAIL \
     --repos=$RHODECODE_REPO_DIR
 }
 
 function rhodecode_setup() {
   for f in /home/$RC_USER/.rccontrol/bootstrap/*.py; do
     fname=${f##*/}
 
     echo "Running script $fname on $RC_TYPE_ID"
-    gosu $RC_USER /home/$RC_USER/.rccontrol/$RC_TYPE_ID/profile/bin/rc-ishell $MAIN_INI_PATH <<< "%run $f"
+    gosu $RC_USER /usr/local/bin/rhodecode_bin/bin/rc-ishell $MAIN_INI_PATH <<< "%run $f"
 
   done
 }
 
 function generate_ssh_keys() {
   keys_dir=/etc/rhodecode/conf/ssh
 
   if [[ ! -d $keys_dir ]]; then
     echo "Generating $keys_dir/ssh_host_rsa_key ..."
     gosu "$RC_USER" mkdir -p $keys_dir
   fi
 
   # Generate ssh host key for the first time
   if [[ ! -f $keys_dir/ssh_host_rsa_key ]]; then
     echo "Generating $keys_dir/ssh_host_rsa_key ..."
     gosu "$RC_USER" ssh-keygen -f $keys_dir/ssh_host_rsa_key -N '' -t rsa
     gosu "$RC_USER" chmod 0600 $keys_dir/ssh_host_rsa_key
   fi
 
   if [[ ! -f $keys_dir/ssh_host_ecdsa_key ]]; then
     echo "Generating $keys_dir/ssh_host_ecdsa_key ..."
     gosu "$RC_USER" ssh-keygen -f $keys_dir/ssh_host_ecdsa_key -N '' -t ecdsa
     gosu "$RC_USER" chmod 0600 $keys_dir/ssh_host_ecdsa_key
   fi
 
   if [[ ! -f $keys_dir/ssh_host_ed25519_key ]]; then
     echo "Generating $keys_dir/ssh_host_ed25519_key ..."
     gosu "$RC_USER" ssh-keygen -f $keys_dir/ssh_host_ed25519_key -N '' -t ed25519
     gosu "$RC_USER" chmod 0600 $keys_dir/ssh_host_ed25519_key
   fi
 
   if [[ ! -f $keys_dir/authorized_keys ]]; then
     echo "Generating $keys_dir/authorized_keys..."
     gosu "$RC_USER" touch $keys_dir/authorized_keys
   fi
 
   sed -i "s/AllowUsers USER/AllowUsers $RC_USER/" $SSHD_CONF_FILE
 }
 
 
 echo "ENTRYPOINT: Running $RC_APP_TYPE with cmd '$1'"
 
 if [ "$SSH_BOOTSTRAP" = 1 ]; then
   # generate SSH keys
   generate_ssh_keys
 fi
 
 isLikelyWeb=
 case "$1" in
 	supervisord | pserve | gunicorn ) isLikelyWeb=1 ;;
 esac
 
 if [[ $RC_APP_TYPE = "rhodecode_http" ]]; then
 
   DB_INIT_FILE=/var/opt/rhodecode_data/.dbinit_bootstrapped
   if [ "$FORCE_DB_INIT_FILE" = 1 ]; then
     rm $DB_INIT_FILE
   fi
 
   # Avoid DB_INIT to run multiple times
   if [[ ! -e $DB_INIT_FILE ]]; then
     echo "ENTRYPOINT: Starting $RC_APP_TYPE initial db bootstrap"
 
     db_init
 
     gosu $RC_USER touch "$DB_INIT_FILE"
     echo "ENTRYPOINT: marked as db-bootstrapped at $DB_INIT_FILE"
 
   fi
 
   RC_SETUP_FILE=/var/opt/rhodecode_data/.setup_bootstrapped
   if [ "$FORCE_RC_SETUP_APP" = 1 ]; then
     rm $RC_SETUP_FILE
   fi
 
   # Avoid destroying bootstrapping by simple start/stop
   if [[ ! -e $RC_SETUP_FILE ]]; then
     echo "ENTRYPOINT: Starting $RC_APP_TYPE initial bootstrap"
 
     # copy over default configuration files
     config_copy
 
     # setup application with specific options
     if [ "$SETUP_APP" = 1 ]; then
       rhodecode_setup
     fi
 
     gosu $RC_USER touch "$RC_SETUP_FILE"
     echo "ENTRYPOINT: marked as setup-bootstrapped at $RC_SETUP_FILE"
 
   fi
 
   if [ "$DB_UPGRADE" = 1 ]; then
     # run DB migrate
+    echo "Found DB_UPGRADE flag, running DB upgrade"
     db_upgrade
   fi
 
 fi
 
 
 if [ "$RC_APP_PROC" = 1 ]; then
   # Fix problem with zombie processes when using executables like supervisord/gunicorn
   set -- tini -- "$@"
   set -- gosu $RC_USER "$@"
 fi
 
 if [ "$RC_APP_TYPE" = "rhodecode_sshd" ]; then
   # Fix problem with Missing privilege separation directory error
   mkdir -p /run/sshd
 fi
 
 exec "$@"

service/rhodecode/rhodecode.dockerfile

@@ -1,258 +1,283 b''
 FROM ubuntu:22.04
 # Using 22.04 LTS Release
 MAINTAINER RhodeCode Inc. <[e-mail]>
 
 ARG TZ="UTC"
 ARG LOCALE_TYPE=en_US.UTF-8
 ARG RHODECODE_TYPE=Enterprise
 # binary-install
-ARG RHODECODE_VERSION=4.27.1
+ARG RHODECODE_VERSION=4.28.0
 
 ARG RHODECODE_DB=sqlite
 ARG RHODECODE_USER_NAME=admin
 ARG RHODECODE_USER_PASS=secret4
 ARG RHODECODE_USER_EMAIL=[e-mail]
 
