compose.prod.yaml

services:
  traefik:
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
    ports:
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "traefik-certificates:/letsencrypt"
    restart: always
    labels:
      - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.entrypoints=web"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

  postgresdb:
    restart: always

  falak:
    image: ghcr.io/jadwalapp/symmetrical-spoon/falak:main
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=symmetrical-spoon_web"
      - "traefik.http.routers.falak.rule=Host(`${FALAK_HOST}`)"
      - "traefik.http.routers.falak.entrypoints=websecure"
      - "traefik.http.routers.falak.tls.certresolver=myresolver"
      - "traefik.http.services.falak.loadbalancer.server.port=${FALAK_PORT}"
      - "traefik.http.services.falak.loadbalancer.server.scheme=h2c"

  website:
    image: ghcr.io/jadwalapp/symmetrical-spoon/website:main
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.website.rule=Host(`${WEBSITE_HOST}`)"
      - "traefik.http.routers.website.entrypoints=websecure"
      - "traefik.http.routers.website.tls.certresolver=myresolver"
      - "traefik.http.services.website.loadbalancer.server.port=8080"

  grafana:
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=symmetrical-spoon_web"
      - "traefik.http.routers.grafana.rule=Host(`${GRAFANA_HOST}`)"
      - "traefik.http.routers.grafana.entrypoints=websecure"
      - "traefik.http.routers.grafana.tls.certresolver=myresolver"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"

  baikal:
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=symmetrical-spoon_web"
      - "traefik.http.routers.baikal.rule=Host(`${BAIKAL_HOST}`)"
      - "traefik.http.routers.baikal.entrypoints=websecure"
      - "traefik.http.routers.baikal.tls.certresolver=myresolver"
      - "traefik.http.services.baikal.loadbalancer.server.port=80"

  wasapp:
    image: ghcr.io/jadwalapp/symmetrical-spoon/wasapp:main
    restart: always

  rabbitmq:
    restart: always

  tailscale:
    image: tailscale/tailscale:latest
    restart: always
    hostname: batata
    networks:
      - web
      - internal
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}?ephemeral=false
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
      - TS_ROUTES=10.98.0.0/16,10.99.0.0/16
    volumes:
      - tailscale-state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin

volumes:
  traefik-certificates:
  tailscale-state:

networks:
  web:
    ipam:
      config:
        - subnet: 10.98.0.0/16
  internal:
    ipam:
      config:
        - subnet: 10.99.0.0/16