version: "3.7"
services:
  letsencrypt-chat:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-chat
    environment:
      - SERVER_NAME=${CHAT_DOMAIN}
      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
      - PROXY_PASS=http://chat:3000/
    volumes:
      - letsencrypt-chat:/etc/letsencrypt
    networks:
      - appnet
  letsencrypt-remote:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-remote
    environment:
      - SERVER_NAME=${REMOTE_DOMAIN}
      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
      - PROXY_PASS=http://guacamole:8080/guacamole/
    volumes:
      - letsencrypt-remote:/etc/letsencrypt
    networks:
      - appnet
    depends_on:
      - guacamole
  letsencrypt-git:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-git
    environment:
      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
      - SERVER_NAME=${GIT_DOMAIN}
      - PROXY_PASS=http://gitea:3000/
    volumes:
      - letsencrypt-git:/etc/letsencrypt
    networks:
      - appnet
    depends_on:
      - gitea
  letsencrypt-drone:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-drone
    environment:
      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
      - SERVER_NAME=${DRONE_DOMAIN}
      - PROXY_PASS=http://drone-server:8080/
    volumes:
      - letsencrypt-drone:/etc/letsencrypt
    networks:
      - appnet
    depends_on:
      - drone-server
  gitea:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: gitea/gitea:latest
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - ROOT_URL=https://${GIT_DOMAIN}/
      - SSH_DOMAIN=${GIT_DOMAIN}
    volumes:
      - gitea-app:/data
    ports:
      - 3000:3000
      - 22:22
    networks:
      - appnet
  ngrok:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ${LOCAL_DOCKER_REGISTRY}ngrok-gitea
    ports:
      - "4040:4040"
    volumes:
      - ./ngrok-gitea/ngrok._yml:/home/ngrok/.ngrok2/ngrok._yml:ro
    environment:
      - GIT_DOMAIN=${GIT_DOMAIN}
      - DRONE_DOMAIN=${DRONE_DOMAIN}
      - REMOTE_DOMAIN=${REMOTE_DOMAIN}
      - BLOG_DOMAIN=${BLOG_DOMAIN}
      - CHAT_DOMAIN=${CHAT_DOMAIN}
    depends_on:
      - gitea
    networks:
      - appnet
    secrets:
      - ngrok-auth-token
  drone-server:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: drone/drone:latest
    volumes:
      - drone:/var/lib/drone
      - drone-data:/data
    depends_on:
      - gitea
    environment:
      - DRONE_LOGS_DEBUG=true
      - DRONE_LOGS_PRETTY=true
      - DRONE_GITEA_SERVER=${DRONE_GITEA_SERVER}
      - DRONE_GITEA_CLIENT_ID=${DRONE_GITEA_CLIENT_ID}
      - DRONE_GITEA_CLIENT_SECRET=${DRONE_GITEA_CLIENT_SECRET}
      - DRONE_SERVER_HOST=${DRONE_DOMAIN} # tunnel hostname       
      - DRONE_ADMIN=giles
      - DRONE_SERVER_PROTO=https # tunnel adds https on top
      - DRONE_SERVER_PORT=:8080
      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
      - DRONE_USER_CREATE=username:giles,admin:true
      - DRONE_AGENTS_ENABLED=true
      - DRONE_CONVERT_PLUGIN_ENDPOINT=http://drone-starlark:3000
      - DRONE_CONVERT_PLUGIN_SECRET=${DRONE_CONVERT_SECRET}
    networks:
      - appnet
  drone-docker-runner:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: drone/drone-runner-docker:1
    depends_on:
      - drone-server
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - DRONE_RPC_PROTO=https
      - DRONE_RPC_HOST=${DRONE_DOMAIN}
      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
      - DRONE_RUNNER_CAPACITY=8
      - DRONE_RUNNER_NAME="docker-runner"
  drone-starlark:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: drone/drone-convert-starlark
    environment:
      - DRONE_DEBUG=true
      - DRONE_SECRET=${DRONE_CONVERT_SECRET}
      - DRONE_STARLARK_REPO_PATHS=this:/repos
    networks:
      - appnet
    volumes:
      - /home/giles/gitea-drone-stack:/repos

  registry:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: registry:2
    ports:
      - 5000:5000
    volumes:
      - registry-data:/var/lib/registry
    environment:
      - REGISTRY_HTTP_ADDR=0.0.0.0:5000
      - REGISTRY_HTTP_TLS_CERTIFICATE="/run/secrets/registry-cert"
      - REGISTRY_HTTP_TLS_KEY="/run/secrets/registry-key"
    networks:
      - appnet
    secrets:
      - registry-cert
      - registry-key
  registry-cache:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: registry:2
    ports:
      - 5001:5001
    volumes:
      - registry-cache-data:/var/lib/registry
    environment:
      - REGISTRY_HTTP_ADDR=0.0.0.0:5001
      - REGISTRY_HTTP_TLS_CERTIFICATE="/run/secrets/registry-cert"
      - REGISTRY_HTTP_TLS_KEY="/run/secrets/registry-key"
      - REGISTRY_PROXY_REMOTEURL=http://registry-1.docker.io
    networks:
      - appnet
    secrets:
      - registry-cert
      - registry-key  
  letsencrypt-blog:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-blog
    environment:
      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
      - SERVER_NAME=${BLOG_DOMAIN}
      - PROXY_PASS=http://ghost:2368
    volumes:
      - letsencrypt-blog:/etc/letsencrypt
    networks:
      - appnet
    depends_on:
      - blog

  ghost:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ghost
    volumes:
      - ghost-content:/var/lib/ghost/content
      - ./ghost/config.production.json:/var/lib/ghost/config.production.json
    environment:
      - url=https://${BLOG_DOMAIN}
    networks:
      - appnet
  
  guacamole-postgresql:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ${LOCAL_DOCKER_REGISTRY}guacamole-postgresql:latest
    environment:
      POSTGRES_PASSWORD: guacroot
      POSTGRES_DB: guacamole_db
    volumes:
      - guacamole-postgresql-data:/var/lib/postgresql/data
    networks:
      - appnet

  # The backend guacamole server.
  guacd:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: guacamole/guacd:latest
    networks:
      - appnet

  guacamole:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: guacamole/guacamole:latest
    secrets:
      - source: guacamole-postgresql-database
        target: database
      - source: guacamole-postgresql-user
        target: user
      - source: guacamole-postgresql-password
        target: password
    environment:
      - POSTGRES_HOSTNAME=guacamole-postgresql
      - POSTGRES_PORT=5432
      - POSTGRES_USER_FILE=/run/secrets/user
      - POSTGRES_PASSWORD_FILE=/run/secrets/password
      - POSTGRES_DATABASE_FILE=/run/secrets/database
      - GUACD_HOSTNAME=guacd
    networks:
      - appnet
  chat:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 0 # will scale after mongo initated
      restart_policy:
        condition: any
    image: rocketchat/rocket.chat:latest
    networks:
      - appnet
    environment:
      - MONGO_OPLOG_URL=mongodb://chat-mongo:27017/local
      - ROOT_URL=https://${CHAT_DOMAIN}
      - PORT=3000
      - MONGO_URL=mongodb://chat-mongo:27017/rocketchat
    volumes:
      - chat-uploads:/app/uploads
  chat-mongo:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: mongo:4.0
    networks:
      - appnet
    environment:
      - MONGO_DATA_DIR=/data/db
      - MONGO_LOG_DIR=/dev/null
    volumes:
      - mongo-chat:/data/db
    command: mongod --smallfiles --replSet rs0 --oplogSize 128
  nginx-home:
    deploy:
      placement:
        constraints: [node.labels.com.sigyl.git-stack == yes]
      replicas: 1
      restart_policy:
        condition: any
    image: ${LOCAL_DOCKER_REGISTRY}nginx-home1
    environment:
      - SERVER_NAME=${BLOG_DOMAIN}
    ports:
      - 80:80
    
volumes:
  gitea-app:
  gitea-db:
  drone:
  drone-data:
  registry-data:
  registry-cache-data:
  guacamole-postgresql-data:
  letsencrypt-remote:
  letsencrypt-chat:
  letsencrypt-git:
  letsencrypt-drone:
  letsencrypt-blog:
  ghost-content:
  mongo-chat:
  chat-uploads:

networks:
  appnet:
    driver: overlay
    #external: true
secrets:
  'registry-cert':
    file: .certificates/registry.crt
  'registry-key':
    file: .certificates/registry.key
  'guacamole-postgresql-database':
    file: .secrets/guacamole-postgresql-database
  'guacamole-postgresql-user':
    file: .secrets/guacamole-postgresql-user
  'guacamole-postgresql-password':
    file: .secrets/guacamole-postgresql-password
  'ngrok-auth-token':
    file: .secrets/ngrok-auth-token