+# nix ver/channels
+ARG DEV_NIX_VERSION=2.0.4
+ARG DEV_NIX_CHANNEL=nixos-18.03
+
 # env are runtime
 ENV \
     TZ=${TZ} \
     LOCALE_TYPE=${LOCALE_TYPE} \
     \
     ## Define type we build, and the instance we'll create
     RHODECODE_TYPE=${RHODECODE_TYPE} \
     RC_TYPE_ID=enterprise-1 \
     \
     ## SETUP ARGS FOR INSTALLATION ##
     ## set version we build on, get from .env or set default ver
     RHODECODE_VERSION=${RHODECODE_VERSION} \
     \
     ## set DB, default sqlite
     RHODECODE_DB=${RHODECODE_DB} \
     \
     ## set app bootstrap required data
     RHODECODE_USER_NAME=${RHODECODE_USER_NAME} \
     RHODECODE_USER_PASS=${RHODECODE_USER_PASS} \
     RHODECODE_USER_EMAIL=${RHODECODE_USER_EMAIL} \
     \
     RC_USER=rhodecode \
     \
     # SVN CONFIG
     MOD_DAV_SVN_CONF_FILE=/etc/rhodecode/conf/svn/mod_dav_svn.conf \
     MOD_DAV_SVN_PORT=8090 \
     \
     # SSHD CONFIG
     SSHD_CONF_FILE=/etc/rhodecode/sshd_config \
     \
+    SHARED_CONF_DIR=/etc/rhodecode/conf \
     BUILD_CONF=/etc/rhodecode/conf_build \
-    BUILD_BIN_DIR=/var/opt/rhodecode_bin \
+    BUILD_BIN_DIR=/usr/local/bin/rhodecode_bin \
     RHODECODE_DATA_DIR=/var/opt/rhodecode_data \
     RHODECODE_REPO_DIR=/var/opt/rhodecode_repo_store \
     RHODECODE_HTTP_PORT=10020 \
     RHODECODE_VCS_PORT=10010 \
     RHODECODE_HOST=0.0.0.0 \
     RHODECODE_VCS_HOST=127.0.0.1
 
 ENV \
     RCCONTROL=/home/$RC_USER/.rccontrol-profile/bin/rccontrol \
     SUPERVISOR_CONF=/home/$RC_USER/.rccontrol/supervisor/supervisord.ini \
     # make application scripts visible
     PATH=$PATH:/home/$RC_USER/.rccontrol-profile/bin
 
 ENV SVN_LOCALE_DEPS apache2 apache2-utils libapache2-mod-svn
 ENV SSH_LOCALE_DEPS openssh-server
 ENV PYTHON_DEPS python2
 ENV EXTRA_DEPS ""
 
 RUN \
 echo "** install base packages **" && \
 set -eux; \
 	\
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	DEBIAN_FRONTEND="noninteractive" \
 	apt-get install -y --no-install-recommends \
         tini \
         bash \
         binutils \
         tzdata \
         locales \
         openssl \
         curl \
         sudo \
         gosu \
         bzip2 \
         ca-certificates \
         $PYTHON_DEPS \
         $SSH_LOCALE_DEPS \
         $SVN_LOCALE_DEPS \
         $EXTRA_DEPS \
 	; \
 	rm -rf /var/lib/apt/lists/*;
 
 RUN \
 echo "** Configure the python executable for py2/3 compat **" && \
-ISPY=$(which python3 || which python2) && \
-if [ -n $ISPY ] ; then ln -s $ISPY /usr/bin/python ; fi
+IS_PY=$(which python3 || which python2) && \
+if [ -n $IS_PY ] ; then ln -s $IS_PY /usr/bin/python ; fi
 
 RUN \
 echo "** Configure the locales **" && \
     sed -i "s/^# ${LOCALE_TYPE}/${LOCALE_TYPE}/g" /etc/locale.gen && \
     locale-gen
 
 # locale-archive is a fix for old nix glibc2.26 locales available
 ENV \
     LOCALE_ARCHIVE=/var/opt/locale-archive \
     LANG=${LOCALE_TYPE} \
     LANGUAGE=${LOCALE_TYPE} \
     LC_ALL=${LOCALE_TYPE}
 
 # configure the system user
 # explicitly set uid/gid to guarantee that it won't change in the future
 # the values 999:999 are identical to the current user/group id assigned
 RUN \
 echo "** Create system user $RC_USER **" && \
   groupadd --system --gid 999 $RC_USER && \
   useradd --system --gid $RC_USER --uid 999 --shell /bin/bash $RC_USER && \
   usermod -G $RC_USER $RC_USER
 
+RUN \
+echo "** Create nix-build user $NIX_BLD_USER **" && \
+    groupadd --system --gid 1099 $NIX_BLD_USER && \
+    useradd --system --gid $NIX_BLD_USER --uid 1099 --shell /bin/bash $NIX_BLD_USER && \
+    usermod -G $NIX_BLD_USER $NIX_BLD_USER
+
+RUN \
+echo "** disable nix sandboxing **" && \
+    mkdir /etc/nix && echo 'sandbox = false' > /etc/nix/nix.conf
+
+
 # set the defult bash shell
 SHELL ["/bin/bash", "-c"]
 
 # Fix and set a timezone
 RUN \
 echo "** configure the timezone **" && \
 rm /etc/localtime && cp /usr/share/zoneinfo/$TZ /etc/localtime && \
 echo $TZ > /etc/timezone
 
 
 RUN \
 echo "** prepare rhodecode store and cache **" && \
   install -d -m 0700 -o $RC_USER -g $RC_USER /nix && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /opt/rhodecode && \
-  install -d -m 0755 -o $RC_USER -g $RC_USER /var/opt/rhodecode_bin && \
+  install -d -m 0755 -o $RC_USER -g $RC_USER /usr/local/bin/rhodecode_bin && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $RHODECODE_REPO_DIR && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $RHODECODE_DATA_DIR && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $BUILD_CONF && \
+  install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-vcsserver && \
+  install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-enterprise-ce && \
+  install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-enterprise-ee && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/ && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/cache && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/bootstrap && \
   install -d -m 0700 -o $RC_USER -g $RC_USER /home/$RC_USER/.ssh && \
   install -d -m 0700 -o $RC_USER -g $RC_USER /home/$RC_USER/.rhoderc
 
 # expose our custom sshd config
 COPY service/sshd/sshd_config $SSHD_CONF_FILE
 
 # Apache SVN setup
 RUN \
     echo "**** Apache config cleanup ****" && \
     rm -f /etc/apache2/conf.d/info.conf \
           /etc/apache2/conf.d/mpm.conf \
           /etc/apache2/conf.d/userdir.conf && \
     rm -f /etc/apache2/sites-enabled/* && \
     rm -f /etc/apache2/sites-available/*
 
