admin/template-stack.yml

version: '3.8'

networks:
  web-net:
    attachable: true
    driver: overlay
  db-net:
    attachable: true
    driver: overlay
  portainer-net:
    attachable: true
    driver: overlay

volumes:
  web-data:
    driver: glusterfs
    name: "data/traefik"
  db-data:
    driver: glusterfs
    name: "data/mysql"
  portainer-data:
    driver: glusterfs
    name: "data/portainer"

secrets:
  traefik-users:
    external: true

services:
  proxy:
    image: "traefik:v2.2"
    command:
      #- "--log.level=DEBUG"
      - "--api"
      - "--api.dashboard=true"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=http"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.https.address=:443"      
      - "--certificatesresolvers.le.acme.email=daniel.huebleitner@gmail.com"
      - "--certificatesresolvers.le.acme.storage=/etc/letsencrypt/acme.json"
      # - "--certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.swarmMode=true"
      - "--global.sendanonymoususage=false"
    secrets:
      - traefik-users
    ports:
      - "80:80"
      - "443:443"
    networks:
      - web-net
    volumes:
      - "web-data:/etc/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        failure_action: rollback
        order: start-first
        monitor: 60s
      rollback_config:
        failure_action: pause
        order: start-first
        monitor: 60s
      placement:
        constraints:
          - node.role==manager
      resources:
        limits:
          cpus: '0.9'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 500M
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 10
        window: 50s
      labels:
        - traefik.enable=true
        - traefik.docker.network=armory_web-net
        - traefik.http.middlewares.admin-auth.basicauth.usersfile=/run/secrets/traefik-users
        - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
        - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
        - traefik.http.routers.traefik-api-http.rule=Host(`traefik.theclassicarmory.com`)
        - traefik.http.routers.traefik-api-http.entrypoints=http
        - traefik.http.routers.traefik-api-http.middlewares=https-redirect
        - traefik.http.routers.traefik-api-https.rule=Host(`traefik.theclassicarmory.com`)
        - traefik.http.routers.traefik-api-https.entrypoints=https
        - traefik.http.routers.traefik-api-https.tls=true
        - traefik.http.routers.traefik-api-https.service=api@internal
        - traefik.http.routers.traefik-api-https.tls.certresolver=le
        - traefik.http.routers.traefik-api-https.middlewares=admin-auth
        - traefik.http.services.traefik-api.loadbalancer.server.port=8080

  app:
    image: hub.monkey.software/theclassicarmory.com/app:latest
    networks:
      - web-net
      - db-net
    depends_on:
      - db
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        failure_action: rollback
        order: start-first
        monitor: 60s
      rollback_config:
        parallelism: 0
        failure_action: continue
        delay: 0s
        order: start-first
        monitor: 60s
      placement:
        constraints:
          - node.role==worker
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 300M
      restart_policy:
        delay: 5s
        max_attempts: 10
        window: 50s
      labels:
        - traefik.enable=true
        - traefik.docker.network=armory_web-net
        - traefik.http.middlewares.armory-https-redirect.redirectscheme.scheme=https
        - traefik.http.middlewares.armory-https-redirect.redirectscheme.permanent=true
        - traefik.http.routers.armory-app-http.rule=Host(`www.theclassicarmory.com`)
        - traefik.http.routers.armory-app-http.entrypoints=http
        - traefik.http.routers.armory-app-http.middlewares=armory-https-redirect
        - traefik.http.routers.armory-app-https.rule=Host(`www.theclassicarmory.com`)
        - traefik.http.routers.armory-app-https.entrypoints=https
        - traefik.http.routers.armory-app-https.tls=true
        - traefik.http.routers.armory-app-https.tls.certresolver=le
        - traefik.http.services.armory-app.loadbalancer.server.port=8080

  db:
    image: mariadb:10.5.5
    environment:
      - MYSQL_ROOT_PASSWORD=evenmuchmoresecreter
      - MYSQL_PASSWORD=muchsecretwow
      - MYSQL_DATABASE=armory
      - MYSQL_USER=armory-app
    networks:
      - db-net
    volumes:
      - db-data:/var/lib/mysql
    stop_grace_period: 60s
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        failure_action: rollback
        order: stop-first
        monitor: 60s
      rollback_config:
        order: start-first
        monitor: 60s
      placement:
        constraints:
          - node.role==worker
      resources:
        limits:
          cpus: '1.5'
          memory: 1.5G
        reservations:
          cpus: '0.5'
          memory: 500M
      restart_policy:
        delay: 5s
        max_attempts: 30
        window: 150s

  portainer-agent:
    image: portainer/agent:linux-amd64-2.0.0-alpine
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "/var/lib/docker/volumes:/var/lib/docker/volumes"
    environment:
      AGENT_CLUSTER_ADDR: "tasks.portainer-agent"
    networks:
      - portainer-net
    deploy:
      mode: global
      update_config:
        parallelism: 1
        failure_action: rollback
        delay: 30s
        order: stop-first
        monitor: 60s
      rollback_config:
        parallelism: 0
        failure_action: continue
        delay: 0s
        order: stop-first
        monitor: 15s
      placement:
        max_replicas_per_node: 1
        constraints: 
          - "node.platform.os==linux"
          - "node.platform.arch==x86_64"
      resources:
        limits:
          cpus: '0.3'
          memory: 100M
        reservations:
          cpus: '0.1'
          memory: 50M
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 10
        window: 50s

  portainer-server:
    image: portainer/portainer-ce:alpine
    command: -H tcp://tasks.portainer-agent:9001 --tlsskipverify
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "portainer-data:/data"
    networks:
      - web-net
      - portainer-net
    deploy:
      mode: replicated
      replicas: 1
      update_config:
        failure_action: rollback
        order: start-first
        monitor: 60s
      rollback_config:
        parallelism: 0
        failure_action: continue
        delay: 0s
        order: start-first
        monitor: 60s
      placement:
        constraints:
          - node.role==manager
      resources:
        limits:
          cpus: '0.4'
          memory: 300M
        reservations:
          cpus: '0.2'
          memory: 100M
      restart_policy:
        delay: 5s
        max_attempts: 10
        window: 50s
      labels:
        - traefik.enable=true
        - traefik.docker.network=armory_web-net
        - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
        - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
        - traefik.http.routers.portainer-app-http.rule=Host(`port.theclassicarmory.com`)
        - traefik.http.routers.portainer-app-http.entrypoints=http
        - traefik.http.routers.portainer-app-http.middlewares=https-redirect
        - traefik.http.routers.portainer-app-https.rule=Host(`port.theclassicarmory.com`)
        - traefik.http.routers.portainer-app-https.entrypoints=https
        - traefik.http.routers.portainer-app-https.tls=true
        - traefik.http.routers.portainer-app-https.tls.certresolver=le
        - traefik.http.services.portainer-app.loadbalancer.server.port=9000