358 lines
9.5 KiB
YAML
358 lines
9.5 KiB
YAML
version: "3.7"
|
|
services:
|
|
letsencrypt-git:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 0
|
|
restart_policy:
|
|
condition: any
|
|
image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-git
|
|
environment:
|
|
- CERTBOT_EMAIL=${CERTBOT_EMAIL}
|
|
- SERVER_NAME=${GIT_DOMAIN}
|
|
- PROXY_PASS=http://gitea:3000/
|
|
- BLOG_PROXY_PASS=http://ghost:2368
|
|
- CHAT_PROXY_PASS=http://chat:3000
|
|
- REMOTE_PROXY_PASS=http://guacamole:8080/guacamole/
|
|
- DRONE_PROXY_PASS=http://drone-server:8080
|
|
- REGISTRY_PROXY_PASS=http://registry-1:5000
|
|
- LOCATION=/git/
|
|
- BLOG_LOCATION=/blog/
|
|
- CHAT_LOCATION=/chat/
|
|
- REMOTE_LOCATION=/remote/
|
|
- DRONE_SERVER_HOST=$DRONE_SERVER_HOST
|
|
- TITLE=$TITLE
|
|
- DESCRIPTION=$DESCRIPTION
|
|
- DRONE_REPO_LINK=$DRONE_REPO_LINK
|
|
- DRONE_COMMIT=$DRONE_COMMIT
|
|
|
|
volumes:
|
|
- letsencrypt-git:/etc/letsencrypt
|
|
networks:
|
|
- appnet
|
|
depends_on:
|
|
- gitea
|
|
ports:
|
|
- 80:80
|
|
- 443:443
|
|
- 5000:5000
|
|
- 5001:5001
|
|
letsencrypt-drone:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 0
|
|
restart_policy:
|
|
condition: any
|
|
image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-drone
|
|
environment:
|
|
- CERTBOT_EMAIL=${CERTBOT_EMAIL}
|
|
- SERVER_NAME=${DRONE_DOMAIN}
|
|
- PROXY_PASS=http://drone-server:8080/
|
|
volumes:
|
|
- letsencrypt-drone:/etc/letsencrypt
|
|
networks:
|
|
- appnet
|
|
depends_on:
|
|
- drone-server
|
|
gitea:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: ${LOCAL_DOCKER_REGISTRY}gitea
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- ROOT_URL=https://${GIT_DOMAIN}/git
|
|
- SSH_DOMAIN=${GIT_DOMAIN}
|
|
- GITEA_APP_NAME=${GITEA_APP_NAME}
|
|
- GIT_DOMAIN=${GIT_DOMAIN}
|
|
- GITEA_SERVER_LFS_JWT_SECRET=$GITEA_SERVER_LFS_JWT_SECRET
|
|
- GITEA_SECURITY_SECRET_KEY=$GITEA_SECURITY_SECRET_KEY
|
|
- GITEA_SECURITY_INTERNAL_TOKEN=$GITEA_SECURITY_INTERNAL_TOKEN
|
|
- GITEA_OAUTH2_JWT_SECRET=$GITEA_OAUTH2_JWT_SECRET
|
|
- GITEA_MAILER_HOST=$GITEA_MAILER_HOST
|
|
- GITEA_MAILER_USER=$GITEA_MAILER_USER
|
|
- GITEA_MAILER_FROM=$GITEA_MAILER_FROM
|
|
- GITEA_MAILER_PASSWD=$GITEA_MAILER_PASSWD
|
|
|
|
volumes:
|
|
- gitea-app:/data
|
|
ports:
|
|
- 3000:3000
|
|
- 22:22
|
|
networks:
|
|
- appnet
|
|
ngrok:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 0
|
|
restart_policy:
|
|
condition: any
|
|
image: ${LOCAL_DOCKER_REGISTRY}ngrok-gitea
|
|
ports:
|
|
- "4040:4040"
|
|
environment:
|
|
- GIT_DOMAIN=${GIT_DOMAIN}
|
|
- DRONE_DOMAIN=${DRONE_DOMAIN}
|
|
- REMOTE_DOMAIN=${REMOTE_DOMAIN}
|
|
- BLOG_DOMAIN=${BLOG_DOMAIN}
|
|
- CHAT_DOMAIN=${CHAT_DOMAIN}
|
|
- NGROK_AUTH_TOKEN=${NGROK_AUTH_TOKEN}
|
|
depends_on:
|
|
- gitea
|
|
networks:
|
|
- appnet
|
|
drone-server:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: drone/drone:latest
|
|
volumes:
|
|
- drone:/var/lib/drone
|
|
- drone-data:/data
|
|
depends_on:
|
|
- gitea
|
|
environment:
|
|
- DRONE_LOGS_DEBUG=true
|
|
- DRONE_LOGS_PRETTY=true
|
|
- DRONE_GITEA_SERVER=${DRONE_GITEA_SERVER}
|
|
- DRONE_GITEA_CLIENT_ID=${DRONE_GITEA_CLIENT_ID}
|
|
- DRONE_GITEA_CLIENT_SECRET=${DRONE_GITEA_CLIENT_SECRET}
|
|
- DRONE_SERVER_HOST=${DRONE_SERVER_HOST} # tunnel hostname
|
|
- DRONE_ADMIN=giles
|
|
- DRONE_SERVER_PROTO=https # tunnel adds https on top
|
|
- DRONE_SERVER_PORT=:8080
|
|
- DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
|
|
- DRONE_USER_CREATE=username:giles,admin:true
|
|
- DRONE_AGENTS_ENABLED=true
|
|
- DRONE_CONVERT_PLUGIN_ENDPOINT=http://drone-starlark:3000
|
|
- DRONE_CONVERT_PLUGIN_SECRET=${DRONE_CONVERT_SECRET}
|
|
networks:
|
|
- appnet
|
|
drone-docker-runner:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: drone/drone-runner-docker:1
|
|
depends_on:
|
|
- drone-server
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
- DRONE_RPC_PROTO=https
|
|
- DRONE_RPC_HOST=${DRONE_SERVER_HOST}
|
|
- DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
|
|
- DRONE_RUNNER_CAPACITY=8
|
|
- DRONE_RUNNER_NAME="docker-runner"
|
|
drone-starlark:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: ${LOCAL_DOCKER_REGISTRY}drone-starlark
|
|
environment:
|
|
- DRONE_DEBUG=true
|
|
- DRONE_SECRET=${DRONE_CONVERT_SECRET}
|
|
- DRONE_STARLARK_REPO_PATHS=this:/repos
|
|
- SIGYL_STACK_NAME=$SIGYL_STACK_NAME
|
|
- SIGYL_STACK_ROOT=$SIGYL_STACK_ROOT
|
|
networks:
|
|
- appnet
|
|
|
|
registry:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: registry:2
|
|
volumes:
|
|
- registry-data:/var/lib/registry
|
|
environment:
|
|
- REGISTRY_HTTP_ADDR=0.0.0.0:5000
|
|
- REGISTRY_HTTP_TLS_CERTIFICATE="/run/secrets/registry-cert"
|
|
- REGISTRY_HTTP_TLS_KEY="/run/secrets/registry-key"
|
|
networks:
|
|
- appnet
|
|
secrets:
|
|
- registry-cert
|
|
- registry-key
|
|
ports:
|
|
- 5003:5000
|
|
registry-1:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: registry:2
|
|
volumes:
|
|
- registry-data:/var/lib/registry
|
|
environment:
|
|
- REGISTRY_HTTP_ADDR=0.0.0.0:5000
|
|
networks:
|
|
- appnet
|
|
registry-cache:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: registry:2
|
|
ports:
|
|
- 5002:5001
|
|
volumes:
|
|
- registry-cache-data:/var/lib/registry
|
|
environment:
|
|
- REGISTRY_HTTP_ADDR=0.0.0.0:5001
|
|
- REGISTRY_HTTP_TLS_CERTIFICATE="/run/secrets/registry-cert"
|
|
- REGISTRY_HTTP_TLS_KEY="/run/secrets/registry-key"
|
|
- REGISTRY_PROXY_REMOTEURL=http://registry-1.docker.io
|
|
networks:
|
|
- appnet
|
|
secrets:
|
|
- registry-cert