 # custom SVN virtualhost
 COPY service/svn/virtualhost.conf /etc/apache2/sites-enabled/
 
 RUN \
 echo "**** Apache config ****" && \
     echo $(strings /usr/lib/apache2/modules/mod_dav_svn.so | grep 'Powered by') > /var/opt/dav.version && \
     mkdir -p /run/apache2 && \
     mkdir -p /var/opt/www && \
     echo "unset HOME" > /etc/apache2/envvars && \
     echo "export APACHE_RUN_USER=${RC_USER}" >> /etc/apache2/envvars && \
     echo "export APACHE_PID_FILE=/var/run/apache2/apache2.pid" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_DIR=/var/run/apache2" >> /etc/apache2/envvars && \
     echo "export APACHE_LOCK_DIR=/var/lock/apache2" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_USER=${RC_USER}" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_GROUP=${RC_USER}" >> /etc/apache2/envvars && \
     sed -i "s/Listen 80/Listen ${MOD_DAV_SVN_PORT}/g" /etc/apache2/ports.conf
 
 
 # Copy artifacts
 
 COPY --chown=$RC_USER:$RC_USER .cache/* /home/$RC_USER/.rccontrol/cache/
-COPY --chown=$RC_USER:$RC_USER config/compose/rhodecode_enterprise.license /home/$RC_USER/.rccontrol/bootstrap/
+COPY --chown=$RC_USER:$RC_USER config/_shared/rhodecode_enterprise.license /home/$RC_USER/.rccontrol/bootstrap/
 COPY --chown=$RC_USER:$RC_USER service/rhodecode/bootstrap/* /home/$RC_USER/.rccontrol/bootstrap/
 
 RUN \
 echo "**** locale-archive path ****" && \
     mv -v /home/$RC_USER/.rccontrol/cache/locale-archive /var/opt/locale-archive
 
 # change to non-root user for RUN commands
 USER $RC_USER
 WORKDIR /home/$RC_USER
 
 RUN \
 echo "** install rhodecode control **" && \
   cd /home/$RC_USER/.rccontrol/cache && \
   INSTALLER=$(ls -Art /home/$RC_USER/.rccontrol/cache/RhodeCode-installer-* | tail -n 1) && \
   chmod +x ${INSTALLER} && \
   ${INSTALLER} --accept-license && \
   ${RCCONTROL} self-init && \
   cp -v /home/$RC_USER/.rccontrol-profile/etc/ca-bundle.crt $BUILD_CONF/ && \
-  echo "Done"
+  echo "Done installing rhodecode control"
 
 RUN \
 echo "** install vcsserver ${RHODECODE_VERSION} **" && \
   ${RCCONTROL} install VCSServer --version ${RHODECODE_VERSION} --start-at-boot=yes --accept-license --offline \
   '{"host":"'"$RHODECODE_VCS_HOST"'", "port":"'"$RHODECODE_VCS_PORT"'"}' && \
   VCSSERVER_PATH=/home/$RC_USER/.rccontrol/vcsserver-1 && \
-  rm -rf $BUILD_BIN_DIR/vcs_bin && ln -s ${VCSSERVER_PATH}/profile/bin $BUILD_BIN_DIR/vcs_bin && \
-  cp -v ${VCSSERVER_PATH}/vcsserver.ini $BUILD_CONF/vcsserver.ini
+  rm -rf $BUILD_BIN_DIR/vcs_bin && \
+  ln -s ${VCSSERVER_PATH}/profile/bin $BUILD_BIN_DIR/vcs_bin && \
+  cp -v ${VCSSERVER_PATH}/vcsserver.ini $BUILD_CONF/vcsserver.ini && \
+  cp -v ${VCSSERVER_PATH}/gunicorn_conf.py $BUILD_CONF/gunicorn_conf_vcs.py && \
+  echo "Done installing vcsserver"
 
 RUN \
 echo "** install rhodecode ${RHODECODE_TYPE} ${RHODECODE_VERSION} **" && \
   RHODECODE_DB_INIT=sqlite && \
   ${RCCONTROL} install ${RHODECODE_TYPE} --version ${RHODECODE_VERSION} --start-at-boot=yes --accept-license --offline \
   '{"host":"'"$RHODECODE_HOST"'", "port":"'"$RHODECODE_HTTP_PORT"'", "username":"'"$RHODECODE_USER_NAME"'", "password":"'"$RHODECODE_USER_PASS"'", "email":"'"$RHODECODE_USER_EMAIL"'", "repo_dir":"'"$RHODECODE_REPO_DIR"'", "database": "'"$RHODECODE_DB_INIT"'", "skip_existing_db": "1"}' && \
   RHODECODE_PATH=/home/$RC_USER/.rccontrol/${RC_TYPE_ID} && \
   rm -rf $BUILD_BIN_DIR/bin && ln -s ${RHODECODE_PATH}/profile/bin $BUILD_BIN_DIR/ && \
   cp -v ${RHODECODE_PATH}/rhodecode.ini $BUILD_CONF/rhodecode.ini && \
   cp -v ${RHODECODE_PATH}/gunicorn_conf.py $BUILD_CONF/gunicorn_conf.py && \
   cp -v ${RHODECODE_PATH}/search_mapping.ini $BUILD_CONF/search_mapping.ini && \
   mkdir -p $RHODECODE_DATA_DIR/static && cp -r ${RHODECODE_PATH}/public/* $RHODECODE_DATA_DIR/static/ && \
-  rm ${RHODECODE_PATH}/rhodecode.db
+  rm ${RHODECODE_PATH}/rhodecode.db && \
+  echo "Done installing rhodecode"
 
 
 RUN \
 echo "** configure supervisord **" && \
   cp -v ${SUPERVISOR_CONF} $BUILD_CONF/ && \
   sed -i "s/self_managed_supervisor = False/self_managed_supervisor = True/g" /home/$RC_USER/.rccontrol.ini && \
-  echo "done"
+  echo "Done installing supervisord"
 
