Package spot for production

*/*/*/*~

*/*/*/*/*~

# Git

.git

.gitignore

# CI

.codeclimate.yml

.travis.yml

SPOT_HOSTNAME=localhost

SPOT_DOCKER_IMG=registry.gitlab.e.foundation:5000/e/cloud/my-spot

SPOT_DOCKER_TAG=latest

SPOT_NGINX_DOCKER_IMG=registry.gitlab.e.foundation:5000/e/cloud/my-spot/nginx

SPOT_NGINX_DOCKER_TAG=latest

FROM alpine:3.10

ENTRYPOINT ["/sbin/tini","--","/usr/local/searx/dockerfiles/docker-entrypoint.sh"]

EXPOSE 8080

VOLUME /etc/searx

VOLUME /var/log/uwsgi

FROM registry.gitlab.e.foundation:5000/e/cloud/my-spot/env as builder

ARG VERSION_GITCOMMIT=unknown

ARG SEARX_GIT_VERSION=unknown

COPY . /src/

RUN pip install --force-reinstall --prefix /install /src

ARG SEARX_GID=977

ARG SEARX_UID=977

RUN addgroup -g ${SEARX_GID} searx && \

    adduser -u ${SEARX_UID} -D -h /usr/local/searx -s /bin/sh -G searx searx

FROM python:3.8-alpine

LABEL maintainer="spot <https://gitlab.e.foundation/e/cloud/my-spot/>"

LABEL description="A privacy-respecting, hackable metasearch engine."

ARG TIMESTAMP_SETTINGS=0

ARG TIMESTAMP_UWSGI=0

ARG LABEL_VCS_REF=

ARG LABEL_VCS_URL=

RUN apk add ca-certificates libxslt py3-gunicorn

ENV INSTANCE_NAME=searx \

    AUTOCOMPLETE= \

    BASE_URL= \

    MORTY_KEY= \

    MORTY_URL=

COPY --from=builder /install/ /usr/local/

WORKDIR /usr/local/searx

EXPOSE 80

STOPSIGNAL SIGINT

COPY requirements.txt ./requirements.txt

RUN apk upgrade --no-cache \

 && apk add --no-cache -t build-dependencies \

    build-base \

    py3-setuptools \

    python3-dev \

    libffi-dev \

    libxslt-dev \

    libxml2-dev \

    openssl-dev \

    tar \

    git \

 && apk add --no-cache \

    ca-certificates \

    su-exec \

    python3 \

    libxml2 \

    libxslt \

    openssl \

    tini \

    uwsgi \

    uwsgi-python3 \

 && pip3 install --upgrade pip \

 && pip3 install --no-cache -r requirements.txt \

 && apk del build-dependencies

COPY --chown=searx:searx . .

RUN su searx -c "/usr/bin/python3 -m compileall -q searx"; \

    touch -c --date=@${TIMESTAMP_SETTINGS} searx/settings.yml; \

    touch -c --date=@${TIMESTAMP_UWSGI} dockerfiles/uwsgi.ini; \

    if [ ! -z $VERSION_GITCOMMIT ]; then\

      echo "VERSION_STRING = VERSION_STRING + \"-$VERSION_GITCOMMIT\"" >> /usr/local/searx/searx/version.py; \

    fi

# Keep this argument at the end since it change each time

ARG LABEL_DATE=

LABEL maintainer="searx <https://github.com/asciimoo/searx>" \

      description="A privacy-respecting, hackable metasearch engine." \

      version="${SEARX_GIT_VERSION}" \

      org.label-schema.schema-version="1.0" \

      org.label-schema.name="searx" \

      org.label-schema.version="${SEARX_GIT_VERSION}" \

      org.label-schema.url="${LABEL_VCS_URL}" \

      org.label-schema.vcs-ref=${LABEL_VCS_REF} \

      org.label-schema.vcs-url=${LABEL_VCS_URL} \

      org.label-schema.build-date="${LABEL_DATE}" \

      org.label-schema.usage="https://github.com/searx/searx-docker"

ENV PYTHONPATH="/usr/local/lib/python3.8/site-packages"

CMD ["gunicorn", "-w", "1", "-b", "0.0.0.0:80", "searx.webapp:app"]

version: '3.6'

services:

  spot:

    image: ${SPOT_DOCKER_IMG}:${SPOT_DOCKER_TAG}

  nginx:

    image: ${SPOT_NGINX_DOCKER_IMG}:${SPOT_NGINX_DOCKER_TAG}

version: '3.6'

x-logging:

  &default-logging

  options:

    max-size: '1g'

    max-file: '5'

  driver: json-file

services:

  spot:

    build: .

    logging: *default-logging

    restart: unless-stopped

    environment:

      SEARX_SECRET: ":@)%NN0+OqNdy:{prWQlZ{p9|oO9p-UyJq@%V!~G:arrSx6fXz.{jd%=XF44ncj"

      GUNICORN_LOGGER: 1

      GUNICORN_LEVEL: INFO

  nginx:

    build:

      context: .

      dockerfile: nginx.Dockerfile

    logging: *default-logging

    restart: unless-stopped

    labels:

      - "traefik.enable=true"

      - "traefik.http.routers.spot.rule=Host(`${SPOT_HOSTNAME}`)"

      - "traefik.http.routers.spot.entrypoints=websecure"

      - "traefik.http.routers.spot.tls.certresolver=spotchallenge"

      - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"

      - "traefik.http.routers.http-catchall.entrypoints=web"

      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https@docker"

      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

      - "traefik.http.middlewares.spot-ratelimit.ratelimit.average=50"

      - "traefik.http.middlewares.spot-ratelimit.ratelimit.burst=20"

  traefik:

    image: "traefik:v2.1.2"

    logging: *default-logging

    restart: unless-stopped

    command:

      - "--providers.docker=true"

      - "--providers.docker.exposedbydefault=false"

      - "--entrypoints.web.address=:80"

      - "--entrypoints.websecure.address=:443"

      - "--certificatesresolvers.spotchallenge.acme.tlschallenge=true"

      - "--certificatesresolvers.spotchallenge.acme.email=contact@e.email"

      - "--certificatesresolvers.spotchallenge.acme.storage=/letsencrypt/acme.json"

    ports:

      - "80:80"

      - "443:443"

    volumes:

      - "letsencrypt:/letsencrypt"

      - "/var/run/docker.sock:/var/run/docker.sock:ro"

volumes:

  letsencrypt: