name: nebula-stack

x-logging: &logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "3"

x-nebula: &nebula
  restart: unless-stopped
  cap_add:
    - SYS_PTRACE
  logging: *logging

x-es-env: &es-env
  cluster.name: nebula-elasticsearch
  discovery.seed_hosts: ${ES01_IP}:9300,${ES02_IP}:9300,${ES03_IP}:9300
  cluster.initial_master_nodes: es01,es02,es03
  bootstrap.memory_lock: "${ES_MEMORY_LOCK}"
  network.host: "0.0.0.0"
  xpack.security.enabled: "true"
  xpack.security.http.ssl.enabled: "false"
  xpack.security.transport.ssl.enabled: "true"
  xpack.security.transport.ssl.verification_mode: certificate
  xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
  xpack.security.transport.ssl.truststore.path: certs/elastic-stack-ca.p12
  xpack.security.transport.ssl.keystore.password: ${ES_CERT_PASSWORD}
  xpack.security.transport.ssl.truststore.password: ${ES_CERT_PASSWORD}
  ELASTIC_PASSWORD: ${ELASTIC_PASSWORD}
  ES_JAVA_OPTS: ${ES_JAVA_OPTS}
  TAKE_FILE_OWNERSHIP: "true"
  cluster.routing.allocation.disk.threshold_enabled: "${ES_DISK_THRESHOLD}"
  ingest.geoip.downloader.enabled: "false"

x-es-node: &es-node
  image: docker.elastic.co/elasticsearch/elasticsearch:${ES_VERSION}
  user: "0:0"
  restart: unless-stopped
  logging: *logging
  ulimits:
    memlock:
      soft: -1
      hard: -1
    nofile:
      soft: 65536
      hard: 65536
  depends_on:
    es-certs:
      condition: service_completed_successfully
  healthcheck:
    test:
      - CMD-SHELL
      - 'curl -fsS -u "elastic:$$ELASTIC_PASSWORD" http://127.0.0.1:9200/_cluster/health >/dev/null'
    interval: 15s
    timeout: 10s
    retries: 20
    start_period: 90s

services:
  es-certs:
    image: docker.elastic.co/elasticsearch/elasticsearch:${ES_VERSION}
    user: "0:0"
    restart: "no"
    logging: *logging
    environment:
      ES_CERT_PASSWORD: ${ES_CERT_PASSWORD}
      ES01_IP: ${ES01_IP}
      ES02_IP: ${ES02_IP}
      ES03_IP: ${ES03_IP}
    entrypoint: ["bash", "-ec"]
    command:
      - |
        if [ -s /certs/elastic-certificates.p12 ] && [ -s /certs/elastic-stack-ca.p12 ]; then
          exit 0
        fi
        rm -f /certs/elastic-certificates.p12 /certs/elastic-stack-ca.p12
        bin/elasticsearch-certutil ca \
          --silent \
          --out /certs/elastic-stack-ca.p12 \
          --pass "$$ES_CERT_PASSWORD"
        bin/elasticsearch-certutil cert \
          --silent \
          --ca /certs/elastic-stack-ca.p12 \
          --ca-pass "$$ES_CERT_PASSWORD" \
          --pass "$$ES_CERT_PASSWORD" \
          --name nebula-es \
          --dns es01,es02,es03 \
          --ip "$$ES01_IP,$$ES02_IP,$$ES03_IP,127.0.0.1" \
          --out /certs/elastic-certificates.p12
        chown 1000:0 /certs/elastic-certificates.p12 /certs/elastic-stack-ca.p12
        chmod 600 /certs/elastic-certificates.p12 /certs/elastic-stack-ca.p12
    volumes:
      - es_certs:/certs
    networks:
      - backend

  es01:
    <<: *es-node
    hostname: es01
    environment:
      <<: *es-env
      node.name: es01
      network.publish_host: ${ES01_IP}
    ports:
      - "127.0.0.1:9200:9200"
    volumes: &es-volumes
      - esdata01:/usr/share/elasticsearch/data
      - es_certs:/usr/share/elasticsearch/config/certs:ro
    networks:
      backend:
        ipv4_address: ${ES01_IP}

  es02:
    <<: *es-node
    hostname: es02
    environment:
      <<: *es-env
      node.name: es02
      network.publish_host: ${ES02_IP}
    volumes:
      - esdata02:/usr/share/elasticsearch/data
      - es_certs:/usr/share/elasticsearch/config/certs:ro
    networks:
      backend:
        ipv4_address: ${ES02_IP}