 USER root
 
-
 RUN \
 echo "**** cleanup ****" && \
     apt-get remove -y $PYTHON_DEPS && \
     apt-get autoclean -y && \
     rm -f /tmp/* && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /var/cache/apk/* && \
     rm -f /home/$RC_USER/.rccontrol/cache/RhodeCode-installer-* && \
     rm -f /home/$RC_USER/.rccontrol/cache/*.bz2 && \
-    rm -rf /var/lib/apt/lists/* \
-    rm -rf /var/cache/apk/* \
-    rm ${SUPERVISOR_CONF}
+    rm -f ${SUPERVISOR_CONF} && \
+    echo "Done cleanup"
+
 
 # copy entrypoints
 COPY entrypoints.d/entrypoint.sh /opt/entrypoints.d/entrypoint.sh
+
 RUN chmod +x /opt/entrypoints.d/entrypoint.sh
 
 # config volume
 VOLUME /etc/rhodecode/conf
 
 # repo store volume
 VOLUME /var/opt/rhodecode_repo_store
 
 # data volume
 VOLUME /var/opt/rhodecode_data
 
 # logs volume
 VOLUME /var/log/rhodecode
 
 ENTRYPOINT ["/opt/entrypoints.d/entrypoint.sh"]
 
 # compose can override this
-CMD ["supervisord", "--nodaemon", "-c", "/etc/rhodecode/conf/supervisord.ini"]
+CMD [ "$BUILD_BIN_DIR/bin/gunicorn", "--error-logfile=-", "--paster=/etc/rhodecode/conf_build/run.ini", "--config=/etc/rhodecode/conf_build/gunicorn_conf.py" ]

service/rhodecode/rhodecode_source.dockerfile

@@ -1,305 +1,324 b''
 FROM ubuntu:22.04
 # Using 22.04 LTS Release
 MAINTAINER RhodeCode Inc. <[e-mail]>
 
 ARG TZ="UTC"
 ARG LOCALE_TYPE=en_US.UTF-8
 ARG RHODECODE_TYPE=Enterprise
 # source-install
-ARG RHODECODE_VERSION=4.26.0
+ARG RHODECODE_VERSION=4.28.0
 
 ARG RHODECODE_DB=sqlite
 ARG RHODECODE_USER_NAME=admin
 ARG RHODECODE_USER_PASS=secret4
 ARG RHODECODE_USER_EMAIL=[e-mail]
 
 # nix ver/channels
 ARG DEV_NIX_VERSION=2.0.4
 ARG DEV_NIX_CHANNEL=nixos-18.03
 
 # env are runtime
 ENV \
     TZ=${TZ} \
     LOCALE_TYPE=${LOCALE_TYPE} \
     \
     ## Define type we build, and the instance we'll create
     RHODECODE_TYPE=${RHODECODE_TYPE} \
     RC_TYPE_ID=enterprise-1 \
     \
     ## SETUP ARGS FOR INSTALLATION ##
     ## set version we build on, get from .env or set default ver
     RHODECODE_VERSION=${RHODECODE_VERSION} \
     \
     ## set DB, default sqlite
     RHODECODE_DB=${RHODECODE_DB} \
     \
     ## set app bootstrap required data
     RHODECODE_USER_NAME=${RHODECODE_USER_NAME} \
     RHODECODE_USER_PASS=${RHODECODE_USER_PASS} \
     RHODECODE_USER_EMAIL=${RHODECODE_USER_EMAIL} \
     \
     RC_USER=rhodecode \
     \
     # SVN CONFIG
     MOD_DAV_SVN_CONF_FILE=/etc/rhodecode/conf/svn/mod_dav_svn.conf \
     MOD_DAV_SVN_PORT=8090 \
     \
     # SSHD CONFIG
     SSHD_CONF_FILE=/etc/rhodecode/sshd_config \
     \
+    SHARED_CONF_DIR=/etc/rhodecode/conf \
     BUILD_CONF=/etc/rhodecode/conf_build \
-    BUILD_BIN_DIR=/var/opt/rhodecode_bin \
+    BUILD_BIN_DIR=/usr/local/bin/rhodecode_bin \
     RHODECODE_DATA_DIR=/var/opt/rhodecode_data \
     RHODECODE_REPO_DIR=/var/opt/rhodecode_repo_store \
     RHODECODE_HTTP_PORT=10020 \
     RHODECODE_VCS_PORT=10010 \
     RHODECODE_HOST=0.0.0.0 \
     RHODECODE_VCS_HOST=127.0.0.1
 
 ENV \
     RCCONTROL=/home/$RC_USER/.rccontrol-profile/bin/rccontrol \
     SUPERVISOR_CONF=/home/$RC_USER/.rccontrol/supervisor/supervisord.ini \
     # make application scripts visible
     PATH=$PATH:/home/$RC_USER/.rccontrol-profile/bin
 
 ENV SVN_LOCALE_DEPS apache2 apache2-utils libapache2-mod-svn
 ENV SSH_LOCALE_DEPS openssh-server
 ENV PYTHON_DEPS python2
-ENV EXTRA_DEPS  vim
+ENV EXTRA_DEPS  ""
 
 ENV \
     PATH=$PATH:/nix/var/nix/profiles/per-user/$RC_USER/profile/bin:/home/$RC_USER/rhodecode-enterprise-ee/profile/bin \
     NIX_BLD_USER=nixbld \
     NIX_PATH=/nix/var/nix/profiles/per-user/$RC_USER/channels \
     NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
 
 
 RUN \
 echo "** install base packages **" && \
 set -eux; \
 	\
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	DEBIAN_FRONTEND="noninteractive" \
 	apt-get install -y --no-install-recommends \
         tini \
         bash \
         binutils \
         tzdata \
         locales \
         openssl \
         curl \
         sudo \
         gosu \
         bzip2 \
         ca-certificates \
         $PYTHON_DEPS \
         $SSH_LOCALE_DEPS \
         $SVN_LOCALE_DEPS \
         $EXTRA_DEPS \
 	; \
 	rm -rf /var/lib/apt/lists/*;
 
 RUN \
 echo "** Configure the python executable for py2/3 compat **" && \
-ISPY=$(which python3 || which python2) && \
-if [ -n $ISPY ] ; then ln -s $ISPY /usr/bin/python ; fi
+IS_PY=$(which python3 || which python2) && \
+if [ -n $IS_PY ] ; then ln -s $IS_PY /usr/bin/python ; fi
 
 RUN \
 echo "** Configure the locales **" && \
     sed -i "s/^# ${LOCALE_TYPE}/${LOCALE_TYPE}/g" /etc/locale.gen && \
     locale-gen
 
 # locale-archive is a fix for old nix glibc2.26 locales available
 ENV \
     LOCALE_ARCHIVE=/var/opt/locale-archive \
     LANG=${LOCALE_TYPE} \
     LANGUAGE=${LOCALE_TYPE} \
     LC_ALL=${LOCALE_TYPE}
 
 # configure the system user
 # explicitly set uid/gid to guarantee that it won't change in the future
 # the values 999:999 are identical to the current user/group id assigned
 RUN \
 echo "** Create system user $RC_USER **" && \
   groupadd --system --gid 999 $RC_USER && \
   useradd --system --gid $RC_USER --uid 999 --shell /bin/bash $RC_USER && \
   usermod -G $RC_USER $RC_USER
 
 RUN \
 echo "** Create nix-build user $NIX_BLD_USER **" && \
     groupadd --system --gid 1099 $NIX_BLD_USER && \
     useradd --system --gid $NIX_BLD_USER --uid 1099 --shell /bin/bash $NIX_BLD_USER && \
     usermod -G $NIX_BLD_USER $NIX_BLD_USER
 
 RUN \
 echo "** disable nix sandboxing **" && \
     mkdir /etc/nix && echo 'sandbox = false' > /etc/nix/nix.conf
 
 
 # set the defult bash shell
 SHELL ["/bin/bash", "-c"]
 
 # Fix and set a timezone
 RUN \
 echo "** configure the timezone **" && \
 rm /etc/localtime && cp /usr/share/zoneinfo/$TZ /etc/localtime && \
 echo $TZ > /etc/timezone
 
 
 RUN \
 echo "** prepare rhodecode store and cache **" && \
   install -d -m 0700 -o $RC_USER -g $RC_USER /nix && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /opt/rhodecode && \
-  install -d -m 0755 -o $RC_USER -g $RC_USER /var/opt/rhodecode_bin && \
+  install -d -m 0755 -o $RC_USER -g $RC_USER /usr/local/bin/rhodecode_bin && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $RHODECODE_REPO_DIR && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $RHODECODE_DATA_DIR && \
   install -d -m 0755 -o $RC_USER -g $RC_USER $BUILD_CONF && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-vcsserver && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-enterprise-ce && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/rhodecode-enterprise-ee && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/ && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/cache && \
   install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/bootstrap && \
-  install -d -m 0700 -o $RC_USER -g $RC_USER /home/$RC_USER/.ssh
+  install -d -m 0700 -o $RC_USER -g $RC_USER /home/$RC_USER/.ssh && \
+  install -d -m 0700 -o $RC_USER -g $RC_USER /home/$RC_USER/.rhoderc
 
 # expose our custom sshd config
 COPY service/sshd/sshd_config $SSHD_CONF_FILE
 
 # Apache SVN setup
 RUN \
     echo "**** Apache config cleanup ****" && \
     rm -f /etc/apache2/conf.d/info.conf \
           /etc/apache2/conf.d/mpm.conf \
           /etc/apache2/conf.d/userdir.conf && \
     rm -f /etc/apache2/sites-enabled/* && \
     rm -f /etc/apache2/sites-available/*
 
 # custom SVN virtualhost
 COPY service/svn/virtualhost.conf /etc/apache2/sites-enabled/
 
 RUN \
 echo "**** Apache config ****" && \
     echo $(strings /usr/lib/apache2/modules/mod_dav_svn.so | grep 'Powered by') > /var/opt/dav.version && \
     mkdir -p /run/apache2 && \
     mkdir -p /var/opt/www && \
     echo "unset HOME" > /etc/apache2/envvars && \
     echo "export APACHE_RUN_USER=${RC_USER}" >> /etc/apache2/envvars && \
     echo "export APACHE_PID_FILE=/var/run/apache2/apache2.pid" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_DIR=/var/run/apache2" >> /etc/apache2/envvars && \
     echo "export APACHE_LOCK_DIR=/var/lock/apache2" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_USER=${RC_USER}" >> /etc/apache2/envvars && \
     echo "export APACHE_RUN_GROUP=${RC_USER}" >> /etc/apache2/envvars && \
     sed -i "s/Listen 80/Listen ${MOD_DAV_SVN_PORT}/g" /etc/apache2/ports.conf
 
 
 # Copy artifacts
-COPY --chown=$RC_USER:$RC_USER .source/ /home/$RC_USER/
+
 COPY --chown=$RC_USER:$RC_USER .cache/* /home/$RC_USER/.rccontrol/cache/
-COPY --chown=$RC_USER:$RC_USER config/compose/rhodecode_enterprise.license /home/$RC_USER/.rccontrol/bootstrap/
+COPY --chown=$RC_USER:$RC_USER config/_shared/rhodecode_enterprise.license /home/$RC_USER/.rccontrol/bootstrap/
 COPY --chown=$RC_USER:$RC_USER service/rhodecode/bootstrap/* /home/$RC_USER/.rccontrol/bootstrap/
 
+COPY --chown=$RC_USER:$RC_USER .source/ /home/$RC_USER/
+RUN \
+echo "** prepare rhodecode dirs **" && \
+  install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/vcsserver-1 && \
+  install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/community-1 && \
+  install -d -m 0755 -o $RC_USER -g $RC_USER /home/$RC_USER/.rccontrol/enterprise-1 && \
+
 RUN \
 echo "**** locale-archive path ****" && \
     mv -v /home/$RC_USER/.rccontrol/cache/locale-archive /var/opt/locale-archive
 
 # change to non-root user for RUN commands
 USER $RC_USER
 WORKDIR /home/$RC_USER
 
 
 RUN \
 echo "** download and install nix ** from $DEV_NIX_VERSION/install" && \
     curl -L https://releases.nixos.org/nix/nix-$DEV_NIX_VERSION/install | USER=$RC_USER /bin/bash
 
