docker-compose.yml

version: '2'
services:
  web:
    image: registry.spin.nersc.gov/stefanl/stefanl-nginx-proxy:v1
    volumes:
    - /global/project/projectdirs/isguser/spin/fruitfly/web/images:/srv:ro
    ports:
    - 55100:8080
    cap_drop:
    - ALL
    user: 46311:71216
    group_add:
    - nginx
    labels:
      io.rancher.container.pull_image: always
    retain_ip: true

  app:
    image: registry.spin.nersc.gov/stefanl/stefanl-flask-fruitfly:v2
    environment:
      MONGO_INITDB_ROOT_USERNAME: mongouser
      MONGO_INITDB_ROOT_PASSWORD_FILE: /run/secrets/mongo-initdb-password
    secrets:
    - source: db.fruitfly-demo.mongo-initdb-password
      target: mongo-initdb-password
      mode: '0444'
      uid: '0'
      gid: '0'
#    - source: app.fruitfly-demo.ssh_private_key
#      target: ssh_private_key
#      mode: '0400'
#      uid: '46311'
#      gid: '71216'
    labels:
      io.rancher.container.pull_image: always
    retain_ip: true
  db:
    image: mongo:4
    environment:
      MONGO_INITDB_ROOT_USERNAME: mongouser
      MONGO_INITDB_ROOT_PASSWORD_FILE: /run/secrets/mongo-initdb-password
    volumes:
    - db.fruitfly-demo:/data/db
    cap_drop:
    - ALL
    cap_add:
    - CHOWN
    - SETGID
    - SETUID
    - DAC_OVERRIDE
    secrets:
    - source: db.fruitfly-demo.mongo-initdb-password
      target: mongo-initdb-password
      mode: '0444'
      uid: '0'
      gid: '0'
    labels:
      io.rancher.container.pull_image: always

secrets:
  db.fruitfly-demo.mongo-initdb-password:
    file: mongo-initdb-password

#secrets:
#  app.fruitfly-demo.ssh_private_key:
#    external: 'true'

volumes:
  db.fruitfly-demo:
    driver: rancher-nfs
    external: true