version: "3.9"

services:

  vpn: # Creates a connection behind the ETH Firewall to access NAS and Postgres
    image: wazum/openconnect-proxy:latest
    env_file:
      - ${CONTAINER_DATA}/config/vpn.config
    cap_add:
    - NET_ADMIN
    volumes:
      - /dev/net/tun:/dev/net/tun
    # alternative to cap_add & volumes: specify privileged: true
    expose: ["5432"] # exposed here because db_passhtrough uses this network. See below for more details
    

  nas_sync: # Syncs locally downloaded files with the NAS-share on nas22.ethz.ch/...
    depends_on:
      - vpn
    network_mode: "service:vpn" # used to establish a connection to the SMB server from inside ETH network
    build: nas_sync # local folder to build
    image: nas_sync:latest
    cap_add: # capabilities needed for mounting the SMB share
      - SYS_ADMIN
      - DAC_READ_SEARCH
    volumes:
      - ${CONTAINER_DATA}/files:/sync/local_files
      - ${CONTAINER_DATA}/config/nas_sync.config:/sync/nas_sync.config
      - ${CONTAINER_DATA}/config/nas_login.config:/sync/nas_login.config
    command: 
      - nas22.ethz.ch/gess_coss_1/helbing_support/Files RM/Archiving/TEST # first command is the target mount path
      - lsyncd
      - /sync/nas_sync.config


  geckodriver: # separate docker container for pdf-download. This hugely improves stability (and creates shorter build times for the containers)
    image: ${GECKODRIVER_IMG}
    shm_size: 2gb
    environment:
      - START_VNC=${HEADFULL-false} # as opposed to headless, used when requiring supervision (eg. for websites that crash)
      - START_XVFB=${HEADFULL-false}
      - SE_VNC_NO_PASSWORD=1
    expose: ["4444"] # exposed to other docker-compose services only
    ports:
      - 7900:7900 # port for webvnc


  db_passthrough: # Allows a container on the local network to connect to a service (here postgres) through the vpn
    network_mode: "service:vpn"
    image: alpine/socat:latest
    command: ["tcp-listen:5432,reuseaddr,fork", "tcp-connect:id-hdb-psgr-cp48.ethz.ch:5432"]
    # expose: ["5432"] We would want this passthrough to expose its ports to the other containers
    # BUT since it uses the same network as the vpn-service, it can't expose ports on its own. 5432 is therefore exposed under service.vpn.expose 


  news_fetch: # Orchestration of the automatic download. It generates pdfs (via the geckodriver container), fetches descriptions, triggers a snaphsot (on archive.org) and writes to a db
    build: news_fetch
    image: news_fetch:latest

    depends_on: # when using docker compose run news_fetch, the dependencies are started as well
      - nas_sync
      - geckodriver
      - db_passthrough

    volumes:
      - ${CONTAINER_DATA}:/app/containerdata # always set
      - ${CODE:-/dev/null}:/code # not set in prod, defaults to /dev/null
    environment:
      - DEBUG=${DEBUG}
      - UNAME=${UNAME}
    entrypoint: ${ENTRYPOINT:-python runner.py} # by default launch workers as defined in the Dockerfile
    # stdin_open: ${INTERACTIVE:-false} # docker run -i
    # tty: ${INTERACTIVE:-false}        # docker run -t


  news_check: # Creates a small webapp on http://localhost:8080 to check previously generated pdfs (some of which are unusable and must be marked as such)
    build: news_check
    image: news_check:latest
    user: 1000:1000 # since the app writes files to the local filesystem, it must be run as the current user
    depends_on:
      - db_passthrough
    volumes:
      - ${CONTAINER_DATA}:/app/containerdata # always set
      - ${CODE:-/dev/null}:/code # not set in prod, defaults to /dev/null
    environment:
      - UNAME=${UNAME}
    ports:
      - "8080:80" # 80 inside container
    entrypoint: ${ENTRYPOINT:-python app.py} # by default launch workers as defined in the Dockerfile
    tty: true