 RUN \
 echo "** update nix package database and set channel to $DEV_NIX_CHANNEL **" && \
     . /home/rhodecode/.nix-profile/etc/profile.d/nix.sh && \
 	nix-channel --add https://channels.nixos.org/$DEV_NIX_CHANNEL nixpkgs && \
 	nix-channel --update
 
 
 RUN \
     echo "** save nix config **" && \
     touch /home/$RC_USER/.rhoderc && \
     mkdir -p /home/$RC_USER/.nixpkgs && touch /home/$RC_USER/.nixpkgs/config.nix && \
     printf '{\n  rc = {\n   sources = {\n    rhodecode-vcsserver = "/home/'$RC_USER'/rhodecode-vcsserver";\n    rhodecode-enterprise-ce = "/home/'$RC_USER'/rhodecode-enterprise-ce";\n    rhodecode-enterprise-ee = "/home/'$RC_USER'/rhodecode-enterprise-ee";\n   };\n  };\n}\n' > /home/$RC_USER/.nixpkgs/config.nix
 
 
 RUN \
 echo "** install rhodecode control **" && \
 #  cd /home/$RC_USER/.rccontrol/cache && \
 #  INSTALLER=$(ls -Art /home/$RC_USER/.rccontrol/cache/RhodeCode-installer-* | tail -n 1) && \
 #  chmod +x ${INSTALLER} && \
 #  ${INSTALLER} --accept-license && \
 #  ${RCCONTROL} self-init && \
 #  cp -v /home/$RC_USER/.rccontrol-profile/etc/ca-bundle.crt $BUILD_CONF/ && \
-  echo "Done"
+  echo "Done installing rhodecode control"
 
 RUN \
-echo "** install build vcsserver ${RHODECODE_VERSION} **" && \
+echo "** install vcsserver ${RHODECODE_VERSION} **" && \
   . /home/rhodecode/.nix-profile/etc/profile.d/nix.sh && \
-  nix-build --show-trace --cores 0 --max-jobs 4 --no-build-output --out-link rhodecode-vcsserver/result rhodecode-vcsserver/default.nix && \
-  nix-shell --command 'echo ok' rhodecode-vcsserver/default.nix && \
+  nix-build --show-trace --cores 0 --max-jobs 4 --no-build-output --out-link /home/$RC_USER/.rccontrol/vcsserver-1/profile rhodecode-vcsserver/default.nix && \
+  nix-shell --command 'echo COMMAND FROM NIX-SHELL TEST' rhodecode-vcsserver/default.nix && \
   VCSSERVER_PATH=/home/$RC_USER/rhodecode-vcsserver && \
-  rm -rf $BUILD_BIN_DIR/vcs_bin && ln -s ${VCSSERVER_PATH}/result/bin $BUILD_BIN_DIR/vcs_bin && \
-  cp -v ${VCSSERVER_PATH}/configs/production.ini $BUILD_CONF/vcsserver.ini
+  rm -rf $BUILD_BIN_DIR/vcs_bin && \
+  cp -rv --preserve=links /home/$RC_USER/.rccontrol/vcsserver-1/profile/bin $BUILD_BIN_DIR/vcs_bin && \
+  cp -v ${VCSSERVER_PATH}/configs/production.ini $BUILD_CONF/vcsserver.ini && \
+  cp -v ${VCSSERVER_PATH}/configs/gunicorn_config.py $BUILD_CONF/gunicorn_conf_vcs.py && \
+  echo "Done installing vcsserver"
 
 RUN \
 echo "** install build Community ${RHODECODE_VERSION} **" && \
   . /home/rhodecode/.nix-profile/etc/profile.d/nix.sh && \
   echo "done"
 
 RUN \
-echo "** install build Enterprise ${RHODECODE_VERSION} **" && \
+echo "** install rhodecode ${RHODECODE_VERSION} **" && \
   . /home/rhodecode/.nix-profile/etc/profile.d/nix.sh && \
-  nix-build --show-trace --cores 0 --max-jobs 4 --no-build-output --out-link rhodecode-enterprise-ee/result rhodecode-enterprise-ee/default.nix && \
+  nix-build --show-trace --cores 0 --max-jobs 4 --no-build-output --out-link /home/$RC_USER/.rccontrol/enterprise-1/profile rhodecode-enterprise-ee/default.nix && \
   nix-shell --command 'echo ok' rhodecode-enterprise-ee/default.nix && \
   RHODECODE_PATH=/home/$RC_USER/rhodecode-enterprise-ee && \
-  rm -rf $BUILD_BIN_DIR/bin && ln -s ${RHODECODE_PATH}/result/bin $BUILD_BIN_DIR/ && \
+  rm -rf $BUILD_BIN_DIR/bin && \
+  cp -rv --preserve=links /home/$RC_USER/.rccontrol/enterprise-1/profile/bin $BUILD_BIN_DIR/ && \
   cp -v ${RHODECODE_PATH}/configs/production.ini $BUILD_CONF/rhodecode.ini && \
   cp -v ${RHODECODE_PATH}/configs/gunicorn_config.py $BUILD_CONF/gunicorn_conf.py && \
-  mkdir -p $RHODECODE_DATA_DIR/static && cp -r ${RHODECODE_PATH}/result/etc/static/* $RHODECODE_DATA_DIR/static/
+  mkdir -p $RHODECODE_DATA_DIR/static && cp -r /home/$RC_USER/.rccontrol/enterprise-1/profile/etc/static/* $RHODECODE_DATA_DIR/static/ && \
+  echo "Done installing rhodecode"
 
 
 RUN \
 echo "** configure supervisord **" && \
   #cp -v ${SUPERVISOR_CONF} $BUILD_CONF/ && \
   #sed -i "s/self_managed_supervisor = False/self_managed_supervisor = True/g" /home/$RC_USER/.rccontrol.ini && \
-  echo "done"
+  echo "Done installing supervisord"
 
 USER root
 
-
 RUN \
 echo "**** cleanup ****" && \
     apt-get remove -y $PYTHON_DEPS && \
     apt-get autoclean -y && \
     rm -f /tmp/* && \
     rm -f /home/$RC_USER/.rccontrol/cache/RhodeCode-installer-* && \
     rm -f /home/$RC_USER/.rccontrol/cache/*.bz2 && \
-    rm -rf /var/lib/apt/lists/* \
-    rm -rf /var/cache/apk/* \
-    rm ${SUPERVISOR_CONF}
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /var/cache/apk/* && \
+    rm -f ${SUPERVISOR_CONF} && \
+    rm -rf /home/$RC_USER/rhodecode-vcsserver && \
+    rm -rf /home/$RC_USER/rhodecode-enterprise-ce && \
+    rm -rf /home/$RC_USER/rhodecode-enterprise-ee && \
+    echo "Done cleanup"
+
 
