forked from opencrvs/opencrvs-countryconfig
-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
6 changed files
with
282 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,6 +10,7 @@ on: | |
| default: 'staging' | ||
| options: | ||
| - staging | ||
| - riku-staging | ||
| - qa | ||
| - development | ||
| core-image-tag: | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,6 +10,7 @@ on: | |
| required: true | ||
| options: | ||
| - development | ||
| - riku-staging | ||
| - staging | ||
| - qa | ||
| - production | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,219 @@ | ||
| version: '3.3' | ||
|
|
||
| # | ||
| # Production deployments of OpenCRVS should never be exposed to the internet. | ||
| # Instead, they should be deployed on a private network and exposed to the internet via a VPN. | ||
| # | ||
| # Before you deploy staging or production environments, make sure the application servers are | ||
| # either in an internal network or protected with a firewall. No ports should be exposed to the internet. | ||
| # | ||
| # The VPN_HOST_ADDRESS environment variable should be set to the IP address where all inbound traffic is coming from. | ||
| # In most cases, this is the VPN server's public IP address. | ||
| # | ||
| # ${VPN_HOST_ADDRESS} | ||
| # | ||
|
|
||
| services: | ||
| gateway: | ||
| environment: | ||
| - NODE_ENV=production | ||
| - LANGUAGES=en,fr | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| workflow: | ||
| environment: | ||
| - NODE_ENV=production | ||
| - LANGUAGES=en,fr | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| search: | ||
| environment: | ||
| - NODE_ENV=production | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| metrics: | ||
| environment: | ||
| - QA_ENV=true | ||
| - NODE_ENV=production | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| - MONGO_URL=mongodb://metrics:${METRICS_MONGODB_PASSWORD}@mongo1/metrics?replicaSet=rs0 | ||
| - HEARTH_MONGO_URL=mongodb://hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/hearth-dev?replicaSet=rs0 | ||
| - DASHBOARD_MONGO_URL=mongodb://performance:${PERFORMANCE_MONGODB_PASSWORD}@mongo1/performance?replicaSet=rs0 | ||
|
|
||
| auth: | ||
| environment: | ||
| - QA_ENV=true | ||
| - NODE_ENV=production | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| user-mgnt: | ||
| environment: | ||
| - QA_ENV=true | ||
| - NODE_ENV=production | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| - MONGO_URL=mongodb://user-mgnt:${USER_MGNT_MONGODB_PASSWORD}@mongo1/user-mgnt?replicaSet=rs0 | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| notification: | ||
| environment: | ||
| - NODE_ENV=production | ||
| - LANGUAGES=en,fr | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| webhooks: | ||
| environment: | ||
| - NODE_ENV=production | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| - MONGO_URL=mongodb://webhooks:${WEBHOOKS_MONGODB_PASSWORD}@mongo1/webhooks?replicaSet=rs0 | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| config: | ||
| environment: | ||
