compose.yml

# bin/up --profile=mysql
# bin/install-root-ca --all

volumes:
  step:
  tls:
  traefik:
  letsencrypt:
  mail:
  prometheus:
  mysql-8:
  mysql-5:

networks:
  default:
    name: ${ENV_NET:-env}
    attachable: true

services:

  init:
#    profiles: [_]
    image: smallstep/step-ca:0.25.2
    user: root
    volumes:
      - traefik:/mnt/traefik
      - letsencrypt:/mnt/letsencrypt
      - tls:/mnt/tls
      - mail:/mnt/mail
    entrypoint:
      - bash
      - -c
      - mkdir -p /mnt/mail/{config,storage,state,logs} && chown step:step /mnt -R

  ca:
#    profiles: [_]
    image: smallstep/step-ca:0.25.2
    restart: unless-stopped
    depends_on:
      init:
        condition: service_completed_successfully
    volumes:
      - step:/home/step
    environment:
      DOCKER_STEPCA_INIT_NAME: ${ENV_DOMAIN:-app.localhost}
      DOCKER_STEPCA_INIT_DNS_NAMES: ca,ca.${ENV_DOMAIN:-app.localhost}
      DOCKER_STEPCA_INIT_PASSWORD: ${ENV_PASS:-}
      DOCKER_STEPCA_INIT_ACME: "true"
      DOCKER_STEPCA_INIT_SSH: "true"
#      DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT: "true"

    command:
      - bash
      - -c
      - |
        set -e
        
        [ -f ~/.bashrc ] || {
        step completion bash | tee ~/.bashrc
        # for random passwords the provisioner must be recreated 
        step ca provisioner remove admin
        step ca provisioner add admin \
          --create \
          --x509-min-dur=1m \
          --x509-max-dur=240000h \
          --password-file=secrets/password 
        }
        
        step-ca --password-file ~/secrets/password ~/config/ca.json

  # docker compose run --rm --entrypoint=bash default-cert
  default-cert:
#    profiles: [_]
    image: smallstep/step-ca:0.25.2
    restart: unless-stopped
    depends_on:
      ca:
        condition: service_healthy
    volumes:
      - step:/home/step
      - traefik:/traefik
      - tls:/run/tls
    entrypoint:
      - bash
      - -c
      - |
        set -e
        
        [ -f /traefik/default-cert.yml ] || {
        tee "/traefik/default-cert.yml" <<EOF
        tls:
          stores:
            default:
              defaultCertificate:
                certFile: /run/tls/traefik.crt
                keyFile: /run/tls/traefik.key
        EOF
        }
        
        step ca certificate \
          --force \
          --provisioner=admin --password-file=secrets/password \
          --not-after=240h \
          --san="app.localhost" --san="*.app.localhost" \
          app.localhost /run/tls/traefik.crt /run/tls/traefik.key
        
        step ca root > /run/tls/traefik-ca.crt

        step ca renew --daemon --renew-period=30s \
          --exec="touch /traefik/default-cert.yml" \
          /run/tls/traefik.crt /run/tls/traefik.key

  traefik:
#    profiles: [_]
    image: traefik:2.10.7
    depends_on:
      default-cert:
        condition: service_healthy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik:/traefik
      - letsencrypt:/letsencrypt
      - tls:/run/tls:ro
    environment:
      - TZ=${ENV_TZ:-Europe/Berlin}
    command:
      # https://doc.traefik.io/traefik/operations/api/
      - --api=true
      - --api.dashboard=true
      - --api.insecure=false
      #- --api.debug=true
      # https://doc.traefik.io/traefik/observability/logs/
      - --log.level=warning
      # https://doc.traefik.io/traefik/observability/access-logs/
      - --accesslog=true
      - --accesslog.fields.names.StartUTC=drop
      # https://doc.traefik.io/traefik/observability/metrics/prometheus/
      - --metrics.prometheus=true
      - --metrics.prometheus.addrouterslabels=true
      # https://doc.traefik.io/traefik/observability/tracing/overview/
      #- --tracing=true
      #- --tracing.datadog=true
      # https://doc.traefik.io/traefik/providers/docker/
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      # https://doc.traefik.io/traefik/providers/file/
      - --providers.file.directory=/traefik
      - --providers.file.watch=true
      # https://doc.traefik.io/traefik/middlewares/http/redirectscheme/
      - --entrypoints.80.address=:80
      - --entrypoints.80.http.redirections.entrypoint.to=:443
      - --entrypoints.80.http.redirections.entrypoint.scheme=https
      - --entrypoints.80.http.redirections.entrypoint.permanent=true
      - --entrypoints.443.address=:443
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=80