 # copy entrypoints
 COPY entrypoints.d/entrypoint.sh /opt/entrypoints.d/entrypoint.sh
+
 RUN chmod +x /opt/entrypoints.d/entrypoint.sh
 
 # config volume
 VOLUME /etc/rhodecode/conf
 
 # repo store volume
 VOLUME /var/opt/rhodecode_repo_store
 
 # data volume
 VOLUME /var/opt/rhodecode_data
 
 # logs volume
 VOLUME /var/log/rhodecode
 
 ENTRYPOINT ["/opt/entrypoints.d/entrypoint.sh"]
 
 # compose can override this
-CMD ["supervisord", "--nodaemon", "-c", "/etc/rhodecode/conf/supervisord.ini"]
+CMD [ "$BUILD_BIN_DIR/bin/gunicorn", "--error-logfile=-", "--paster=/etc/rhodecode/conf_build/run.ini", "--config=/etc/rhodecode/conf_build/gunicorn_conf.py" ]

service/sshd/rhodecode_sshd.dockerfile

@@ -1,76 +1,77 b''
-FROM debian:buster
+FROM ubuntu:22.04
+# Using 22.04 LTS Release
 MAINTAINER RhodeCode Inc. <[e-mail]>
 
 # env are runtime/build
 ENV \
     TZ="UTC" \
     RC_USER=rhodecode \
     RHODECODE_USER_NAME=rhodecode \
     SSHD_CONF_FILE=/etc/rhodecode/sshd_config
 
 RUN \
 echo "** install base packages **" && \
 set -eux; \
 	\
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
         bash \
         tzdata \
         vim \
         openssl \
         openssh-server \
 	; \
 	rm -rf /var/lib/apt/lists/*;
 
 #	# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
 #	apt-mark auto '.*' > /dev/null; \
 #	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
 #	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
 
 # configure the system user
 # explicitly set uid/gid to guarantee that it won't change in the future
 # the values 999:999 are identical to the current user/group id assigned
 RUN \
 echo "** Create system user $RC_USER **" && \
   groupadd --system --gid 999 $RC_USER && \
   useradd --system --gid $RC_USER --uid 999 --shell /bin/bash $RC_USER
 
 
 RUN \
 echo "** prepare rhodecode store and cache **" && \
   install -d -m 0700 -o $RC_USER -g $RC_USER /home/$RC_USER/.ssh
 
 # set the defult bash shell
 SHELL ["/bin/bash", "-c"]
 
 # Fix and set a timezone
 RUN \
 echo "** configure the timezone **" && \
 echo $TZ > /etc/timezone
 
 # expose our custom sshd config
 COPY service/sshd/sshd_config $SSHD_CONF_FILE
 
 USER root
 
 RUN \
 echo "**** cleanup ****" && \
     rm -f /tmp/* && \
     rm -rf /var/lib/apt/lists/* \
     rm -rf /var/cache/apk/*
 
 # copy entrypoints
 COPY entrypoints.d/ssh-entrypoint.sh /opt/entrypoints.d/ssh-entrypoint.sh
 RUN chmod +x /opt/entrypoints.d/ssh-entrypoint.sh
 
 # config volume
 VOLUME /etc/rhodecode/conf
 
 # logs volume
 VOLUME /var/log/rhodecode
 
 ENTRYPOINT ["/opt/entrypoints.d/ssh-entrypoint.sh"]
 
 # compose can override this
 CMD ["/usr/sbin/sshd", "-f", "/etc/rhodecode/sshd_config", "-D", "-e"]

service/svn/rhodecode_svn.dockerfile

@@ -1,72 +1,99 b''
 FROM ubuntu:22.04
 # Using 22.04 LTS Release
 MAINTAINER RhodeCode Inc. <[e-mail]>
 
 
 ENV \
     RC_USER=rhodecode \
-    MOD_DAV_SVN_CONF_FILE=/etc/rhodecode/conf/svn/mod_dav_svn.conf
+    # SVN CONFIG
+    MOD_DAV_SVN_CONF_FILE=/etc/rhodecode/conf/svn/mod_dav_svn.conf \
+    MOD_DAV_SVN_PORT=8090
+
+ENV SVN_LOCALE_DEPS apache2 apache2-utils libapache2-mod-svn subversion
+#apache2-webdav
 
 RUN \
-echo "** install base svn packages **" && \
-  apt-get update && \
-  apt-get install --no-cache \
-    tini \
-    bash \
-    curl \
-    apache2 \
-    apache2-utils \
-    apache2-webdav \
-    mod_dav_svn \
-    subversion
+echo "** install svn base packages **" && \
+set -eux; \
+	\
+	savedAptMark="$(apt-mark showmanual)"; \
+	apt-get update; \
+	DEBIAN_FRONTEND="noninteractive" \
+	apt-get install -y --no-install-recommends \
+        tini \
+        bash \
+        binutils \
+        tzdata \
+        locales \
+        openssl \
+        curl \
+        sudo \
+        gosu \
+        bzip2 \
+        ca-certificates \
+        $SVN_LOCALE_DEPS \
+	; \
+	rm -rf /var/lib/apt/lists/*;
+
 
 # configure the system user
 # explicitly set uid/gid to guarantee that it won't change in the future
 # the values 999:999 are identical to the current user/group id assigned
 RUN \
 echo "** Create system user $RC_USER **" && \
   groupadd --system --gid 999 $RC_USER && \
-  useradd --system --gid $RC_USER --uid 999 --shell /bin/bash $RC_USER
+  useradd --system --gid $RC_USER --uid 999 --shell /bin/bash $RC_USER && \
+  usermod -G $RC_USER $RC_USER
+
+# Apache SVN setup
+RUN \
+    echo "**** Apache config cleanup ****" && \
+    rm -f /etc/apache2/conf.d/info.conf \
+          /etc/apache2/conf.d/mpm.conf \
+          /etc/apache2/conf.d/userdir.conf && \
+    rm -f /etc/apache2/sites-enabled/* && \
+    rm -f /etc/apache2/sites-available/*
 