| - NODE_ENV=production | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| - MONGO_URL=mongodb://config:${CONFIG_MONGODB_PASSWORD}@mongo1/application-config?replicaSet=rs0 | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| scheduler: | ||
| environment: | ||
| - NODE_ENV=production | ||
| - OPENHIM_MONGO_URL=mongodb://openhim:${OPENHIM_MONGODB_PASSWORD}@mongo1/openhim-dev?replicaSet=rs0 | ||
|
|
||
| documents: | ||
| environment: | ||
| - NODE_ENV=production | ||
|
|
||
| countryconfig: | ||
| image: ${DOCKERHUB_ACCOUNT}/${DOCKERHUB_REPO}:${COUNTRY_CONFIG_VERSION} | ||
| restart: unless-stopped | ||
| secrets: | ||
| - jwt-public-key.{{ts}} | ||
| environment: | ||
| - NODE_ENV=production | ||
| - FHIR_URL=http://hearth:3447/fhir | ||
| - AUTH_URL=http://auth:4040 | ||
| - APPLICATION_CONFIG_URL=http://config:2021 | ||
| - OPENHIM_URL=http://openhim-core:5001/fhir | ||
| - CONFIRM_REGISTRATION_URL=http://openhim-core:5001/confirm/registration | ||
| - CHECK_INVALID_TOKEN=true | ||
| - SENTRY_DSN=${SENTRY_DSN} | ||
| - SENDER_EMAIL_ADDRESS=${SENDER_EMAIL_ADDRESS} | ||
| - ALERT_EMAIL=${ALERT_EMAIL} | ||
| - SMTP_HOST=${SMTP_HOST} | ||
| - SMTP_PORT=${SMTP_PORT} | ||
| - SMTP_USERNAME=${SMTP_USERNAME} | ||
| - SMTP_PASSWORD=${SMTP_PASSWORD} | ||
| - SMTP_SECURE=${SMTP_SECURE} | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| client: | ||
| environment: | ||
| - DECLARED_DECLARATION_SEARCH_QUERY_COUNT=100 | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| logstash: | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| apm-server: | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| components: | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| login: | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| hearth: | ||
| environment: | ||
| - mongodb__url=mongodb://hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/hearth-dev?replicaSet=rs0 | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| migration: | ||
| environment: | ||
| - USER_MGNT_MONGO_URL=mongodb://user-mgnt:${USER_MGNT_MONGODB_PASSWORD}@mongo1/user-mgnt?replicaSet=rs0 | ||
| - APPLICATION_CONFIG_MONGO_URL=mongodb://config:${CONFIG_MONGODB_PASSWORD}@mongo1/application-config?replicaSet=rs0 | ||
| - PERFORMANCE_MONGO_URL=mongodb://performance:${PERFORMANCE_MONGODB_PASSWORD}@mongo1/performance?replicaSet=rs0 | ||
| - HEARTH_MONGO_URL=mongodb://hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/hearth-dev?replicaSet=rs0 | ||
| - OPENHIM_MONGO_URL=mongodb://openhim:${OPENHIM_MONGODB_PASSWORD}@mongo1/openhim-dev?replicaSet=rs0 | ||
| - WAIT_HOSTS=mongo1:27017,influxdb:8086,minio:9000,elasticsearch:9200 | ||
|
|
||
| openhim-core: | ||
| environment: | ||
| - mongo_url=mongodb://openhim:${OPENHIM_MONGODB_PASSWORD}@mongo1/openhim-dev?replicaSet=rs0 | ||
| - mongo_atnaUrl=mongodb://openhim:${OPENHIM_MONGODB_PASSWORD}@mongo1/openhim-dev?replicaSet=rs0 | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| openhim-console: | ||
| deploy: | ||
| replicas: 1 | ||
|
|
||
| mongo-on-update: | ||
| environment: | ||
| - REPLICAS=1 | ||
|
|
||
| traefik: | ||
| # These templates use an Automatic Certificate Management Environment (Let's Encrypt). | ||