      - --certificatesresolvers.ca.acme.caserver=https://ca:9000/acme/acme/directory
      #      - --certificatesresolvers.ca.acme.email=ignore@localhost
      - --certificatesresolvers.ca.acme.tlsChallenge=true

      # https://doc.traefik.io/traefik/routing/overview/#rootcas
      - --serversTransport.rootCAs=/run/tls/traefik-ca.crt

    labels:
      traefik.enable: true
      traefik.http.routers.traefik.service: api@internal
      traefik.http.routers.traefik.entrypoints: 443
      traefik.http.routers.traefik.tls: true
      traefik.http.routers.traefik.tls.certresolver: letsencrypt

      # https://traefik.app.localhost/
      # traefik.http.routers.traefik.rule: Host(`traefik.${ENV_DOMAIN:-app.localhost}`)

      # https://app.localhost/traefik/
      # see https://github.com/traefik/traefik/issues/5853#issuecomment-663914401
      traefik.http.routers.traefik.rule: ${ENV_TRAEFIK_TR_RULE:-Host(`${ENV_DOMAIN:-app.localhost}`) && (PathPrefix(`/traefik/`) || HeadersRegexp(`Referer`, `.*/traefik/.*`))}
      # see https://doc.traefik.io/traefik/middlewares/http/stripprefixregex/
      traefik.http.middlewares.traefik-strip.stripprefix.prefixes: /traefik/

      traefik.http.routers.traefik.middlewares: ${ENV_TRAEFIK_TR_MIDDLEWARES:-auth,traefik-strip}
      # see https://doc.traefik.io/traefik/middlewares/http/basicauth/
      # sudo apt install -y apache2-utils
      # htpasswd -nB admin
      # escape '$' with '$$' in compose.yml
      # admin/admin
      traefik.http.middlewares.auth.basicauth.users: ${ENV_AUTH:-admin:$$2y$$05$$yrOjlUeRyiwyOhg8mR42HuJeuQXJdZOFcwgHk3eDU5vD5E2AzyaDa}

  prometheus:
    profiles:
      - monitoring
    image: prom/prometheus:v2.46.0
    hostname: prometheus
    container_name: prometheus
    volumes:
      - ./etc/prometheus.yml:/etc/prometheus.yml:ro
      - prometheus:/data

    # https://prometheus.io/docs/prometheus/latest/command-line/prometheus/
    command:
      - --log.level=warn
      - --config.file=/etc/prometheus.yml
      - --storage.tsdb.retention.size=256MB
      - --web.external-url=/prometheus/
    labels:
      traefik.enable: true
      traefik.http.services.prometheus.loadbalancer.server.port: 9090
      traefik.http.routers.prometheus.service: prometheus
      traefik.http.routers.prometheus.entrypoints: 443
      traefik.http.routers.prometheus.tls: true
      traefik.http.routers.prometheus.tls.certresolver: letsencrypt
      traefik.http.routers.prometheus.rule: Host(`${ENV_DOMAIN:-app.localhost}`) && PathPrefix(`/prometheus`)
      traefik.http.routers.prometheus.middlewares: auth

  mysql-8:
    profiles:
      - mysql
      - mysql-8
    image: mysql:8
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - mysql-8:/var/lib/mysql
    environment:
      MYSQL_USER: ${MYSQL_USER:-mysql}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-root}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-${MYSQL_PASSWORD:-root}}

  mysql-5-cert:
    profiles:
      - mysql
      - mysql-5
    depends_on:
      ca:
        condition: service_healthy
    image: smallstep/step-ca:0.25.2
    restart: unless-stopped
    user: root
    volumes:
      - step:/home/step
      - tls:/run/tls
    entrypoint:
      - sh
      - -c
      - |
        set -e
        
        step ca certificate --force --provisioner=admin --password-file=secrets/password \
        --kty=RSA \
        --not-after=2400h \
        mysql-5 /run/tls/mysql-5.crt /run/tls/mysql-5.key