  es03:
    <<: *es-node
    hostname: es03
    environment:
      <<: *es-env
      node.name: es03
      network.publish_host: ${ES03_IP}
    volumes:
      - esdata03:/usr/share/elasticsearch/data
      - es_certs:/usr/share/elasticsearch/config/certs:ro
    networks:
      backend:
        ipv4_address: ${ES03_IP}

  metad0:
    <<: *nebula
    image: vesoft/nebula-metad:${NEBULA_VERSION}
    hostname: metad0
    environment:
      USER: root
    command: &meta-cmd
      - --meta_server_addrs=${METAD0_IP}:9559,${METAD1_IP}:9559,${METAD2_IP}:9559
      - --local_ip=${METAD0_IP}
      - --ws_ip=${METAD0_IP}
      - --port=9559
      - --ws_http_port=19559
      - --data_path=/data/meta
      - --logtostderr=true
      - --redirect_stdout=false
    healthcheck: &meta-health
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/${METAD0_IP}/9559'"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s
    volumes:
      - meta0:/data/meta
    networks:
      backend:
        ipv4_address: ${METAD0_IP}

  metad1:
    <<: *nebula
    image: vesoft/nebula-metad:${NEBULA_VERSION}
    hostname: metad1
    environment:
      USER: root
    command:
      - --meta_server_addrs=${METAD0_IP}:9559,${METAD1_IP}:9559,${METAD2_IP}:9559
      - --local_ip=${METAD1_IP}
      - --ws_ip=${METAD1_IP}
      - --port=9559
      - --ws_http_port=19559
      - --data_path=/data/meta
      - --logtostderr=true
      - --redirect_stdout=false
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/${METAD1_IP}/9559'"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s
    volumes:
      - meta1:/data/meta
    networks:
      backend:
        ipv4_address: ${METAD1_IP}

  metad2:
    <<: *nebula
    image: vesoft/nebula-metad:${NEBULA_VERSION}
    hostname: metad2
    environment:
      USER: root
    command:
      - --meta_server_addrs=${METAD0_IP}:9559,${METAD1_IP}:9559,${METAD2_IP}:9559
      - --local_ip=${METAD2_IP}
      - --ws_ip=${METAD2_IP}
      - --port=9559
      - --ws_http_port=19559
      - --data_path=/data/meta
      - --logtostderr=true
      - --redirect_stdout=false
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/${METAD2_IP}/9559'"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s
    volumes:
      - meta2:/data/meta
    networks:
      backend:
        ipv4_address: ${METAD2_IP}

  storaged0:
    <<: *nebula
    image: vesoft/nebula-storaged:${NEBULA_VERSION}
    hostname: storaged0
    environment:
      USER: root
    command: &storage-cmd
      - --meta_server_addrs=${METAD0_IP}:9559,${METAD1_IP}:9559,${METAD2_IP}:9559
      - --local_ip=${STORAGED0_IP}
      - --ws_ip=${STORAGED0_IP}
      - --port=9779
      - --ws_http_port=19779
      - --data_path=/data/storage
      - --logtostderr=true
      - --redirect_stdout=false
    depends_on: &meta-ready
      metad0:
        condition: service_healthy
      metad1:
        condition: service_healthy
      metad2:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/${STORAGED0_IP}/9779'"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s
    volumes:
      - storage0:/data/storage
    networks:
      backend:
        ipv4_address: ${STORAGED0_IP}

  storaged1:
    <<: *nebula
    image: vesoft/nebula-storaged:${NEBULA_VERSION}
    hostname: storaged1
    environment:
      USER: root
    command:
      - --meta_server_addrs=${METAD0_IP}:9559,${METAD1_IP}:9559,${METAD2_IP}:9559
      - --local_ip=${STORAGED1_IP}
      - --ws_ip=${STORAGED1_IP}
      - --port=9779
      - --ws_http_port=19779
      - --data_path=/data/storage
      - --logtostderr=true
      - --redirect_stdout=false
    depends_on: *meta-ready
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/${STORAGED1_IP}/9779'"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s
    volumes:
      - storage1:/data/storage
    networks:
      backend:
        ipv4_address: ${STORAGED1_IP}

