285 lines
8.6 KiB
YAML
285 lines
8.6 KiB
YAML
services:
|
|
neo4j-certs-perm-fix:
|
|
image: busybox
|
|
command: ["chmod", "-R", "755", "/certs"]
|
|
volumes:
|
|
- ./neo4j-certs:/certs
|
|
networks:
|
|
- medax-network
|
|
|
|
neo4j:
|
|
image: neo4j:5.7
|
|
restart: unless-stopped
|
|
depends_on:
|
|
neo4j-certs-perm-fix:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
- NEO4J_AUTH=${NEO4J_AUTH:-neo4j/password}
|
|
- NEO4J_PLUGINS=["apoc"]
|
|
- NEO4J_server_config_strict__validation_enabled=false
|
|
- NEO4J_apoc_export_file_enabled=true
|
|
- NEO4J_apoc_import_file_enabled=true
|
|
- NEO4J_apoc_import_file_use__neo4j__config=true
|
|
- SHARED_PATH=/neo4j_import
|
|
- NO_PROXY=${NO_PROXY},10.0.0.0/8
|
|
- DISABLE_IMPORT=${DISABLE_IMPORT:-false}
|
|
- ENABLE_BOLT_TLS=${ENABLE_BOLT_TLS:-false}
|
|
|
|
command: >
|
|
bash -c '
|
|
if [ "$${DISABLE_IMPORT:-false}" != "true" ]; then
|
|
echo "running cmd from docker compose" &&
|
|
# Copy plugin files if they exist
|
|
if [ -f /init_files/semspect_neo4j-plugin-8.2.0.jar ]; then
|
|
echo "Copying Semspect plugin..." &&
|
|
cp /init_files/semspect_neo4j-plugin-8.2.0.jar /var/lib/neo4j/plugins/
|
|
fi
|
|
if [ -f /init_files/semspect.lic ]; then
|
|
echo "Copying Semspect license..." &&
|
|
cp /init_files/semspect.lic /var/lib/neo4j/plugins/
|
|
fi
|
|
# Copy neo4j.conf if it exists
|
|
ls
|
|
ls /init_files/
|
|
if [ -f /init_files/neo4j.conf ]; then
|
|
echo "Copying Neo4j configuration..." &&
|
|
cp /init_files/neo4j.conf /var/lib/neo4j/conf/
|
|
fi
|
|
if [ "$${ENABLE_BOLT_TLS:-false}" != "true" ]; then
|
|
echo "ENABLE_BOLT_TLS is not true - disabling required bolt TLS (no certs mounted in ./neo4j-certs locally)." &&
|
|
sed -i \
|
|
-e "s/^server.bolt.tls_level=REQUIRED/#server.bolt.tls_level=REQUIRED/" \
|
|
-e "s/^dbms.ssl.policy.bolt.enabled=true/#dbms.ssl.policy.bolt.enabled=true/" \
|
|
/var/lib/neo4j/conf/neo4j.conf
|
|
fi
|
|
echo "<----------------"
|
|
# Set proper permissions
|
|
#chown -R neo4j:neo4j /var/lib/neo4j/plugins
|
|
#chown -R neo4j:neo4j /var/lib/neo4j/conf
|
|
echo "Import loop is enabled."
|
|
|
|
while true; do
|
|
if [ -f /neo4j_import/ready-to-import ]; then
|
|
echo "Starting import process..."
|
|
neo4j stop &&
|
|
bash /neo4j_import/neo4j-admin-import-call.sh &&
|
|
rm /neo4j_import/ready-to-import &&
|
|
touch /neo4j_import/import-complete &&
|
|
chmod 777 /neo4j_import/import-complete
|
|
neo4j start
|
|
echo "The container is running. CTRL+C will end the bash command and thus, the neo4j container"
|
|
fi
|
|
sleep 10
|
|
done
|
|
else
|
|
echo "Import loop is disabled. Keeping Neo4j container alive..."
