HAJK WebGIS in a box

[matself]

This is what the docker-compose.yml file is said to produce. Very promising.
However, this file fails miserably because all of the dependencies are missing. Or cannot be found, at least.
Please advise. The running vanilla Hajk instance can be found at http://geodat.se

[Hallbergs]

Some error-logs would be helpful. What dependencies are missing? Have you built an Hajk-image and named it so that the compose reference is correct?

The compose file haven't been modified in years and should be seen as an example. The readme should probably be updated to show that.

[matself]

Certainly. I did not build anything, simply pulled hallbergs/hajk:latest and deployed the provided docker-composer file per this instruction. "HAJK also contains a Docker Compose for a production-like set-up combining the following components into a hand "HAJK WebGIS in a box":"
The standard dockerfile is said to contain "all of HAJK's parts" which seems reasonable.
However, here is the response from docker when running the composer file.

WARN[0000] /root/projects/hajk/docker-compose.yml: the attribute version is obsolete, it will be ignored, please remove it to avoid potential confusion 
[+] Running 3/3
 ✘ hajk Error      pull access denied for hajk-backend-with...             1.4s 
 ✘ db Error        pull access denied for hajk-backend-with-c...           1.4s 
 ✘ geoserver Error pull access denied for hajk-backend...                  1.4s 
Error response from daemon: pull access denied for hajk-backend-with-client-and-admin, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

The concept of bundling PostgreSQL/PostGIS and Geoserver together with HAJK is a really great idea, but may need to be revised. Or, the instructions augmented. If one is allowed a wish, including QGIS server would add even more value.
I can install PostgreSQL and Geoserver myself, no big deal, but the bundle seemed too great an idea to pass.

[Hallbergs]

It's trying to find/pull an image ("hajk-backend-with-client-and-admin") as stated in the compose file. This image does not exist since you haven't built an image with that name. You would have to build an image with that name, or update the compose-file so that the hajk service points to an image that exists (hallbergs/hajk:latest or such).

We'll look into updating the instructions, making the point above more clear.

Also, as stated in the instructions, remember to read up on Docker Compose, Kubernetes, etc. before deploying something serious.

### Production Usage

For a production set-up you are free to re-use the compose file, but read up on [Docker Compose](https://docs.docker.com/compose/) syntax and make sure to do some adjustments like:

* change the composition's default passwords (use Docker secrets)
* set container memory limits
* adjust container re-start conditions to your needs
* pin all image versions to explicit releases for stability

Also consider running an orchestration component like Docker Stack/Swarm, Kubernetes, RedHat OpenShift or similar for greater scalibility flexibility in a high load production scenario.

[matself]

On a general note, a script like a Docker compose should aim to simplify a process, or ensure a consistent deployment of an application orin this case a stack of applications. There is no indication that this one is only provided as an 'example'.

[Hallbergs]

I know, we should update the instructions to clarify that the compose file should be seen as an example, as i stated in my first response.

[matself]

When it is up, running Hajk under Docker is very straightforward, fast and efficient (as long as you do not try to add other apps in the Compose).
But a serious problem is that /admin gets exposed with no restrictions. Have you deviced a method to restrict /admin access in a Docker environment? Or have I overlooked that part in the manual?
I have tried adding Nginx or Apache images and do it that way, and also tried the Traefik proxy. ChatGPT and Gemini have done their best in assisting, but without success - there were endless configuration problems and most attempts blocked the site entirely.

[jacobwod]

This has nothing to do with deployment native vs Docker: if you run Hajk without restricting access via AD (which currently is the only way) you must either not expose /admin, or take care of restricting it by some other means.

Regarding Docker without AD where you still want to use Admin, I'd recommend editing .env, commenting out the EXPOSE_AND_RESTRICT_ADMIN (or whatever it's called, look it up please), whenever you're done editing you JSON files. That's not optimal but enables you to use Admin when needed.

[matself]

This is OT, but I chose the node.js version instead. Using Nginx for port mapping allowed me to password protect /admin. As a bonus, I also chose to deploy the site with ssl as https.
Regarding the Docker approach, I was just curious how other users do.