        [ -f /run/tls/mysql-5-ca.crt ] || {
        step ca root > /run/tls/mysql-5-ca.crt
        }

        chown 999:999 /run/tls/mysql-5.crt /run/tls/mysql-5.key /run/tls/mysql-5-ca.crt
        
        step ca renew --daemon --renew-period=30s \
          --exec="touch /dev/null" \
          /run/tls/mysql-5.crt /run/tls/mysql-5.key

  mysql-5:
    profiles:
      - mysql
      - mysql-5
    # for arm architecture set
    # ENV_MYSQL5_IMAGE=biarms/mysql:5.7
    image: ${ENV_MYSQL5_IMAGE:-mysql:5}
    restart: unless-stopped
    depends_on:
      mysql-5-cert:
        condition: service_healthy
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - mysql-5:/var/lib/mysql
      - tls:/run/tls
    environment:
      MYSQL_USER: ${MYSQL_USER:-mysql}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-root}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-${MYSQL_PASSWORD:-root}}
    ports:
      - "3306:${ENV_MYSQL5_PORT:-3306}"
    command:
      - --ssl
      - --tls-version=TLSv1.2,TLSv1.3
      - --ssl-cert=/run/tls/mysql-5.crt
      - --ssl-key=/run/tls/mysql-5.key
#      - --require-secure-transport=ON
#      - --ssl-ca=/rum/tls/mysql-5-ca.crt

  pma:
    profiles:
      - pma
      - mysql
      - mysql-5
      - mysql-8
    image: phpmyadmin:5
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro

    environment:
      MYSQL_USER: ${MYSQL_USER:-root}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-root}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-${MYSQL_PASSWORD:-root}}
      PMA_HOSTS: mysql-5,mysql-8
      PMA_ABSOLUTE_URI: https://${ENV_PMA_TR_HOST:-${ENV_DOMAIN:-app.localhost}}${ENV_PMA_TR_PATH:-/pma}
    #      PMA_ARBITRARY: ${PMA_ARBITRARY:-1}
    labels:
      traefik.enable: true
      traefik.http.routers.pma.entrypoints: 443
      traefik.http.routers.pma.tls: true
      traefik.http.routers.pma.tls.certresolver: letsencrypt
      traefik.http.routers.pma.rule: ${ENV_PMA_TR_RULE:-Host(`${ENV_PMA_TR_HOST:-${ENV_DOMAIN:-app.localhost}}`) && PathPrefix(`${ENV_PMA_TR_PATH:-/pma}`)}
      traefik.http.middlewares.pma-strip.stripprefix.prefixes: ${ENV_PMA_TR_PATH:-/pma}/
      traefik.http.routers.pma.middlewares: ${ENV_PMA_TR_MIDDLEWARES:-auth,pma-strip}

  mailhog:
    profiles:
      - mailhog
    image: mailhog/mailhog:v1.0.1
    restart: unless-stopped
    labels:
      traefik.enable: true
      traefik.http.services.mailhog.loadbalancer.server.port: 8025
      traefik.http.routers.mailhog.service: mailhog
      traefik.http.routers.mailhog.entrypoints: 443
      traefik.http.routers.mailhog.tls: true
      traefik.http.routers.mailhog.tls.certresolver: letsencrypt
      traefik.http.routers.mailhog.rule: ${ENV_MAILHOG_TR_RULE:-Host(`${ENV_MAILHOG_TR_HOST:-${ENV_DOMAIN:-app.localhost}}`) && PathPrefix(`${ENV_MAILHOG_TR_PATH:-/mailhog}`)}
      traefik.http.middlewares.mailhog-strip.stripprefix.prefixes: ${ENV_MAILHOG_TR_PATH:-/mailhog}/
      traefik.http.routers.mailhog.middlewares: ${ENV_MAILHOG_TR_MIDDLEWARES:-auth,mailhog-strip}

  mail:
    profiles:
      - mail
    restart: unless-stopped
    image: mailserver/docker-mailserver:14
    hostname: ${ENV_MAIL_DOMAIN:-mail.${ENV_DOMAIN:-app.localhost}}
    ports:
      - "25:${ENV_MAIL_PORT_25-25}"
      - "587:${ENV_MAIL_PORT_587-587}"
      - "465:${ENV_MAIL_PORT_465-465}"
      - "993:${ENV_MAIL_PORT_993-993}"
    volumes:
      - letsencrypt:/etc/letsencrypt
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro

      # https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/optional-config/
      - ${ENV_MAIL_VOLUME_CONFIG:-/mail/config:/tmp/docker-mailserver}
      - ${ENV_MAIL_VOLUME_STORAGE:-/mail/storage:/var/mail}
      - ${ENV_MAIL_VOLUME_STATE:-/mail/state:/var/mail-state}
      - ${ENV_MAIL_VOLUME_LOGS:-/mail/logs:/var/log/mail}

    environment: # https://docker-mailserver.github.io/docker-mailserver/edge/config/environment/
      SSL_TYPE: ${ENV_MAIL_SSL_TYPE-letsencrypt}
      SSL_DOMAIN: ${ENV_MAIL_DOMAIN:-mail.${ENV_DOMAIN:-app.localhost}}