prod-stack.yml

version: "3.7"

x-logging:
  &default-logging
  options:
    max-size: '12m'
    max-file: '5'
  driver: json-file
x-deploy-php:
  &default-php-deploy
  replicas: 1
  labels:
    - "traefik.enable=false"
  placement:
    constraints:
      - node.labels.type != vm
  resources:
    limits:
      memory: 2048M
      cpus: "1"
    reservations:
      memory: 200M
  update_config:
    parallelism: 1
    failure_action: rollback
    order: start-first
x-deploy:
  &default-deploy
  replicas: 1
  labels:
    - "traefik.enable=false"
  placement:
    constraints:
      - node.labels.type != vm
  resources:
    limits:
      memory: 2048M
  update_config:
    parallelism: 1
    failure_action: rollback
    order: start-first

services:
  app:
    image: ${IMAGE_NAME}
    networks:
      - proxy
      - default
    expose:
      - "80"
    environment:
      CONTAINER_ROLE: app
    secrets:
      - source: dotenv
        target: .env
    deploy:
      replicas: 2
      placement:
        constraints:
          - node.labels.type != vm
        preferences:
          - spread: node.labels.site
      update_config:
        parallelism: 1
        failure_action: rollback
        order: start-first
      resources:
        limits:
          memory: 2048M
        reservations:
          memory: 128M
      labels:
        # note: this assumes traefik v2
        - "traefik.enable=true"
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.tls=true"
        - "traefik.http.routers.${TRAEFIK_BACKEND}.rule=Host(`${TRAEFIK_HOSTNAME}`)"
        - "traefik.http.routers.${TRAEFIK_BACKEND}.entrypoints=web"
        - "traefik.http.services.${TRAEFIK_BACKEND}.loadbalancer.server.port=80" # it seems you always need to give traefik a port so it 'notices' the service
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.rule=Host(`${TRAEFIK_HOSTNAME}`)"
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.entrypoints=web-secured"
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.tls.certresolver=mytlschallenge"
    stop_grace_period: 2m
    logging: *default-logging

  scheduler:
    image: ${IMAGE_NAME}
    deploy: *default-php-deploy
    stop_grace_period: 5m
    networks:
      - default
    environment:
      CONTAINER_ROLE: scheduler
    secrets:
      - source: dotenv
        target: .env
    logging: *default-logging

  queue:
    image: ${IMAGE_NAME}
    deploy: *default-php-deploy
    stop_grace_period: 5m
    networks:
      - default
    environment:
      CONTAINER_ROLE: queue
    secrets:
      - source: dotenv
        target: .env
    logging: *default-logging

  migrations:
    image: ${IMAGE_NAME}
    deploy: *default-php-deploy
    stop_grace_period: 5m
    networks:
      - default
    environment:
      CONTAINER_ROLE: migrations
      CRONMON_ADMIN_USERNAME: ${CRONMON_ADMIN_USERNAME}
      CRONMON_ADMIN_EMAIL: ${CRONMON_ADMIN_EMAIL}
      CRONMON_ADMIN_PASSWORD: ${CRONMON_ADMIN_PASSWORD}
    secrets:
      - source: dotenv
        target: .env

  redis:
    # redis v5.0.5 tag as of 2019-06-25
    # you can get the sha of an image by doing :
    #  docker pull redis:5.0.5
    #  docker images --digests | grep redis
    image: redis@sha256:ca2d9251c2818df48c6598e01a5bdeab46040dc7ab236abe075d7c7343465177
    deploy: *default-deploy
    logging: *default-logging
    networks:
      - default
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]

  mysql:
    image: mysql:5.7
    deploy: *default-deploy
    networks:
      - default
    volumes:
      - mysql:/var/lib/mysql
    environment:
      MYSQL_DATABASE: ${DB_DATABASE}
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_USER: ${DB_USERNAME}
      MYSQL_PASSWORD: ${DB_PASSWORD}

secrets:
  dotenv:
    external: true
    name: ${DOTENV_NAME}

volumes:
  mysql:

networks:
  default:
  proxy:
    external: true