+# custom SVN virtualhost
+COPY service/svn/virtualhost.conf /etc/apache2/sites-enabled/
+
+RUN \
+echo "**** Apache config ****" && \
+    echo $(strings /usr/lib/apache2/modules/mod_dav_svn.so | grep 'Powered by') > /var/opt/dav.version && \
+    mkdir -p /run/apache2 && \
+    mkdir -p /var/opt/www && \
+    echo "unset HOME" > /etc/apache2/envvars && \
+    echo "export APACHE_RUN_USER=${RC_USER}" >> /etc/apache2/envvars && \
+    echo "export APACHE_PID_FILE=/var/run/apache2/apache2.pid" >> /etc/apache2/envvars && \
+    echo "export APACHE_RUN_DIR=/var/run/apache2" >> /etc/apache2/envvars && \
+    echo "export APACHE_LOCK_DIR=/var/lock/apache2" >> /etc/apache2/envvars && \
+    echo "export APACHE_RUN_USER=${RC_USER}" >> /etc/apache2/envvars && \
+    echo "export APACHE_RUN_GROUP=${RC_USER}" >> /etc/apache2/envvars && \
+    sed -i "s/Listen 80/Listen ${MOD_DAV_SVN_PORT}/g" /etc/apache2/ports.conf
+
+USER root
 
 RUN \
 echo "**** cleanup ****" && \
-    apt-get purge tzdata python2 && \
+    apt-get autoclean -y && \
     rm -f /tmp/* && \
     rm -rf /var/lib/apt/lists/* \
     rm -rf /var/cache/apk/*
 
-RUN \
-    echo "**** Apache config cleanup ****" && \
-    rm -f /etc/apache2/conf.d/info.conf \
-          /etc/apache2/conf.d/mpm.conf \
-          /etc/apache2/conf.d/userdir.conf
-
-
-COPY svn/virtualhost.conf /etc/apache2/conf.d/
 
 # copy entrypoints
 COPY entrypoints.d/svn-entrypoint.sh /opt/entrypoints.d/svn-entrypoint.sh
 RUN chmod +x /opt/entrypoints.d/svn-entrypoint.sh
 
-RUN \
-    echo $(strings /usr/lib/apache2/mod_dav_svn.so | grep 'Powered by') > /var/opt/dav.version && \
-    mkdir -p /run/apache2 && \
-    mkdir -p /var/opt/www && \
-    echo "export APACHE_RUN_USER=${RC_USER}" > /etc/apache2/envvars && \
-    echo "export APACHE_RUN_GROUP=${RC_USER}" >> /etc/apache2/envvars && \
-    sed -i "s/User apache/User ${RC_USER}/g" /etc/apache2/httpd.conf && \
-    sed -i "s/Group apache/Group ${RC_USER}/g" /etc/apache2/httpd.conf
+# config volume
+VOLUME /etc/rhodecode/conf
 
 # repo store volume
 VOLUME /var/opt/rhodecode_repo_store
 
-# config volume
-VOLUME /etc/rhodecode/conf
-
 # logs volume
 VOLUME /var/log/rhodecode
 
 ENTRYPOINT ["/opt/entrypoints.d/svn-entrypoint.sh"]
 
-CMD ["apachectl", "-D", "FOREGROUND"]
+CMD ["apachectl", "-D", "FOREGROUND"]
  No newline at end of file

service/svn/virtualhost.conf

@@ -1,22 +1,33 b''
 LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so
 LoadModule authn_anon_module /usr/lib/apache2/modules/mod_authn_anon.so
 LoadModule dav_svn_module /usr/lib/apache2/modules/mod_dav_svn.so
 
+ErrorLogFormat "{ \"time\":\"%{%Y-%m-%d}tT%{%T}t.%{msec_frac}tZ\", \"function\" : \"[%-m:%l]\" , \"process\" : \"[pid %P:tid %T]\" , \"message\" : \"%M\" ,\ \"referer\"\ : \"%{Referer}i\" }"
+LogFormat "{ \"time\":\"%{%Y-%m-%d}tT%{%T}t.%{msec_frac}tZ\", \"process\":\"%D\", \"filename\":\"%f\", \"remoteIP\":\"%a\", \"host\":\"%V\", \"request\":\"%U\", \"query\":\"%q\", \"method\":\"%m\", \"status\":\"%>s\", \"userAgent\":\"%{User-agent}i\", \"referer\":\"%{Referer}i\" }" combined
+
+ErrorLog /dev/stderr
+CustomLog /dev/stdout combined
+
+
 <VirtualHost *:${MOD_DAV_SVN_PORT}>
     ServerAdmin admin@localhost
     DocumentRoot /var/opt/www
-    ErrorLog ${APACHE_LOG_DIR}/svn_error.log
-    CustomLog ${APACHE_LOG_DIR}/svn_access.log combined
+
+    ErrorLogFormat "{ \"time\":\"%{%Y-%m-%d}tT%{%T}t.%{msec_frac}tZ\", \"function\" : \"[%-m:%l]\" , \"process\" : \"[pid %P:tid %T]\" , \"message\" : \"%M\" ,\ \"referer\"\ : \"%{Referer}i\" }"
+    LogFormat "{ \"time\":\"%{%Y-%m-%d}tT%{%T}t.%{msec_frac}tZ\", \"process\":\"%D\", \"filename\":\"%f\", \"remoteIP\":\"%a\", \"host\":\"%V\", \"request\":\"%U\", \"query\":\"%q\", \"method\":\"%m\", \"status\":\"%>s\", \"userAgent\":\"%{User-agent}i\", \"referer\":\"%{Referer}i\" }" combined
+
+    ErrorLog /dev/stderr
+    CustomLog /dev/stdout combined
     LogLevel info
 
     <Location /_server_status>
         Require ip 127
         SetHandler server-status
         Require all granted
     </Location>
 
     # allows custom host names, prevents 400 errors on checkout
     HttpProtocolOptions Unsafe
 
     Include ${MOD_DAV_SVN_CONF_FILE}
 </VirtualHost>
  No newline at end of file