  storaged2:
    <<: *nebula
    image: vesoft/nebula-storaged:${NEBULA_VERSION}
    hostname: storaged2
    environment:
      USER: root
    command:
      - --meta_server_addrs=${METAD0_IP}:9559,${METAD1_IP}:9559,${METAD2_IP}:9559
      - --local_ip=${STORAGED2_IP}
      - --ws_ip=${STORAGED2_IP}
      - --port=9779
      - --ws_http_port=19779
      - --data_path=/data/storage
      - --logtostderr=true
      - --redirect_stdout=false
    depends_on: *meta-ready
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/${STORAGED2_IP}/9779'"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s
    volumes:
      - storage2:/data/storage
    networks:
      backend:
        ipv4_address: ${STORAGED2_IP}

  graphd:
    <<: *nebula
    image: vesoft/nebula-graphd:${NEBULA_VERSION}
    hostname: graphd
    environment:
      USER: root
    command:
      - --meta_server_addrs=${METAD0_IP}:9559,${METAD1_IP}:9559,${METAD2_IP}:9559
      - --local_ip=${GRAPHD_IP}
      - --ws_ip=${GRAPHD_IP}
      - --port=9669
      - --ws_http_port=19669
      - --logtostderr=true
      - --redirect_stdout=false
    depends_on: *meta-ready
    ports:
      - "127.0.0.1:9669:9669"
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/${GRAPHD_IP}/9669'"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s
    networks:
      backend:
        ipv4_address: ${GRAPHD_IP}

  storaged-listener:
    image: vesoft/nebula-storaged:${NEBULA_VERSION}
    hostname: storaged-listener
    restart: unless-stopped
    cap_add:
      - SYS_PTRACE
    logging: *logging
    environment:
      USER: root
    entrypoint: ["bash", "-ec"]
    command:
      - |
        mkdir -p /data/listener /logs
        exec /usr/local/nebula/bin/nebula-storaged \
          --daemonize=false \
          --containerized=true \
          --meta_server_addrs=${METAD0_IP}:9559,${METAD1_IP}:9559,${METAD2_IP}:9559 \
          --local_ip=${LISTENER_IP} \
          --ws_ip=${LISTENER_IP} \
          --port=9789 \
          --ws_http_port=19789 \
          --heartbeat_interval_secs=10 \
          --listener_path=/data/listener \
          --data_path=/data \
          --log_dir=/logs \
          --logtostderr=true \
          --redirect_stdout=false
    depends_on: *meta-ready
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/${LISTENER_IP}/9789'"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s
    volumes:
      - listener0:/data
    networks:
      backend:
        ipv4_address: ${LISTENER_IP}

  studio:
    image: vesoft/nebula-graph-studio:${STUDIO_VERSION}
    hostname: studio
    restart: unless-stopped
    logging: *logging
    depends_on:
      - graphd
    ports:
      - "127.0.0.1:7001:7001"
    networks:
      - backend

  console:
    image: vesoft/nebula-console:${NEBULA_VERSION}
    profiles: ["ops"]
    entrypoint: ["nebula-console"]
    command: ["-addr", "graphd", "-port", "9669", "-u", "root", "-p", "nebula"]
    stdin_open: true
    tty: true
    networks:
      - backend

  ops:
    image: vesoft/nebula-console:${NEBULA_VERSION}
    profiles: ["ops"]
    entrypoint: ["sh", "-c"]
    environment:
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD}
      STORAGED0_IP: ${STORAGED0_IP}
      STORAGED1_IP: ${STORAGED1_IP}
      STORAGED2_IP: ${STORAGED2_IP}
      ES01_IP: ${ES01_IP}
      ES02_IP: ${ES02_IP}
      ES03_IP: ${ES03_IP}
      LISTENER_IP: ${LISTENER_IP}
      OPS_COMMAND: verify
    command:
      - |
        sed 's/\r$$//' /scripts/cluster.sh | sh -s "$${OPS_COMMAND:-verify}"
    volumes:
      - ./scripts/cluster.sh:/scripts/cluster.sh:ro
    networks:
      - backend

networks:
  backend:
    name: nebula-stack-net
    driver: bridge
    ipam:
      config:
        - subnet: ${DOCKER_SUBNET}

volumes:
  es_certs:
  esdata01:
  esdata02:
  esdata03:
  meta0:
  meta1:
  meta2:
  storage0:
  storage1:
  storage2:
  listener0: