compose.yml

name: cli-node-docker-atlas-lab

# Core infrastructure entrypoint for the local Atlas Lab stack.
x-lab-env: &lab-env
  TZ: ${TZ}

services:
  gateway:
    build:
      context: ../..
      dockerfile: infra/docker/images/gateway/Dockerfile
      args:
        CADDY_VERSION: ${CADDY_VERSION}
    restart: unless-stopped
    env_file:
      - ../../env/lab.env
    environment:
      ATLAS_AI_LLM_ENABLED: "false"
      ATLAS_WORKBENCH_ENABLED: "false"
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 $$LAB_HTTPS_PORT || exit 1"]
      interval: 2s
      timeout: 5s
      retries: 30
      start_period: 2s
    ports:
      - "${LAB_HTTPS_PORT}:${LAB_HTTPS_PORT}"
      - "${GITLAB_HTTPS_PORT}:${GITLAB_HTTPS_PORT}"
      - "${PENPOT_HTTPS_PORT}:${PENPOT_HTTPS_PORT}"
      - "${TRILIUM_HTTPS_PORT}:${TRILIUM_HTTPS_PORT}"
    volumes:
      - gateway-certs:/etc/caddy/certs
      - gateway-config:/etc/caddy/dynamic
      - gateway-site:/srv
      - gateway-data:/data
    depends_on:
      gitlab:
        condition: service_started
      trilium:
        condition: service_started
      penpot-frontend:
        condition: service_started
    networks:
      - edge-net
      - apps-net
      - penpot-net

  gitlab:
    image: gitlab/gitlab-ce:${GITLAB_VERSION}
    hostname: ${LAB_PUBLIC_HOST}
    restart: unless-stopped
    shm_size: "256m"
    environment:
      <<: *lab-env
      GITLAB_ROOT_EMAIL: ${GITLAB_ROOT_EMAIL}
      GITLAB_ROOT_PASSWORD: ${GITLAB_ROOT_PASSWORD}
      GITLAB_OMNIBUS_CONFIG: |
        external_url '${GITLAB_EXTERNAL_URL}'
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        letsencrypt['enable'] = false
        gitlab_rails['initial_root_password'] = '${GITLAB_ROOT_PASSWORD}'
        gitlab_rails['signup_enabled'] = false
        gitlab_rails['time_zone'] = '${TZ}'
        registry['enable'] = false
        gitlab_pages['enable'] = false
        mattermost['enable'] = false
        prometheus_monitoring['enable'] = false
        alertmanager['enable'] = false
        puma['worker_processes'] = 2
        sidekiq['concurrency'] = 10
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1/-/health >/dev/null || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 20
      start_period: 180s
    volumes:
      - gitlab-config:/etc/gitlab
      - gitlab-logs:/var/log/gitlab
      - gitlab-data:/var/opt/gitlab
    networks:
      apps-net:
      services-egress-net:
        gw_priority: 1

  trilium:
    image: triliumnext/trilium:${TRILIUM_VERSION}
    restart: unless-stopped
    environment:
      <<: *lab-env
      TRILIUM_DATA_DIR: ${TRILIUM_DATA_DIR}
    volumes:
      - trilium-data:${TRILIUM_DATA_DIR}
    networks:
      apps-net:
      services-egress-net:
        gw_priority: 1

  penpot-frontend:
    image: penpotapp/frontend:${PENPOT_VERSION}
    restart: unless-stopped
    environment:
      PENPOT_FLAGS: disable-email-verification enable-prepl-server login-with-password registration
      PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 367001600
      PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE: 367001600
    depends_on:
      - penpot-backend
      - penpot-exporter
    volumes:
      - penpot-assets:/opt/data/assets
    networks:
      penpot-net:
      services-egress-net:
        gw_priority: 1

  penpot-backend:
    image: penpotapp/backend:${PENPOT_VERSION}
    restart: unless-stopped
    environment:
      PENPOT_FLAGS: disable-email-verification enable-prepl-server login-with-password registration
      PENPOT_PUBLIC_URI: https://${LAB_PUBLIC_HOST}:${PENPOT_HTTPS_PORT}
      PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 367001600
      PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE: 367001600
      PENPOT_SECRET_KEY: ${PENPOT_SECRET_KEY}
      PENPOT_DATABASE_URI: postgresql://penpot-postgres/penpot
      PENPOT_DATABASE_USERNAME: penpot
      PENPOT_DATABASE_PASSWORD: ${PENPOT_POSTGRES_PASSWORD}
      PENPOT_REDIS_URI: redis://penpot-valkey/0
      PENPOT_OBJECTS_STORAGE_BACKEND: fs
      PENPOT_OBJECTS_STORAGE_FS_DIRECTORY: /opt/data/assets
      PENPOT_TELEMETRY_ENABLED: "true"
      PENPOT_TELEMETRY_REFERER: atlas-lab
      PENPOT_SMTP_DEFAULT_FROM: no-reply@penpot.local
      PENPOT_SMTP_DEFAULT_REPLY_TO: no-reply@penpot.local
      PENPOT_SMTP_HOST: penpot-mailcatch
      PENPOT_SMTP_PORT: "1025"
      PENPOT_SMTP_TLS: "false"
      PENPOT_SMTP_SSL: "false"
    depends_on:
      penpot-postgres:
        condition: service_healthy
      penpot-valkey:
        condition: service_healthy
    volumes:
      - penpot-assets:/opt/data/assets
    networks:
      penpot-net:
      services-egress-net:
        gw_priority: 1

  penpot-exporter:
    image: penpotapp/exporter:${PENPOT_VERSION}
    restart: unless-stopped
    environment:
      PENPOT_SECRET_KEY: ${PENPOT_SECRET_KEY}
      PENPOT_PUBLIC_URI: http://penpot-frontend:8080
      PENPOT_REDIS_URI: redis://penpot-valkey/0
    depends_on:
      penpot-valkey:
        condition: service_healthy
    networks:
      penpot-net:
      services-egress-net:
        gw_priority: 1

  penpot-postgres:
    image: postgres:15
    restart: unless-stopped
    stop_signal: SIGINT
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U penpot"]
      interval: 5s
      timeout: 10s
      retries: 10
      start_period: 20s
    environment:
      POSTGRES_INITDB_ARGS: --data-checksums
      POSTGRES_DB: penpot
      POSTGRES_USER: penpot
      POSTGRES_PASSWORD: ${PENPOT_POSTGRES_PASSWORD}
    volumes:
      - penpot-postgres:/var/lib/postgresql/data
    networks:
      - penpot-net

  penpot-valkey:
    image: valkey/valkey:8.1
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
      interval: 1s
      timeout: 3s
      retries: 5
      start_period: 3s
    environment:
      VALKEY_EXTRA_FLAGS: --maxmemory 128mb --maxmemory-policy volatile-lfu
    networks:
      - penpot-net

  penpot-mailcatch:
    image: sj26/mailcatcher:latest
    restart: unless-stopped
    expose:
      - "1025"
    networks:
      - penpot-net

networks:
  edge-net:
    name: cli-node-docker-atlas-lab_edge
  services-egress-net:
    name: cli-node-docker-atlas-lab_services_egress
  apps-net:
    name: cli-node-docker-atlas-lab_apps
    internal: true
  penpot-net:
    name: cli-node-docker-atlas-lab_penpot
    internal: true
volumes:
  gateway-certs:
  gateway-config:
  gateway-site:
  gateway-data:
  gitlab-config:
  gitlab-logs:
  gitlab-data:
  trilium-data:
  penpot-assets:
  penpot-postgres: