Replace custom nginx / certbot config with BunkerWeb

.env.example

@@ -1,5 +1,5 @@
 ### ODK Central ###
-ODK_CENTRAL_URL=${ODK_CENTRAL_URL:-"https://proxy"}
+ODK_CENTRAL_URL=${ODK_CENTRAL_URL:-"https://odkcentral:8443"}
 ODK_CENTRAL_USER=${ODK_CENTRAL_USER:-"[email protected]"}
 ODK_CENTRAL_PASSWD=${ODK_CENTRAL_PASSWD:-"testuserpassword"}
 

.github/labeler.yml

@@ -4,7 +4,6 @@
   - "src/backend/**/*"
 "devops":
   - ".github/**/*"
-  - "nginx/**/*"
   - "scripts/**/*"
   - "docker-*.yml"
   - "**/Dockerfile"

.gitignore

@@ -19,6 +19,7 @@
 .Python
 env/
 build/
+!contrib/just/build
 develop-eggs/
 dist/
 dev-dist/

README.md

@@ -18,7 +18,7 @@
 <!-- prettier-ignore-start -->
 <div align="center">
 
-| **CI/CD** | | [![Build and Deploy](https://github.com/hotosm/fmtm/actions/workflows/build_and_deploy.yml/badge.svg?branch=main)](https://github.com/hotosm/fmtm/actions/workflows/build_and_deploy.yml?query=branch%3Amain) [![Build CI Img](https://github.com/hotosm/fmtm/actions/workflows/build_ci_img.yml/badge.svg?branch=development)](https://github.com/hotosm/fmtm/actions/workflows/build_ci_img.yml) [![Build ODK Images](https://github.com/hotosm/fmtm/actions/workflows/build_odk_imgs.yml/badge.svg?branch=development)](https://github.com/hotosm/fmtm/actions/workflows/build_odk_imgs.yml) <br> [![🔧 Build Proxy Images](https://github.com/hotosm/fmtm/actions/workflows/build_proxy_imgs.yml/badge.svg?branch=development)](https://github.com/hotosm/fmtm/actions/workflows/build_proxy_imgs.yml) [![Publish Docs](https://github.com/hotosm/fmtm/actions/workflows/docs.yml/badge.svg?branch=development)](https://github.com/hotosm/fmtm/actions/workflows/docs.yml) |
+| **CI/CD** | | [![Build and Deploy](https://github.com/hotosm/fmtm/actions/workflows/build_and_deploy.yml/badge.svg?branch=main)](https://github.com/hotosm/fmtm/actions/workflows/build_and_deploy.yml?query=branch%3Amain) [![Build CI Img](https://github.com/hotosm/fmtm/actions/workflows/build_ci_img.yml/badge.svg?branch=development)](https://github.com/hotosm/fmtm/actions/workflows/build_ci_img.yml) [![Build ODK Images](https://github.com/hotosm/fmtm/actions/workflows/build_odk_imgs.yml/badge.svg?branch=development)](https://github.com/hotosm/fmtm/actions/workflows/build_odk_imgs.yml) <br> [![Publish Docs](https://github.com/hotosm/fmtm/actions/workflows/docs.yml/badge.svg?branch=development)](https://github.com/hotosm/fmtm/actions/workflows/docs.yml) |
 | :--- | :--- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Tech Stack** | | ![FastAPI](https://img.shields.io/badge/FastAPI-005571?style=for-the-badge&logo=fastapi) ![React](https://img.shields.io/badge/react-%2320232a.svg?style=for-the-badge&logo=react&logoColor=%2361DAFB) ![Postgres](https://img.shields.io/badge/postgres-%23316192.svg?style=for-the-badge&logo=postgresql&logoColor=white) ![Kubernetes](https://img.shields.io/badge/kubernetes-%23326ce5.svg?style=for-the-badge&logo=kubernetes&logoColor=white) ![Docker](https://img.shields.io/badge/docker-%230db7ed.svg?style=for-the-badge&logo=docker&logoColor=white) |
 | **Code Style** | | [![Backend Style](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/format.json&labelColor=202235)](https://github.com/astral-sh/ruff) [![Frontend Style](https://img.shields.io/badge/code%20style-prettier-F7B93E?logo=Prettier)](https://github.com/prettier/prettier) [![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://pre-commit.com) |

nginx/templates/cert-init/fmtm.conf.template → contrib/just/build/Justfile

@@ -1,4 +1,4 @@
-# Copyright (c) 2022, 2023 Humanitarian OpenStreetMap Team
+# Copyright (c) 2024 Humanitarian OpenStreetMap Team
 #
 # This file is part of FMTM.
 #
@@ -16,11 +16,23 @@
 #     along with FMTM.  If not, see <https:#www.gnu.org/licenses/>.
 #
 
-server {
-    listen 80 default_server;
-    server_name ${FMTM_DOMAIN};
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-}
+# Generate certs for local ODK Central https
+[no-cd]
+gen-odk-cert:
+    #!/usr/bin/env sh
+    openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -days 36500 \
+    -nodes -keyout odkcentral.key -out odkcentral.crt -subj "/CN=odkcentral" \
+    -addext "subjectAltName=DNS:odkcentral,DNS:*.odk.fmtm.localhost,IP:10.20.30.50"
+
+    CERT_BASE64=$(cat odkcentral.crt | base64 -w0)
+    KEY_BASE64=$(cat odkcentral.key | base64 -w0)
+
+    echo
+    echo "Cert base64:"
+    echo
+    echo ${CERT_BASE64}
+    echo
+    echo "Key base64:"
+    echo
+    echo ${KEY_BASE64}
+    echo

contrib/just/start/Justfile

@@ -83,7 +83,7 @@ tunnel:
     up -d api ui
 
   # Restart ODK Central with domain override (for form download urls)
-  CENTRAL_DOMAIN_OVERRIDE="$(echo "${odk_url}" | sed 's|^https://||')" \
+  FMTM_ODK_DOMAIN="$(echo "${odk_url}" | sed 's|^https://||')" \
   docker compose \
     -f docker-compose.yml \
     -f contrib/tunnel/docker-compose.yml \
@@ -137,4 +137,3 @@ _print-tunnel-urls fmtm_url api_url odk_url s3_url:
   @echo
 
 
-

docker-compose.development.yml

@@ -76,6 +76,77 @@ services:
       - fmtm-net
     restart: "unless-stopped"
 
+  # proxy:
+  #   image: "ghcr.io/bunkerity/bunkerweb:1.5.9"
+  #   depends_on:
+  #     proxy-config:
+  #       condition: service_started
+  #     api:
+  #       condition: service_started
+  #     ui:
+  #       condition: service_started
+  #     central:
+  #       condition: service_started
+  #       required: false
+  #     central-ui:
+  #       condition: service_completed_successfully
+  #       required: false
+  #     s3:
+  #       condition: service_started
+  #   volumes:
+  #     - nginx-configs:/etc/nginx
+  #     - central_frontend:/var/www/html/odk.fmtm.localhost:ro
+  #   environment:
+  #     # General
+  #     LOG_LEVEL: notice
+  #     API_WHITELIST_IP: 127.0.0.0/8 10.20.30.0/24
+  #     MULTISITE: yes
+  #     USE_REVERSE_PROXY: yes
+  #     REVERSE_PROXY_INTERCEPT_ERRORS: no
+  #     ALLOWED_METHODS: OPTIONS|HEAD|GET|POST|PATCH|PUT|DELETE
+  #     USE_REAL_IP: yes
+  #     SERVE_FILES: yes
+  #     USE_BACKUP: no
+  #     USE_METRICS: no
+  #     # USE_ANTIBOT: yes
+  #     USE_BAD_BEHAVIOR: yes
+  #     USE_LIMIT_REQ: yes
+  #     USE_MODSECURITY: yes
+  #     USE_BROTLI: yes
+  #     # For OpenTelemetry
+  #     CUSTOM_HEADER: "Access-Control-Allow-Headers: 'traceparent,tracestate'"
+  #     # AUTO_LETS_ENCRYPT: yes
+  #     # EMAIL_LETS_ENCRYPT:
+  #     # USE_LETS_ENCRYPT_STAGING: yes
+  #     # Reverse proxy configs
+  #     SERVER_NAME: fmtm.localhost api.fmtm.localhost s3.fmtm.localhost odk.fmtm.localhost odkcentral
+  #     fmtm.localhost_REVERSE_PROXY_HOST: http://ui:7051
+  #     fmtm.localhost_MAX_CLIENT_SIZE: 1G
+  #     api.fmtm.localhost_REVERSE_PROXY_HOST: http://api:8000
+  #     api.fmtm.localhost_MAX_CLIENT_SIZE: 1G
+  #     s3.fmtm.localhost_REVERSE_PROXY_HOST: http://s3:9000
+  #     s3.fmtm.localhost_MAX_CLIENT_SIZE: 10G
+  #     odk.fmtm.localhost_REVERSE_PROXY_HOST: http://central:8383
+  #     odk.fmtm.localhost_REVERSE_PROXY_URL: ~ ^/v\d
+  #     # buffer requests, but not responses, so streaming out works
+  #     odk.fmtm.localhost_REVERSE_PROXY_BUFFERING: no
+  #     odk.fmtm.localhost_MAX_CLIENT_SIZE: 500m
+  #     # Service for local development only to facilitate https odkcentral
+  #     odkcentral_REVERSE_PROXY_HOST: http://central:8383
+  #     odkcentral_REVERSE_PROXY_URL: ~ ^/v\d
+  #     odkcentral_REVERSE_PROXY_BUFFERING: no
+  #     # Custom cert only for local development
+  #     odkcentral_USE_CUSTOM_SSL: yes
+  #     odkcentral_AUTO_REDIRECT_HTTP_TO_HTTPS: no
+  #     odkcentral_CUSTOM_SSL_CERT_DATA: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUI5RENDQVhtZ0F3SUJBZ0lVWXFyb0dWRVdsK204eU9OY2pUU2pCWThkckN3d0NnWUlLb1pJemowRUF3SXcKRlRFVE1CRUdBMVVFQXd3S2IyUnJZMlZ1ZEhKaGJEQWdGdzB5TkRBM01qTXhNakF6TVRWYUdBOHlNVEkwTURZeQpPVEV5TURNeE5Wb3dGVEVUTUJFR0ExVUVBd3dLYjJSclkyVnVkSEpoYkRCMk1CQUdCeXFHU000OUFnRUdCU3VCCkJBQWlBMklBQktSZmpOQVFzWUI0ekNXckdETHdKNEVIRDRTNW5rL1Z3aG00TmYwN203c0RTai9RTzlYK0JnNjIKeWlMbWVzT1ZMRExHRklpZXZ2aHIrZkxNY0YwUDQwN0FWKytER1o5bXZ6VmNwMVdZMlE5NllpTVVuelM3MWx0RQo4K3BXbFBmanRLT0JoekNCaERBZEJnTlZIUTRFRmdRVWNVekZsNUpWN1dUM045VUhxbmhSRHlWT3ZjY3dId1lEClZSMGpCQmd3Rm9BVWNVekZsNUpWN1dUM045VUhxbmhSRHlWT3ZjY3dEd1lEVlIwVEFRSC9CQVV3QXdFQi96QXgKQmdOVkhSRUVLakFvZ2dwdlpHdGpaVzUwY21Gc2doUXFMbTlrYXk1bWJYUnRMbXh2WTJGc2FHOXpkSWNFQ2hRZQpNakFLQmdncWhrak9QUVFEQWdOcEFEQm1BakVBb2xuOGRubmlQN0dKSEJPQW4rTHVCV0ZhaUY1NHFZRmpTYyt1Clpia1cwY1pyNWw2VnZ6WVlBdGdWbUtOdTB5WWRBakVBMWlvT2JRTERYdDV3S1JPWjV5VUtmbys2T21IbTV1NWkKQU5LUHd2MExqc2ZIYk5hbzJMWnduK0VxTjNtdUpPNXEKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  #     odkcentral_CUSTOM_SSL_KEY_DATA: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JRzJBZ0VBTUJBR0J5cUdTTTQ5QWdFR0JTdUJCQUFpQklHZU1JR2JBZ0VCQkRCc21pQjBmUU5hR1VobEdpWnMKNks1YVo1K1hUOVM1cFdlWkhZc05SVXRlK2FRZ1hIK0pTSmpwRnFqRnNLN21abldoWkFOaUFBU2tYNHpRRUxHQQplTXdscXhneThDZUJCdytFdVo1UDFjSVp1RFg5TzV1N0Ewby8wRHZWL2dZT3Rzb2k1bnJEbFN3eXhoU0lucjc0CmEvbnl6SEJkRCtOT3dGZnZneG1mWnI4MVhLZFZtTmtQZW1JakZKODB1OVpiUlBQcVZwVDM0N1E9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+  #   ports:
+  #     - ${FMTM_DEV_PORT:-7050}:8080
+  #   networks:
+  #     fmtm-net:
+  #       ipv4_address: 10.20.30.50
+  #   restart: "unless-stopped"
+
   api:
     image: "ghcr.io/hotosm/fmtm/backend:${GIT_BRANCH}"
     volumes:
@@ -124,6 +195,8 @@ services:
     depends_on:
       central-db:
         condition: service_healthy
+      pyxform:
+        condition: service_started
     environment:
       - DOMAIN=${FMTM_ODK_DOMAIN:-odk.${FMTM_DOMAIN}}
       - SSL_TYPE=upstream

docker-compose.yml

@@ -18,6 +18,7 @@
 name: fmtm
 
 volumes:
+  nginx-configs:
   fmtm_data:
   fmtm_db_data:
   fmtm_logs:
@@ -29,16 +30,17 @@ volumes:
 networks:
   fmtm-net:
     name: fmtm-${GIT_BRANCH:-local}
+    ipam:
+      driver: default
+      config:
+        - subnet: 10.20.30.0/24
 
 services:
   proxy:
-    image: "ghcr.io/hotosm/fmtm/proxy:debug"
-    build:
-      context: nginx
-      target: debug
-      args:
-        NGINX_TAG: "${NGINX_TAG:-1.27.0}"
+    image: "ghcr.io/bunkerity/bunkerweb:1.5.9"
     depends_on:
+      proxy-config:
+        condition: service_started
       api:
         condition: service_started
       ui:
@@ -52,13 +54,84 @@ services:
       s3:
         condition: service_started
     volumes:
-      - central_frontend:/usr/share/nginx/html/central
+      - nginx-configs:/etc/nginx
+      - central_frontend:/var/www/html/odk.fmtm.localhost:ro
+    environment:
+      # General
+      LOG_LEVEL: notice
+      API_WHITELIST_IP: 127.0.0.0/8 10.20.30.0/24
+      MULTISITE: yes
+      USE_REVERSE_PROXY: yes
+      REVERSE_PROXY_INTERCEPT_ERRORS: no
+      ALLOWED_METHODS: OPTIONS|HEAD|GET|POST|PATCH|PUT|DELETE
+      USE_REAL_IP: yes
+      SERVE_FILES: yes
+      USE_BACKUP: no
+      USE_METRICS: no
+      # USE_ANTIBOT: yes
+      USE_BAD_BEHAVIOR: no
+      USE_LIMIT_REQ: no
+      USE_MODSECURITY: no
+      USE_BROTLI: yes
+      # For OpenTelemetry
+      # KEEP_UPSTREAM_HEADERS: "*"
+      # CUSTOM_HEADER: "Access-Control-Allow-Headers: traceparent,tracestate"
+      # AUTO_LETS_ENCRYPT: yes
+      # EMAIL_LETS_ENCRYPT:
+      # USE_LETS_ENCRYPT_STAGING: yes
+      # Reverse proxy configs
+      SERVER_NAME: fmtm.localhost api.fmtm.localhost s3.fmtm.localhost odk.fmtm.localhost odkcentral
+      fmtm.localhost_REVERSE_PROXY_HOST: http://ui:7051
+      fmtm.localhost_MAX_CLIENT_SIZE: 1G
+      api.fmtm.localhost_REVERSE_PROXY_HOST: http://api:8000
+      api.fmtm.localhost_MAX_CLIENT_SIZE: 1G
+      s3.fmtm.localhost_REVERSE_PROXY_HOST: http://s3:9000
+      s3.fmtm.localhost_MAX_CLIENT_SIZE: 10G
+      odk.fmtm.localhost_REVERSE_PROXY_HOST: http://central:8383
+      odk.fmtm.localhost_REVERSE_PROXY_URL: ~ ^/v\d
+      # buffer requests, but not responses, so streaming out works
+      odk.fmtm.localhost_REVERSE_PROXY_BUFFERING: no
+      odk.fmtm.localhost_MAX_CLIENT_SIZE: 500m
+      # Service for local development only to facilitate https odkcentral
+      odkcentral_REVERSE_PROXY_HOST: http://central:8383
+      odkcentral_REVERSE_PROXY_URL: ~ ^/v\d
+      odkcentral_REVERSE_PROXY_BUFFERING: no
+      # Custom cert only for local development
+      odkcentral_USE_CUSTOM_SSL: yes
+      odkcentral_AUTO_REDIRECT_HTTP_TO_HTTPS: no
+      odkcentral_CUSTOM_SSL_CERT_DATA: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUI5RENDQVhtZ0F3SUJBZ0lVWXFyb0dWRVdsK204eU9OY2pUU2pCWThkckN3d0NnWUlLb1pJemowRUF3SXcKRlRFVE1CRUdBMVVFQXd3S2IyUnJZMlZ1ZEhKaGJEQWdGdzB5TkRBM01qTXhNakF6TVRWYUdBOHlNVEkwTURZeQpPVEV5TURNeE5Wb3dGVEVUTUJFR0ExVUVBd3dLYjJSclkyVnVkSEpoYkRCMk1CQUdCeXFHU000OUFnRUdCU3VCCkJBQWlBMklBQktSZmpOQVFzWUI0ekNXckdETHdKNEVIRDRTNW5rL1Z3aG00TmYwN203c0RTai9RTzlYK0JnNjIKeWlMbWVzT1ZMRExHRklpZXZ2aHIrZkxNY0YwUDQwN0FWKytER1o5bXZ6VmNwMVdZMlE5NllpTVVuelM3MWx0RQo4K3BXbFBmanRLT0JoekNCaERBZEJnTlZIUTRFRmdRVWNVekZsNUpWN1dUM045VUhxbmhSRHlWT3ZjY3dId1lEClZSMGpCQmd3Rm9BVWNVekZsNUpWN1dUM045VUhxbmhSRHlWT3ZjY3dEd1lEVlIwVEFRSC9CQVV3QXdFQi96QXgKQmdOVkhSRUVLakFvZ2dwdlpHdGpaVzUwY21Gc2doUXFMbTlrYXk1bWJYUnRMbXh2WTJGc2FHOXpkSWNFQ2hRZQpNakFLQmdncWhrak9QUVFEQWdOcEFEQm1BakVBb2xuOGRubmlQN0dKSEJPQW4rTHVCV0ZhaUY1NHFZRmpTYyt1Clpia1cwY1pyNWw2VnZ6WVlBdGdWbUtOdTB5WWRBakVBMWlvT2JRTERYdDV3S1JPWjV5VUtmbys2T21IbTV1NWkKQU5LUHd2MExqc2ZIYk5hbzJMWnduK0VxTjNtdUpPNXEKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+      odkcentral_CUSTOM_SSL_KEY_DATA: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JRzJBZ0VBTUJBR0J5cUdTTTQ5QWdFR0JTdUJCQUFpQklHZU1JR2JBZ0VCQkRCc21pQjBmUU5hR1VobEdpWnMKNks1YVo1K1hUOVM1cFdlWkhZc05SVXRlK2FRZ1hIK0pTSmpwRnFqRnNLN21abldoWkFOaUFBU2tYNHpRRUxHQQplTXdscXhneThDZUJCdytFdVo1UDFjSVp1RFg5TzV1N0Ewby8wRHZWL2dZT3Rzb2k1bnJEbFN3eXhoU0lucjc0CmEvbnl6SEJkRCtOT3dGZnZneG1mWnI4MVhLZFZtTmtQZW1JakZKODB1OVpiUlBQcVZwVDM0N1E9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
     ports:
-      - ${FMTM_DEV_PORT:-7050}:80
+      - ${FMTM_DEV_PORT:-7050}:8080
     networks:
-      - fmtm-net
+      fmtm-net:
+        ipv4_address: 10.20.30.50
     restart: "unless-stopped"
 
+  proxy-config:
+    image: "ghcr.io/bunkerity/bunkerweb-scheduler:1.5.9"
+    depends_on:
+      proxy-docker-sock:
+        condition: service_started
+    environment:
+      - DOCKER_HOST=tcp://proxy-docker-sock:2375
+    networks:
+      - fmtm-net
+    restart: "no"
+    entrypoint: timeout 120 ./entrypoint.sh
+
+  proxy-docker-sock:
+    image: "docker.io/tecnativa/docker-socket-proxy:0.2.0"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+      - LOG_LEVEL=warning
+    networks:
+      - fmtm-net
+    restart: "no"
+    command: timeout 120 haproxy -W -db -f /usr/local/etc/haproxy/haproxy.cfg
+
   api:
     image: "ghcr.io/hotosm/fmtm/backend:${TAG_OVERRIDE:-debug}"
     build:
@@ -96,6 +169,8 @@ services:
     #   - "5678-5679:5678" # Debugger port
     networks:
       - fmtm-net
+    extra_hosts:
+      odkcentral: 10.20.30.50
     restart: "unless-stopped"
     deploy:
       replicas: ${API_REPLICAS:-1}
@@ -120,7 +195,7 @@ services:
       - /app/node_modules/
       # - ../ui:/app/node_modules/@hotosm/ui:ro
     environment:
-      - VITE_API_URL=${API_URL_OVERRIDE:-http://api.${FMTM_DOMAIN}:${FMTM_DEV_PORT:-7050}}
+      - VITE_API_URL=${API_URL_OVERRIDE:-http://api.fmtm.localhost:${FMTM_DEV_PORT:-7050}}
     ports:
       - "7051:7051"
     networks:
@@ -135,7 +210,7 @@ services:
       - DISPLAY=:0
     volumes:
       - ./src/frontend:/app
-      - /tmp/.X11-unix:/tmp/.X11-unix
+      - /tmp/.X11-unix:/tmp/.X11-unix:ro
     command: npm run test:e2e
     networks:
       - fmtm-net
@@ -151,8 +226,10 @@ services:
     depends_on:
       central-db:
         condition: service_healthy
+      pyxform:
+        condition: service_started
     environment:
-      - DOMAIN=${CENTRAL_DOMAIN_OVERRIDE:-odk.${FMTM_DOMAIN}:${FMTM_DEV_PORT:-7050}}
+      - DOMAIN=${FMTM_ODK_DOMAIN:-odk.fmtm.localhost}:${FMTM_DEV_PORT:-7050}
       - SSL_TYPE=upstream
       - SYSADMIN_EMAIL=${ODK_CENTRAL_USER}
       - SYSADMIN_PASSWD=${ODK_CENTRAL_PASSWD}
@@ -234,7 +311,7 @@ services:
     # Temp workaround until https://github.com/postgis/docker-postgis/issues/216
     build:
       context: https://github.com/postgis/docker-postgis.git#master:14-3.4/alpine
-    command: -c 'max_connections=300'
+    command: -c 'wal_level=logical' -c 'max_connections=300'
     volumes:
       - fmtm_db_data:/var/lib/postgresql/data/
     environment: