docker-compose.yml

version: '2.2'


volumes:
  consul-leader:


#define internal docker networks for container connectivity
networks:
  internal:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.16.238.0/24


#define docker containers as services
services:
  #create a DNS service which also forwards lookups to consul DNS
  dnsmasq: &dnsmasq
    image: storytel/dnsmasq
    init: true
    command:
      - /bin/sh
      - -c
      - |
        set -ex
        type curl || (
          until apk update; do sleep 3; done
          until apk add curl bind-tools; do sleep 3; done
        )

        echo '{{range service "consul"}}server=/consul.service.consul/{{.Address}}#8600' >> /tmp/dnsmasq.tpl
        echo '{{end}}' >> /tmp/dnsmasq.tpl
        consul-agent.sh --service '{"service": {"name": "dnsmasq", "tags": [], "port": 53}}' \
          --consul-template-file-cmd /tmp/dnsmasq.tpl dnsmasql.tpl /etc/dnsmasq/consul.conf "consul lock -name=service/dnsmasq -shell=false restart killall dnsmasq"
        # end consul-template template
        set +e
        while true; do
          sleep 1
          CONSUL_IP="`dig +short consul | tail -n1`"
          # add --log-queries for more verbosity
          dnsmasq --no-daemon --server=/consul/"$${CONSUL_IP}"#8600
        done
    volumes:
      - ./consul-template:/usr/local/bin/consul-template
      - ./consul:/usr/local/bin/consul
      - ./jq:/usr/local/bin/jq
      - ./scripts/consul-agent.sh:/bin/consul-agent.sh
    cap_add:
      - NET_ADMIN
    networks:
      internal:
        ipv4_address: 172.16.238.2


  dnsmasq-secondary:
    <<: *dnsmasq
    networks:
      internal:
        ipv4_address: 172.16.238.3


  dns-troubleshoot:
    image: joffotron/docker-net-tools
    init: true
    scale: 0
    networks:
      - internal
    dns:
      - 172.16.238.2
      - 172.16.238.3
    depends_on:
      - dnsmasq


  consul:
    image: 'consul'
    init: true
    command: 'agent -datacenter docker -server -bootstrap-expect 1 -disable-host-node-id -client 0.0.0.0 -ui -data-dir /consul/data'
    healthcheck:
      test: ['CMD', '/bin/sh', '-c', 'curl -sfLo /dev/null http://127.0.0.1:8500/v1/health/node/$$HOSTNAME']
    scale: 1
    networks:
      - internal
    dns:
      - 172.16.238.2
      - 172.16.238.3
    volumes:
      - consul-leader:/consul/data
    depends_on:
      - dnsmasq


  consul-worker:
    image: 'consul'
    init: true
    entrypoint: ''
    command:
      - /bin/sh
      - -c
      - |
        set -ex
        until apk update; do sleep 3; done
        until apk add bind-tools; do sleep 3; done
        until dig +short consul.service.consul; do sleep 1; done
        docker-entrypoint.sh agent -datacenter docker -server -join consul.service.consul -disable-host-node-id -client 0.0.0.0 -ui
    scale: 2
    networks:
      - internal
    dns:
      - 172.16.238.2
      - 172.16.238.3
    depends_on:
      consul:
        condition: service_healthy


  vault:
    image: 'vault'
    init: true
    #exports work around vault bug https://github.com/hashicorp/vault/issues/3866
    #IP is the IP address of the default networking route
    #$$ escapes in "$" in docker-compose string interpolation
    command:
      - "sh"
      - "-c"
      - |
        set -ex
        export IP=$$(ip -o ro get $$(ip ro | awk '$$1 == "default" { print $$3 }') | awk '{print $$5}')
        export VAULT_API_ADDR="http://$${IP}:8200" VAULT_CLUSTER_ADDR="https://$${IP}:8201"
        exec vault server -config=/vault/config
    #set scale: 3 for HA configuration
    scale: 1
    environment:
      VAULT_ADDR: 'http://127.0.0.1:8200'
      VAULT_LOCAL_CONFIG: >-
        {
            "ui": true,
            "backend": {
                "consul": {
                    "address": "consul:8500",
                    "path": "vault",
                    "scheme": "http"
                }
            },
            "default_lease_ttl": "168h",
            "listener": {
                "tcp": {
                    "address": "0.0.0.0:8200",
                    "tls_disable": "1"
                }
            },
            "max_lease_ttl": "720h"
        }
    cap_add:
      - IPC_LOCK
    networks:
      - internal
    dns:
      - 172.16.238.2
      - 172.16.238.3
    depends_on:
      - consul-worker


  portal:
    image: nginx
    init: true
    scale: 1
    networks:
      - internal
    dns:
      - 172.16.238.2
      - 172.16.238.3
    depends_on:
      - consul-worker
    volumes:
      - ./consul-template:/usr/local/bin/consul-template
      - ./templates/nginx.conf:/nginx.conf
      - ./templates/index.html:/index.html
      - ./consul:/usr/local/bin/consul
      - ./jq:/usr/local/bin/jq
      - ./scripts/consul-agent.sh:/bin/consul-agent.sh
    command:
      - /bin/sh
      - -c
      - |
        # this command will automatically register the portal app as a consul service
        set -ex
        type curl || (
          until apt-get update; do sleep 3; done
          until apt-get -y --no-install-recommends install unzip curl ca-certificates procps less vim; do sleep 3; done
        )
        curl -fLo /usr/share/nginx/html/stylesheet.css https://raw.githubusercontent.com/samrocketman/jervis-api/gh-pages/1.6/stylesheet.css
        curl -fLo ~/.vimrc https://raw.githubusercontent.com/samrocketman/home/master/dotfiles/.vimrc
        consul-agent.sh --service '{"service": {"name": "portal", "tags": [], "port": 80}}' \
          --consul-template-file-cmd /nginx.conf nginx.tpl /etc/nginx/conf.d/default.conf "consul lock -name service/portal -shell=false reload nginx -s reload" \
          --consul-template-file /index.html index.html.tpl /usr/share/nginx/html/index.html
        exec nginx -g 'daemon off;'


  socks:
    # socks5 proxy service for browsers to connect into the network
    # https://github.com/serjs/socks5-server
    image: serjs/go-socks5-proxy
    init: true
    ports:
      - "127.0.0.1:1080:1080"
    networks:
      - internal
    dns:
      - 172.16.238.2
      - 172.16.238.3
    depends_on:
      - dnsmasq