| # This makes sure that the HTTPS certificates are automatically generated and renewed without manual maintenance. | ||
| # | ||
| # For your country to do this, your domain's DNS provider must be one of the ones listed here | ||
| # https://doc.traefik.io/traefik/https/acme/#providers | ||
| # | ||
| # If your DNS provider is not listed, you can use manually renewed certificate files instead of Let's Encrypt. | ||
| # To do this, remove the `environment` and `certificatesresolvers.certResolver.acme` sections and uncomment the following lines. | ||
| # You will also need to place your certificates in the `/data/traefik/certs` directory. | ||
| # Ensure that the file names match the ones defined below. | ||
| # | ||
| # volumes: | ||
| # - /var/run/docker.sock:/var/run/docker.sock | ||
| # - /data/traefik/certs:/certs | ||
| # command: | ||
| # - --tls.certificates.certfile=/certs/crvs.cm.crt | ||
| # - --tls.certificates.keyfile=/certs/crvs.cm.key | ||
| # - --tls.certificates.stores=default | ||
| # - --tls.stores.default.defaultcertificate.certfile=/certs/crvs.cm.crt | ||
| # - --tls.stores.default.defaultcertificate.keyfile=/certs/crvs.cm.key | ||
|
|
||
| environment: | ||
| - GOOGLE_DOMAINS_ACCESS_TOKEN=${GOOGLE_DOMAINS_ACCESS_TOKEN} | ||
| command: | ||
| - --certificatesresolvers.certResolver.acme.dnschallenge=true | ||
| - --certificatesresolvers.certResolver.acme.dnschallenge.provider=googledomains | ||
| - --certificatesresolvers.certResolver.acme.email=riku@opencrvs.org | ||
| - --certificatesresolvers.certResolver.acme.storage=acme.json | ||
|
|
||
| - --entrypoints.web.address=:80 | ||
| - --entrypoints.websecure.address=:443 | ||
| - --providers.docker | ||
| - --providers.docker.swarmMode=true | ||
| - --api.dashboard=true | ||
| - --api.insecure=true | ||
| - --log.level=WARNING | ||
| - --entrypoints.web.http.redirections.entryPoint.to=websecure | ||
| - --entrypoints.web.http.redirections.entryPoint.scheme=https | ||
| - --entrypoints.web.http.redirections.entrypoint.permanent=true | ||
| - --serverstransport.insecureskipverify=true | ||
| - --entrypoints.websecure.address=:443 | ||
| - --accesslog=true | ||
| - --accesslog.format=json | ||
| - --ping=true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| # This Source Code Form is subject to the terms of the Mozilla Public | ||
| # License, v. 2.0. If a copy of the MPL was not distributed with this | ||
| # file, You can obtain one at https://mozilla.org/MPL/2.0/. | ||
| # | ||
| # OpenCRVS is also distributed under the terms of the Civil Registration | ||
| # & Healthcare Disclaimer located at http://opencrvs.org/license. | ||
| # | ||
| # Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS. | ||
| all: | ||
| vars: | ||
| # This configuration variable blocks all access to the server, including SSH, except from the IP addresses specified below. | ||
| # This should always be set when configuring a production server if there is no other firewall in front of the server. | ||
| # SSH and other services should never be exposed to the public internet. | ||
| only_allow_access_from_addresses: | ||
| - 165.22.110.53 | ||
| enable_backups: false | ||
| periodic_restore_from_backup: true | ||
| # external_backup_server_ssh_port: Defined in --extra-vars by the provisioning pipeline | ||
| # external_backup_server_ip: Defined in --extra-vars by the provisioning pipeline | ||
| users: | ||
| # If you need to remove access from someone, do not remove them from this list, but instead set their state: absent | ||
| - name: riku | ||
| ssh_keys: | ||
| - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWIF63S4f3z9wQMvWibmvl7MPuJ6EVrkP0HuvgNhcs/4DZYMcR/GRBvV4ldOSYMlBevIXycgGzNDxKJgENUuwIWanjBu7uVAHyD6+cIRD1h63qq7Cjv/2HYTfBDKOrKzPOhA6zWvKO0ZGWsjRXk5LWMCbKOkvKJCxOpj/NVBxeE4FTK5YADYPV3OSsmBtqTHrVLm2sMmShU/2hMYYswWkobidjX65+nK/X+3C+yJbHwiydVvn+QCrFlFfCLPWKe8rUpOxyxofPqWVQh6CHhHfT8okaOc9sOE8Qeip9ljo84DftJh3Xm3ynOdWK1hH2BvRvxNadWqcE1qECbkg4tx2x riku.rouvila@gmail.com | ||
| state: present | ||
| sudoer: true | ||
| - name: euan | ||
| ssh_keys: | ||
| - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDECqHO65UpyrrO8uueD06RxGaVVq22f152Rf8qVQQAAIGAMu6gCs7ztlZ8a3yQgSEIjM/Jl1/RqIVs6CziTEef74nLFTZ5Ufz3CLRVgdebBeSBEmhTfTUV0HLkSyNzwKFpuzJxucGd72ulPvEp6eHvyJAPJz37YcU8cjaL1v05T6s2ee99li35GlDDtCzfjVV4ZPAg5JdfWuTj41RAVC0LQhk2/NB4qEu37UxGGjhRFSjBEsS5LxI9QfvgrsHpl/VOn+soH7ZkK7kS6qRgNP/uYsXRWXhHaamcl5OX68gJWTbrW6c7PCqlbCWGnsHJswCmqPIthwXXMfC7ULDNLSKG6mslAt5Dyc8/MCr3vTW7pDyr2d0FvvY86SMQUggxv3qF7TZewqfX1bhK0fMLarIxVMQ1RFo//wN9QGA+2we8rxd2Y1Kr1DBuJyuwXPfv+Exo8yNYQ+x/AYH5k6UVcSYuaB8eYmplG2KQCxt8RBFtoChrwOKNRWLqXdKyfpdp5XmnnWxPvR95gf3h3yLocVYkF0i0uvKKJ0vt8J0Ezfkdfow0B1kUg5bPXKJROX7PwbaCPdYcxyDaO6wwOigRnSmoFvkH1pLb4j1RQAXcX531CHgfN6Izi/h0mpMS4bnyIUcv2GQr+h4z4TxcCtj7qpH2y6yw7XG12jVh7TfeesXG2Q== euanmillar77@gmail.com | ||
| state: present | ||
| sudoer: true | ||
| - name: tameem | ||
| ssh_keys: | ||
| - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUprcQyUFYwRto0aRpgriR95C1pgNxrQ0lEWEe1D8he haidertameem@gmail.com | ||
| state: present | ||
| sudoer: true | ||
| - name: ashikul | ||
| ssh_keys: | ||
| - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFr/v3hUGEbc2wQsDLCmqLrwiz964yVrnLZ6kafemjmX8aRGLp1CNFvrZ674SLnXidZGMkx9d5xVvv8IdFR3R50MqSqfolF43MV34/JVHjQHh9Vk4MJT/3GIaeNmr2GQ/38qAmt2BQn1ecnb7FjNO2bFvHokLhm2wCXt+A4avuTgJe0p4e6uu01IHeIzDb5sPzZ3ID0h6jJnjEDcET+Lf5NGpCjn7YKhLhBWSSl9cXQdOGLzNzg3aBk32kgJ1beP1funSeVd0jniJPZeZRC1G/kRdqBUOHKiENtwgquzZxXzdHkZV9+4mF7YGlx6LpQdNuDpW7JADtYNldtdbexdyfrgNoRzKwyMmaKNDbeHd1FsIHSDJmGm9hCoLTM2dEtsGzgghfe0tat8sOWmsj5v2en0V8rKV+w8OQEmHtaQkgMjqmZaAnd8uWiB2xIbrUuax5Pq8zkj37xnfbRxUPOEkMlOUbhh1wzGbqeUEB7nbv/vXZxwC0b7ryMk5egBP+0ZRONsdib9RkSTr3B9uSb7iTOQftdhy+CTqqOq+6s+TyC2qnu12B1WZb9sx9jQl0mBHd9gx/FgYDs8jfIr2vF4jRkejW/moaVqvCd/FLyS91eCMXQjIXdGKWKPUUL7GEBqdZRLnYSJOqgPp9sk1+NEvMabTXlWmoUjaShq8z+o7JsQ== nileeeem36@gmail.com | ||
| state: present | ||
| sudoer: true | ||
| docker-manager-first: | ||
| hosts: | ||
| riku-staging: | ||
| ansible_host: '164.90.208.204' | ||
| data_label: data1 | ||
| ansible_ssh_common_args: '-J jump@165.22.110.53 -o StrictHostKeyChecking=no' | ||
|
|
||
| # QA and staging servers are not configured to use workers. | ||
| docker-workers: {} | ||
| backups: | ||
| hosts: | ||
| farajaland-qa: | ||
| ansible_host: '165.22.110.53' |