|
|
cp /init_files/neo4j.conf /var/lib/neo4j/conf/
|
|
if [ "$${ENABLE_BOLT_TLS:-false}" != "true" ]; then
|
|
echo "ENABLE_BOLT_TLS is not true - disabling required bolt TLS (no certs mounted in ./neo4j-certs locally)." &&
|
|
sed -i \
|
|
-e "s/^server.bolt.tls_level=REQUIRED/#server.bolt.tls_level=REQUIRED/" \
|
|
-e "s/^dbms.ssl.policy.bolt.enabled=true/#dbms.ssl.policy.bolt.enabled=true/" \
|
|
/var/lib/neo4j/conf/neo4j.conf
|
|
fi
|
|
neo4j start
|
|
echo "The container is running. CTRL+C will end the bash command and thus, the neo4j container"
|
|
tail -f /dev/null
|
|
fi
|
|
'
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:7474 || exit 1"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
ports:
|
|
- "8080:7474" # direct access — remove in production
|
|
- "8081:7687" # remove in production
|
|
#- "127.0.0.1:8080:7474" #production
|
|
#- "127.0.0.1:8081:7687"
|
|
|
|
volumes:
|
|
- neo4j_data:/data
|
|
- neo4j_logs:/logs
|
|
- neo4j_import:/neo4j_import
|
|
- ${INPUT_DATA_PATH:-./data}:/input_data
|
|
- ./init_scripts:/init_scripts
|
|
- ./init_files:/init_files
|
|
- ./importData:/importData
|
|
- ./neo4j-certs:/var/lib/neo4j/certificates
|
|
networks:
|
|
- medax-network
|
|
|
|
python_app:
|
|
depends_on:
|
|
loader:
|
|
condition: service_completed_successfully
|
|
required: false
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
HTTP_PROXY: ${HTTP_PROXY}
|
|
HTTPS_PROXY: ${HTTPS_PROXY}
|
|
NO_PROXY: ${NO_PROXY}
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- NEO4J_URI=bolt://neo4j:7687
|
|
- NEO4J_USER=${NEO4J_USER:-neo4j}
|
|
- NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
|
|
- DISABLE_IMPORT=${DISABLE_IMPORT:-false}
|
|
- INPUT_DATA_PATH=/input_data
|
|
- POETRY_VIRTUALENVS_CREATE=false
|
|
- NEO4J_dbms_directories_import=/neo4j_import
|
|
volumes:
|
|
- neo4j_import:/neo4j_import
|
|
- ${INPUT_DATA_PATH:-./data}:/input_data
|
|
- ./importData:/importData # Share the import data directory
|
|
# depends_on:
|
|
# neo4j:
|
|
# condition: service_healthy
|
|
networks:
|
|
- medax-network
|
|
|
|
oauth2-proxy:
|
|
profiles:
|
|
- server
|
|
image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
|
|
container_name: oauth2-proxy
|
|
restart: unless-stopped
|
|
extra_hosts:
|
|
- "keycloak-test.miracum.med.uni-greifswald.de:10.66.82.11"
|
|
- "host.docker.internal:host-gateway"
|
|
|
|
command:
|
|
- --config=/etc/oauth2-proxy.cfg
|
|
ports:
|
|
# - "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./oauth_conf/oauth2-proxy.cfg:/etc/oauth2-proxy.cfg:ro
|
|
- ./oauth_templates:/templates:ro
|
|
- ./oauth-certs:/etc/oauth-certs:ro
|
|
- ./logs:/var/log/oauth2-proxy
|
|
depends_on:
|
|
- neo4j
|
|
|
|
networks:
|
|
- medax-network
|
|
|
|
nginx:
|
|
profiles:
|
|
- server
|
|
image: nginx:latest
|
|
container_name: neo4j-nginx
|
|
|
|
## ports:
|
|
## - "8088:80"
|
|
# - "7687:7687"
|
|
|
|
volumes:
|
|
- ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
|
|
- ./logs:/var/log/nginx
|
|
depends_on:
|
|
- neo4j
|
|
|
|
networks:
|
|
- medax-network
|
|
|
|
neo4j-proxy:
|
|
profiles:
|
|
- proxy
|
|
image: quay.io/oauth2-proxy/oauth2-proxy:latest
|
|
restart: on-failure
|
|
environment:
|
|
OAUTH2_PROXY_PROVIDER: keycloak-oidc
|
|
OAUTH2_PROXY_CLIENT_ID: ${NEO4J_OAUTH_CLIENT_ID:-neo4j-client}
|
|
OAUTH2_PROXY_CLIENT_SECRET: ${NEO4J_OAUTH_SECRET}
|
|
OAUTH2_PROXY_OIDC_ISSUER_URL: ${KEYCLOAK_ISSUER_URL}
|
|
OAUTH2_PROXY_UPSTREAMS: http://neo4j:7474/
|
|
OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180
|
|
OAUTH2_PROXY_REDIRECT_URL: ${NEO4J_PROXY_REDIRECT_URL:-http://localhost:8082/oauth2/callback}
|
|
OAUTH2_PROXY_COOKIE_SECRET: ${NEO4J_COOKIE_SECRET}
|
|
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
|
|
OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
|
|
OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: "true"
|
|
OAUTH2_PROXY_COOKIE_SECURE: "false"
|
|
extra_hosts:
|
|
- "localhost:host-gateway"
|
|
ports:
|
|
- "8082:4180"
|
|
depends_on:
|
|
- neo4j
|
|
#- keycloak # enable if a local keycloak is set up
|
|
|
|
keycloak:
|
|
profiles:
|
|
- keycloak
|
|
image: quay.io/keycloak/keycloak:latest
|
|
command: start-dev
|
|
restart: on-failure
|
|
environment:
|
|
KC_BOOTSTRAP_ADMIN_USERNAME: admin
|
|
KC_BOOTSTRAP_ADMIN_PASSWORD: admin
|
|
KC_HOSTNAME: http://localhost:4040
|
|
KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
|
|
ports:
|
|
- "4040:8080"
|
|
volumes:
|
|
- keycloak_data:/opt/keycloak/data
|
|
|
|
blaze:
|
|
profiles:
|
|
- blaze
|
|
image: samply/blaze:latest
|
|
ports:
|
|
- "8090:8080"
|
|
environment:
|
|
JAVA_TOOL_OPTIONS: "-Xmx2g"
|
|
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
|
volumes:
|
|
- blaze-data:/app/data
|
|
healthcheck:
|
|
test: curl -f http://localhost:8080/fhir/metadata || exit 1
|
|
interval: 5s
|
|
timeout: 10s
|
|
retries: 30
|
|
networks:
|
|
- medax-network
|
|
|
|
|
|
loader:
|
|
profiles:
|
|
- blaze
|
|
image: curlimages/curl:latest
|
|
depends_on:
|
|
blaze:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ./testData/POLAR_mock:/bundles:ro #adapt first part to whereever the testfiles are stored
|
|
entrypoint: /bin/sh
|
|
command: >
|
|
-c '
|
|
for f in /bundles/*.json; do
|
|
echo "Loading $$f ...";
|
|
curl -s -X POST http://blaze:8080/fhir \
|
|
-H "Content-Type: application/fhir+json" \
|
|
-d @"$$f" > /dev/null;
|
|
echo "";
|
|
done;
|
|
echo "Done loading all bundles."
|
|
'
|
|
networks:
|
|
- medax-network
|
|
# Define named volumes
|
|
volumes:
|
|
neo4j_data:
|
|
neo4j_logs:
|
|
neo4j_import:
|
|
keycloak_data:
|
|
blaze-data:
|
|
|
|
networks:
|
|
medax-network:
|
|
driver: bridge
|