alex
1f2017b7a9
- Remove env_file from deploy/portainer-stack.yml (api and web services) - Add TRAEFIK_CERT_RESOLVER env var to all Traefik router labels - Add TRAEFIK_DASHBOARD_SUBDOMAIN for configurable dashboard hostname - Add TRAEFIK_ENTRYPOINT env var to Traefik dashboard router - Update .env.example with TRAEFIK_DASHBOARD_SUBDOMAIN and TRAEFIK_LOG_LEVEL - Update deploy/.env.example with new Traefik variables All environment variables now come from host environment only.
127 lines
4.2 KiB
YAML
127 lines
4.2 KiB
YAML
version: "3.8"
|
|
|
|
services:
|
|
traefik:
|
|
image: traefik:v3.1
|
|
command:
|
|
- --api.dashboard=true
|
|
- --providers.docker=true
|
|
- --providers.docker.exposedbydefault=false
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.websecure.address=:443
|
|
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
|
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
|
- --certificatesresolvers.letsencrypt.acme.tlschallenge=true
|
|
- --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}
|
|
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
|
|
- --log.level=INFO
|
|
- --accesslog=true
|
|
- --accesslog.format=json
|
|
- --metrics.prometheus=true
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- traefik-certs:/letsencrypt
|
|
networks:
|
|
- platform
|
|
- tools
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_SUBDOMAIN:-traefik}.${ROOT_DOMAIN}`)
|
|
- traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
|
|
- traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
|
|
- traefik.http.routers.traefik-dashboard.service=api@internal
|
|
- traefik.http.routers.traefik-dashboard.middlewares=auth@file
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "traefik", "healthcheck"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
api:
|
|
image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/api:${API_TAG:-latest}
|
|
environment:
|
|
- DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
|
|
- ROOT_DOMAIN=${ROOT_DOMAIN}
|
|
- TOOL_DOMAIN=${TOOL_DOMAIN}
|
|
- API_URL=${API_URL}
|
|
- WEB_URL=${WEB_URL}
|
|
- CORS_ORIGINS=https://${ROOT_DOMAIN},https://*.${ROOT_DOMAIN}
|
|
- AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
|
|
- AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
|
|
- AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
|
|
- SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}
|
|
- ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- platform
|
|
volumes:
|
|
- api-data:/data
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN}`)
|
|
- traefik.http.routers.api.entrypoints=websecure
|
|
- traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
|
|
- traefik.http.services.api.loadbalancer.server.port=8000
|
|
- traefik.http.routers.api.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 5s
|
|
|
|
web:
|
|
image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/web:${WEB_TAG:-latest}
|
|
environment:
|
|
- VITE_API_URL=${VITE_API_URL}
|
|
- VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER}
|
|
- VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID}
|
|
depends_on:
|
|
- api
|
|
networks:
|
|
- platform
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN}`)
|
|
- traefik.http.routers.web.entrypoints=websecure
|
|
- traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
|
|
- traefik.http.services.web.loadbalancer.server.port=8080
|
|
- traefik.http.routers.web.middlewares=sec-headers@file
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: postgres:17-alpine
|
|
environment:
|
|
- POSTGRES_USER=${POSTGRES_USER}
|
|
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
|
- POSTGRES_DB=${POSTGRES_DB}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
networks:
|
|
- platform
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres-data:
|
|
api-data:
|
|
traefik-certs:
|
|
|
|
networks:
|
|
platform:
|
|
driver: bridge
|
|
tools:
|
|
driver: bridge
|
|
external: false
|