docker-compose.yml

secrets:
  owner_cert_password:
    file: ./secrets/owner_cert_password.txt
  secretary_cert_password:
    file: ./secrets/secretary_cert_password.txt
  client_truststore_password:
    file: ./secrets/client_truststore_password.txt
  # google_client_id:
  #   file: ./secrets/google/client_id.txt
  # google_client_secret:
  #   file: ./secrets/google/client_secret.txt
  # orcid_client_id:
  #   file: ./secrets/orcid/client_id.txt
  # orcid_client_secret:
  #   file: ./secrets/orcid/client_secret.txt
  # credentials:
  #   file: ./secrets/credentials.trig
volumes:
  varnish_frontend_cache:
services:
  nginx:
    image: nginx:1.23.3
    mem_limit: 128m
    configs:
      - source: nginx_conf
        target: /etc/nginx/nginx.conf
    depends_on:
      linkeddatahub:
        condition: service_healthy
    ports:
      - ${HTTP_PORT}:8080 # allow Tomcat to do HTTP to HTTPS redirect
      - ${HTTPS_PORT}:8443 # HTTPS
      - ${HTTPS_CLIENT_CERT_PORT:-5443}:9443 # HTTPS client cert
    volumes:
      - ./ssl/server:/etc/nginx/ssl:ro
  linkeddatahub:
    user: root # otherwise the ldh user does not have permissions to the mounted folder which is owner by root
    build: .
    mem_limit: 2048m
    depends_on:
      - fuseki-admin
      - fuseki-end-user
    environment:
    #  - JPDA_ADDRESS=*:8000 # debugger host - performance hit when enabled
      - CATALINA_OPTS=-XX:+UseContainerSupport -XX:MaxRAMPercentage=75 --add-exports java.base/sun.security.tools.keytool=ALL-UNNAMED # heap will use up to 75% of container's RAM
      - TZ="Europe/Copenhagen"
      #- CATALINA_OPTS="-Duser.timezone=Europe/Copenhagen"
      - PROXY_HOST=nginx
      - PROXY_PORT=9443
      - FRONTEND_PROXY=http://varnish-frontend:6060/
      - BACKEND_PROXY_ADMIN=http://varnish-admin/
      - BACKEND_PROXY_END_USER=http://varnish-end-user/
      - PROTOCOL=${PROTOCOL}
      - HOST=${HOST}
      - ABS_PATH=${ABS_PATH}
      - HTTP_SCHEME=https
      - HTTP_PORT=7070
      - HTTP_PROXY_NAME=${HOST}
      - HTTP_PROXY_PORT=${HTTPS_PORT}
      - HTTP_REDIRECT_PORT=${HTTPS_PORT}
      - HTTPS_PROXY_PORT=${HTTPS_PORT}
      - HTTPS=false
      - SELF_SIGNED_CERT=true # only on localhost
      - SIGN_UP_CERT_VALIDITY=180
      - MAX_CONTENT_LENGTH=${MAX_CONTENT_LENGTH:-2097152}
      - ALLOW_INTERNAL_URLS=${ALLOW_INTERNAL_URLS:-}
      - NOTIFICATION_ADDRESS=LinkedDataHub <notifications@localhost>
      - MAIL_SMTP_HOST=email-server
      - MAIL_SMTP_PORT=25
      - MAIL_USER=linkeddatahub@localhost
      - REMOTE_IP_VALVE=true
      - REMOTE_IP_VALVE_PROTOCOL_HEADER=X-Forwarded-Proto
      - REMOTE_IP_VALVE_PORT_HEADER=X-Forwarded-Port
      - REMOTE_IP_VALVE_REMOTE_IP_HEADER=X-Forwarded-For
      - REMOTE_IP_VALVE_HOST_HEADER=X-Forwarded-Host
      - OWNER_MBOX=${OWNER_MBOX}
      #- OWNER_URI=${OWNER_URI}
      - OWNER_GIVEN_NAME=${OWNER_GIVEN_NAME}
      - OWNER_FAMILY_NAME=${OWNER_FAMILY_NAME}
      - OWNER_ORG_UNIT=${OWNER_ORG_UNIT}
      - OWNER_ORGANIZATION=${OWNER_ORGANIZATION}
      - OWNER_LOCALITY=${OWNER_LOCALITY}
      - OWNER_STATE_OR_PROVINCE=${OWNER_STATE_OR_PROVINCE}
      - OWNER_COUNTRY_NAME=${OWNER_COUNTRY_NAME}
    secrets:
      - owner_cert_password
      - secretary_cert_password
      - client_truststore_password
      # - google_client_id
      # - google_client_secret
      # - orcid_client_id
      # - orcid_client_secret
      # - credentials
    volumes:
      - /var/linkeddatahub/oidc
      - ./ssl/server:/var/linkeddatahub/ssl/server:ro
      - ./ssl/owner:/var/linkeddatahub/ssl/owner
      - ./ssl/secretary:/var/linkeddatahub/ssl/secretary
      - ./datasets/owner:/var/linkeddatahub/datasets/owner
      - ./datasets/secretary:/var/linkeddatahub/datasets/secretary
      - ./uploads:/var/www/linkeddatahub/uploads
      - ./config/dev.log4j.properties:/usr/local/tomcat/webapps/ROOT/WEB-INF/classes/log4j.properties:ro
      - ./config/dataspaces.trig:/var/linkeddatahub/datasets/dataspaces.trig
      - ./config/system.trig:/var/linkeddatahub/datasets/system.trig
  fuseki-admin:
    image: atomgraph/fuseki:4.7.0
    user: root # otherwise fuseki user does not have permissions to the mounted folder which is owner by root
    expose:
      - 3030
    volumes:
      - ./config/fuseki/config.ttl:/fuseki/config.ttl:ro
      - ./fuseki/admin:/fuseki/databases
    command: [ "--config", "/fuseki/config.ttl" ]
  fuseki-end-user:
    image: atomgraph/fuseki:4.7.0
    user: root # otherwise the fuseki user does not have permissions to the mounted folder which is owner by root
    expose:
      - 3030
    volumes:
      - ./config/fuseki/config.ttl:/fuseki/config.ttl:ro
      - ./fuseki/end-user:/fuseki/databases
    command: [ "--config", "/fuseki/config.ttl" ]
  varnish-frontend:
    image: varnish:7.3.0
    user: root # otherwise varnish user does not have permissions to the mounted folder which is owner by root
    configs:
      - source: varnish-frontend_vcl
        target: /etc/varnish/default.vcl
    depends_on:
      - linkeddatahub
    tmpfs: /var/lib/varnish/varnishd:exec
    volumes:
      - varnish_frontend_cache:/var/lib/varnish
    entrypoint: varnishd
    command: [ "-F", "-f", "/etc/varnish/default.vcl", "-a", "http=:6060,HTTP", "-a", "proxy=:8443,PROXY", "-p", "feature=+http2", "-s", "file,/var/lib/varnish/storage.bin,3G", "-t", "86400" ] # -F: foreground, -f: config, -a: listeners, -p: http2, -s: storage, -t: TTL
  varnish-admin:
    image: varnish:7.3.0
    user: root # otherwise the varnish user does not have permissions to the mounted folder which is owner by root
    configs:
      - source: varnish-admin_vcl
        target: /etc/varnish/default.vcl
    depends_on:
      - linkeddatahub
    tmpfs: /var/lib/varnish/varnishd:exec
    entrypoint: varnishd
    command: [ "-F", "-f", "/etc/varnish/default.vcl", "-a", "http=:80,HTTP", "-a", "proxy=:8443,PROXY", "-p", "feature=+http2", "-s", "malloc,1G", "-t", "86400", "-p", "timeout_idle=60s" ] # -F: foreground, -f: config, -a: listeners, -p: http2 + idle timeout, -s: storage, -t: TTL
  varnish-end-user:
    image: varnish:7.3.0
    user: root # otherwise varnish user does not have permissions to the mounted folder which is owner by root
    configs:
      - source: varnish-end-user_vcl
        target: /etc/varnish/default.vcl
    depends_on:
      - linkeddatahub
    tmpfs: /var/lib/varnish/varnishd:exec
    entrypoint: varnishd
    command: [ "-F", "-f", "/etc/varnish/default.vcl", "-a", "http=:80,HTTP", "-a", "proxy=:8443,PROXY", "-p", "feature=+http2", "-s", "malloc,1G", "-t", "86400", "-p", "timeout_idle=60s" ] # -F: foreground, -f: config, -a: listeners, -p: http2 + idle timeout, -s: storage, -t: TTL
  email-server:
    image: namshi/smtp
    environment:
      - DISABLE_IPV6=true
configs:
  nginx_conf:
    content: |
      pid /tmp/nginx.pid;

      events { 
          worker_connections 1024;
      }

      http {
          upstream linkeddatahub {
              server ${NGINX_UPSTREAM_SERVER:-varnish-frontend:6060};
          }

          # Exempt internal requests from the linkeddatahub container from rate limiting
          # Use RFC 1918 private IP ranges (same logic as InetAddress.isSiteLocalAddress())
          map $$remote_addr $$limit_key {
              default $$binary_remote_addr;
              ~^10\.          "";  # RFC 1918: 10.0.0.0/8
              ~^172\.1[6-9]\. "";  # RFC 1918: 172.16.0.0/12 (172.16-19.x.x)
              ~^172\.2[0-9]\. "";  # RFC 1918: 172.16.0.0/12 (172.20-29.x.x)
              ~^172\.3[0-1]\. "";  # RFC 1918: 172.16.0.0/12 (172.30-31.x.x)
              ~^192\.168\.    "";  # RFC 1918: 192.168.0.0/16
          }

          limit_req_zone $$limit_key zone=linked_data:10m rate=15r/s;
          limit_req_zone $$limit_key zone=static_files:10m rate=20r/s;
          limit_req_status 429;

          client_max_body_size ${MAX_CONTENT_LENGTH:-2097152};

          # server with optional client cert authentication
          server {
              listen 8443 ssl;
              server_name *.${HOST} ${HOST};
              ssl_certificate /etc/nginx/ssl/server.crt;
              ssl_certificate_key /etc/nginx/ssl/server.key;
              ssl_session_cache shared:SSL:1m;
              ssl_prefer_server_ciphers on;
              ssl_verify_client ${NGINX_SSL_VERIFY_CLIENT:-optional_no_ca};

              location / {
                  proxy_pass http://linkeddatahub;
                  #proxy_cache backcache;
                  limit_req zone=linked_data burst=30 nodelay;

                  proxy_set_header Host $$host;
                  proxy_set_header X-Forwarded-Host $$host;
                  proxy_set_header X-Forwarded-Proto $$scheme;
                  proxy_set_header X-Forwarded-Port ${HTTPS_PORT};

                  proxy_set_header Client-Cert '';
                  proxy_set_header Client-Cert $$ssl_client_escaped_cert;

                  # add_header Cache-Control "public, max-age=86400";
              }

              location ^~ /uploads/ {
                  proxy_pass http://linkeddatahub;
                  limit_req zone=static_files burst=20 nodelay;

                  proxy_set_header Host $$host;
                  proxy_set_header X-Forwarded-Host $$host;
                  proxy_set_header X-Forwarded-Proto $$scheme;
                  proxy_set_header X-Forwarded-Port ${HTTPS_PORT};

                  proxy_set_header Client-Cert '';
                  proxy_set_header Client-Cert $$ssl_client_escaped_cert;

                  add_header Cache-Control "public, max-age=604800, immutable";
              }

              location ^~ /static/ {
                  proxy_pass http://linkeddatahub;
                  limit_req zone=static_files burst=50 nodelay;

                  add_header Cache-Control "public, max-age=604800, immutable";
              }
          }

          # server with client cert authentication on
          server {
              listen 9443 ssl;
              server_name *.${HOST} ${HOST};
              ssl_certificate /etc/nginx/ssl/server.crt;
              ssl_certificate_key /etc/nginx/ssl/server.key;
              ssl_session_cache shared:SSL:1m;  
              ssl_prefer_server_ciphers on;
              ssl_verify_client optional_no_ca;

              location / {
                  proxy_pass http://linkeddatahub;
                  #proxy_cache backcache;
                  limit_req zone=linked_data burst=30 nodelay;

                  proxy_set_header Host $$host;
                  proxy_set_header X-Forwarded-Host $$host;
                  proxy_set_header X-Forwarded-Proto $$scheme;
                  proxy_set_header X-Forwarded-Port ${HTTPS_PORT};

                  proxy_set_header Client-Cert '';
                  proxy_set_header Client-Cert $$ssl_client_escaped_cert;
              }

              location ^~ /static/ {
                  proxy_pass http://linkeddatahub;
                  limit_req zone=static_files burst=50 nodelay;
              }
          }

          server {
              listen 8080;
              server_name *.${HOST} ${HOST};
          
              location / {
                  return 301 https://$$server_name:${HTTPS_PORT}$$request_uri;
              }
          }

      }
  varnish-frontend_vcl:
    content: |
      vcl 4.0;

      import std;

      backend default {
          .host = "${VARNISH_FRONTEND_BACKEND_HOST:-linkeddatahub}";
          .port = "${VARNISH_FRONTEND_BACKEND_PORT:-7070}";
          .first_byte_timeout = 60s;
      }

      acl local {
          "localhost";
          "linkeddatahub";
      }

      acl remote {
      }

      sub vcl_recv {
          if (req.method == "PURGE") {
              if (!client.ip ~ local && !client.ip ~ remote) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }
              return (purge);
          }

          if (req.method == "BAN") { # supports only 2 URIs!
              if (!client.ip ~ local && !client.ip ~ remote) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }

              set req.http.X-Escaped-Request-URI-1 = regsub(req.http.X-Escaped-Request-URI, ",.*$", ""); # remove header value after comma
              set req.http.X-Escaped-Request-URI-2 = regsub(req.http.X-Escaped-Request-URI, "^.*,", ""); # remove header value before comma
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-1);
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-2);
              return (synth(200, "Banned"));
          }

          if (req.method != "GET" &&
            req.method != "HEAD" &&
            req.method != "PUT" &&
            req.method != "POST" &&
            req.method != "TRACE" &&
            req.method != "OPTIONS" &&
            req.method != "DELETE" &&
            req.method != "PATCH") {
              /* Non-RFC2616 or CONNECT which is weird. */
              return (pipe);
          }

          if (req.method != "GET" && req.method != "HEAD") {
              /* We only deal with GET and HEAD by default */
              return (pass);
          }

          if (req.http.Client-Cert) {
              # Authenticated HTML is user-specific → never cache
              if (req.http.Accept ~ "text/html" ||
                  req.http.Accept ~ "application/xhtml+xml") {
                  return (pass);
              }

              # Conditional requests must reach backend for validation
              if (req.http.If-Match || req.http.If-None-Match ||
                  req.http.If-Modified-Since || req.http.If-Unmodified-Since) {
                  return (pass);
              }

              # /access endpoint returns agent-specific group memberships
              if (req.url ~ "^/access") {
                  return (pass);
              }

              # SPARQL referencing /acl/agents/ depends on agent identity → don't cache
              if (req.url ~ "%2Facl%2Fagents%2F") {
                  return (pass);
              }
          }

          if (req.http.Cookie) {
              # explicitly allow only cookies required by LDH server-side
              set req.http.Cookie = ";" + req.http.Cookie;
              set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
              set req.http.Cookie = regsuball(req.http.Cookie, ";(LinkedDataHub\.state|LinkedDataHub\.id_token)=", "; \1=");
              set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
              set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");

              if (req.http.cookie ~ "^\s*$") {
                  unset req.http.cookie;
              }
          }

          return (hash);
      }

      sub vcl_backend_response {
          /* Add Vary: Origin for static files to enable proper CORS caching */
          if (bereq.url ~ "^/static/") {
              if (beresp.http.Vary) {
                  set beresp.http.Vary = beresp.http.Vary + ", Origin";
              } else {
                  set beresp.http.Vary = "Origin";
              }
          }
          