|
|
- registry-key
|
|
|
|
ghost:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: ${LOCAL_DOCKER_REGISTRY}ghost
|
|
volumes:
|
|
- ghost-content:/var/lib/ghost/content
|
|
environment:
|
|
- GIT_DOMAIN=$GIT_DOMAIN
|
|
- GHOST-MAIL-SERVICE=$GHOST-MAIL-SERVICE
|
|
- GHOST-MAIL-USER=$GHOST-MAIL-USER
|
|
- GHOST-MAIL-PASSWORD=$GHOST-MAIL-PASSWORD
|
|
|
|
|
|
networks:
|
|
- appnet
|
|
|
|
guacamole-postgresql:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack-data == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: ${LOCAL_DOCKER_REGISTRY}guacamole-postgresql:latest
|
|
environment:
|
|
POSTGRES_PASSWORD: ${GUACAMOLE_POSTGRES_PASSWORD}
|
|
POSTGRES_DB: ${GUACAMOLE_POSTGRES_DB}
|
|
volumes:
|
|
- guacamole-postgresql-data:/var/lib/postgresql/data
|
|
networks:
|
|
- appnet
|
|
|
|
# The backend guacamole server.
|
|
guacd:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: guacamole/guacd:latest
|
|
networks:
|
|
- appnet
|
|
|
|
guacamole:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: guacamole/guacamole:latest
|
|
environment:
|
|
- POSTGRES_HOSTNAME=guacamole-postgresql
|
|
- POSTGRES_PORT=5432
|
|
- POSTGRES_USER=${GUACAMOLE_POSTGRES_USER}
|
|
- POSTGRES_PASSWORD=${GUACAMOLE_POSTGRES_PASSWORD}
|
|
- POSTGRES_DATABASE=${GUACAMOLE_POSTGRES_DB}
|
|
- GUACD_HOSTNAME=guacd
|
|
networks:
|
|
- appnet
|
|
chat:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack == yes]
|
|
replicas: 0 # will scale after mongo initated
|
|
restart_policy:
|
|
condition: any
|
|
image: rocketchat/rocket.chat:3.0.7
|
|
networks:
|
|
- appnet
|
|
environment:
|
|
- MONGO_OPLOG_URL=mongodb://chat-mongo:27017/local
|
|
- ROOT_URL=https://${GIT_DOMAIN}/chat
|
|
- PORT=3000
|
|
- MONGO_URL=mongodb://chat-mongo:27017/rocketchat
|
|
- ADMIN_USERNAME=${CHAT_ADMIN_NAME}
|
|
- ADMIN_PASS=${CHAT_ADMIN_PASSWORD}
|
|
- ADMIN_EMAIL=${CHAT_ADMIN_EMAIL}
|
|
volumes:
|
|
- chat-uploads:/app/uploads
|
|
chat-mongo:
|
|
deploy:
|
|
placement:
|
|
constraints: [node.labels.com.sigyl.git-stack-data == yes]
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
image: mongo:4.0
|
|
networks:
|
|
- appnet
|
|
environment:
|
|
- MONGO_DATA_DIR=/data/db
|
|
- MONGO_LOG_DIR=/dev/null
|
|
volumes:
|
|
- mongo-chat:/data/db
|
|
command: mongod --smallfiles --replSet rs0 --oplogSize 128
|
|
|
|
volumes:
|
|
gitea-app:
|
|
drone:
|
|
drone-data:
|
|
registry-data:
|
|
registry-cache-data:
|
|
guacamole-postgresql-data:
|
|
letsencrypt-git:
|
|
letsencrypt-drone:
|
|
ghost-content:
|
|
mongo-chat:
|
|
chat-uploads:
|
|
|
|
networks:
|
|
appnet:
|
|
driver: overlay
|
|
#external: true
|
|
secrets:
|
|
'registry-cert':
|
|
file: .certificates/registry.crt
|
|
'registry-key':
|
|
file: .certificates/registry.key
|
|
|