docker-swarm.yml

version: "3.7"
services:
  # DDI

  dns:
    image: intranet-dns
    ports:
      - "53:53"
      - "53:53/udp"
    networks:
      - ddi
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.role == manager

  # Web

  reverse-proxy:
    image: intranet-reverse-proxy
    ports:
      - "80:80"
      - "443:443"
    networks:
      - web
    secrets:
      - source: site_privkey.pem
        mode: 0000
      - source: site_fullchain.pem
        mode: 0000
      - source: home_privkey.pem
        mode: 0000
      - source: home_fullchain.pem
        mode: 0000
      - source: test_privkey.pem
        mode: 0000
      - source: test_fullchain.pem
        mode: 0000
      - htpasswd
    deploy:
      placement:
        constraints:
          - node.role == manager
      restart_policy:
        condition: on-failure
  site:
    image: {{ SITE_IMAGE }}
    networks:
      - web
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.site == true
  storage:
    image: ntrrg/nginx:http
    networks:
      - web
    volumes:
      - type: bind
        source: {{ ROOT }}/srv/storage/data
        target: /usr/share/nginx/html
        read_only: true
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.storage == true
  filebrowser:
    image: filebrowser/filebrowser:v2.0.3
    command: -b /admin -p 8080
    user: "1000:1000"
    networks:
      - web
    volumes:
      - type: bind
        source: {{ ROOT }}/srv/storage/data
        target: /srv
      - type: bind
        source: {{ ROOT }}/srv/storage/database.db
        target: /database.db
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.storage == true
  mirrors:
    image: ntrrg/nginx:http
    networks:
      - web
    volumes:
      - type: bind
        source: {{ ROOT }}/srv/mirrors
        target: /usr/share/nginx/html
        read_only: true
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.mirrors == true
  git:
    image: gogs/gogs:0.11.53
    ports:
      - "22:22"
    networks:
      - web
    volumes:
      - type: bind
        source: {{ ROOT }}/srv/gogs
        target: /data
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.git == true
  ci-server:
    depends_on:
      - git
    image: drone/drone:0.8.6
    environment:
      - DRONE_HOST=https://ci.{{ DOMAIN }}
      - DRONE_ADMIN={{ USER }}
      - DRONE_GOGS=true
      - DRONE_GOGS_URL=https://git.{{ DOMAIN }}
      - DRONE_SECRET={{ DRONE_SECRET }}
    networks:
      - web
    volumes:
      - type: bind
        source: {{ ROOT }}/srv/drone
        target: /var/lib/drone
    deploy:
      endpoint_mode: dnsrr
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.ci-server == true
  ci-builder:
    depends_on:
      - ci-server
    image: drone/agent:0.8.6
    command: agent
    environment:
      - DRONE_ROOT=ci-server:9000
      - DRONE_SECRET={{ DRONE_SECRET }}
    networks:
      - web
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
    deploy:
      mode: global
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.ci-builder == true
  registry:
    image: registry:2
    networks:
      - web
    volumes:
      - type: bind
        source: {{ ROOT }}/srv/registry
        target: /var/lib/registry
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.registry == true
  docker-registry:
    image: registry:2
    environment:
      - REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io
    networks:
      - web
    volumes:
      - type: bind
        source: {{ ROOT }}/srv/docker-registry
        target: /var/lib/registry
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.docker-registry == true
networks:
  ddi:
  web:
secrets:
  site_privkey.pem:
    file: {{ ROOT }}/etc/letsencrypt/archive/{{ DOMAIN }}/privkey1.pem
  site_fullchain.pem:
    file: {{ ROOT }}/etc/letsencrypt/archive/{{ DOMAIN }}/fullchain1.pem
  home_privkey.pem:
    file: {{ ROOT }}/etc/letsencrypt/archive/home.{{ DOMAIN }}/privkey1.pem
  home_fullchain.pem:
    file: {{ ROOT }}/etc/letsencrypt/archive/home.{{ DOMAIN }}/fullchain1.pem
  test_privkey.pem:
    file: {{ ROOT }}/etc/letsencrypt/archive/test.{{ DOMAIN }}/privkey1.pem
  test_fullchain.pem:
    file: {{ ROOT }}/etc/letsencrypt/archive/test.{{ DOMAIN }}/fullchain1.pem
  htpasswd:
    file: {{ ROOT }}/etc/htpasswd