          /* purge URLs after updates */
          if ((beresp.status == 200 || beresp.status == 201 || beresp.status == 204) && bereq.method ~ "POST|PUT|DELETE|PATCH") {
              set beresp.http.X-LinkedDataHub = "Banned";
              ban("req.url == " + bereq.url + " && req.http.host == " + bereq.http.host);
          }

          return (deliver);
      }
  varnish-admin_vcl:
    content: |
      vcl 4.0;

      import std;

      backend default {
          .host = "${VARNISH_ADMIN_BACKEND_HOST:-fuseki-admin}";
          .port = "${VARNISH_ADMIN_BACKEND_PORT:-3030}";
          .first_byte_timeout = 60s;
      }

      acl local {
          "localhost";
          "linkeddatahub";
      }

      sub vcl_recv {
          if (req.method == "PURGE") {
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }
              return (purge);
          }

          if (req.method == "BAN") { # supports only 2 URIs!
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }

              set req.http.X-Escaped-Request-URI-1 = regsub(req.http.X-Escaped-Request-URI, ",.*$", ""); # remove header value after comma
              set req.http.X-Escaped-Request-URI-2 = regsub(req.http.X-Escaped-Request-URI, "^.*,", ""); # remove header value before comma
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-1);
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-2);
              return (synth(200, "Banned"));
          }

          if (req.method != "GET" &&
            req.method != "HEAD" &&
            req.method != "PUT" &&
            req.method != "POST" &&
            req.method != "TRACE" &&
            req.method != "OPTIONS" &&
            req.method != "DELETE" &&
            req.method != "PATCH") {
              /* Non-RFC2616 or CONNECT which is weird. */
              return (pipe);
          }

          if (req.method != "GET" && req.method != "HEAD") {
              /* We only deal with GET and HEAD by default */
              return (pass);
          }

          return (hash);
      }

      sub vcl_backend_response {
          /* purge URLs after updates */
          if ((beresp.status == 200 || beresp.status == 201 || beresp.status == 204) && bereq.method ~ "POST|PUT|DELETE|PATCH") {
              set beresp.http.X-LinkedDataHub = "Banned";
              ban("req.url == " + bereq.url + " && req.http.host == " + bereq.http.host);
          }

          return (deliver);
      }
  varnish-end-user_vcl:
    content: |
      vcl 4.0;

      import std;

      backend default {
          .host = "${VARNISH_END_USER_BACKEND_HOST:-fuseki-end-user}";
          .port = "${VARNISH_END_USER_BACKEND_PORT:-3030}";
          .first_byte_timeout = 60s;
      }

      acl local {
          "localhost";
          "linkeddatahub";
      }

      sub vcl_recv {
          if (req.method == "PURGE") {
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }
              return (purge);
          }

          if (req.method == "BAN") { # supports only 2 URIs!
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }

              set req.http.X-Escaped-Request-URI-1 = regsub(req.http.X-Escaped-Request-URI, ",.*$", ""); # remove header value after comma
              set req.http.X-Escaped-Request-URI-2 = regsub(req.http.X-Escaped-Request-URI, "^.*,", ""); # remove header value before comma
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-1);
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-2);
              return (synth(200, "Banned"));
          }

          if (req.method != "GET" &&
            req.method != "HEAD" &&
            req.method != "PUT" &&
            req.method != "POST" &&
            req.method != "TRACE" &&
            req.method != "OPTIONS" &&
            req.method != "DELETE" &&
            req.method != "PATCH") {
              /* Non-RFC2616 or CONNECT which is weird. */
              return (pipe);
          }

          if (req.method != "GET" && req.method != "HEAD") {
              /* We only deal with GET and HEAD by default */
              return (pass);
          }

          return (hash);
      }

      sub vcl_backend_response {
          /* purge URLs after updates */
          if ((beresp.status == 200 || beresp.status == 201 || beresp.status == 204) && bereq.method ~ "POST|PUT|DELETE|PATCH") {
              set beresp.http.X-LinkedDataHub = "Banned";
              ban("req.url == " + bereq.url + " && req.http.host == " + bereq.http.host);
          }

          return (deliver);
      }