docker-compose.prod.yml

services:
  traefik:
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
    networks:
      - web-public
    deploy:
      update_config:
        parallelism: 1
        delay: 5s
        order: stop-first
      placement:
        constraints:
          - node.role==manager
    volumes:
      # Mount the Docker socket as read-only so Traefik can listen to events
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - certificates:/certificates
    configs:
      - source: traefik
        target: /etc/traefik/traefik.yml
  php:
    image: ${SPIN_IMAGE_DOCKERFILE_PHP}
    environment:
      AUTORUN_ENABLED: "true" # 👈 Remove this line if you don't want Laravel Automations
      APP_ENV: "${SPIN_DEPLOYMENT_ENVIRONMENT}"
      PHP_OPCACHE_ENABLE: "1"
      HEALTHCHECK_PATH: "/up"
    networks:
      - web-public
    volumes:
      - "storage_private:/var/www/html/storage/app/private/"
      - "storage_public:/var/www/html/storage/app/public/"
      - "storage_sessions:/var/www/html/storage/framework/sessions"
      - "storage_logs:/var/www/html/storage/logs"
    deploy:
      replicas: 1
      update_config:
        failure_action: rollback
        parallelism: 1
        delay: 5s
        order: start-first
      rollback_config:
        parallelism: 0
        order: stop-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 3
        window: 120s
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.laravel-web.rule=Host(`${SPIN_APP_DOMAIN}`)"
        - "traefik.http.routers.laravel-web.entrypoints=websecure"
        - "traefik.http.routers.laravel-web.tls=true"
        - "traefik.http.routers.laravel-web.tls.certresolver=letsencryptresolver"
        - "traefik.http.services.laravel-web.loadbalancer.server.port=8443"
        - "traefik.http.services.laravel-web.loadbalancer.server.scheme=https"
        # Health check
        - "traefik.http.services.laravel-web.loadbalancer.healthcheck.path=/up"
        - "traefik.http.services.laravel-web.loadbalancer.healthcheck.interval=30s"
        - "traefik.http.services.laravel-web.loadbalancer.healthcheck.timeout=5s"
        - "traefik.http.services.laravel-web.loadbalancer.healthcheck.scheme=https"
  schedule:
    image: ${SPIN_IMAGE_DOCKERFILE_PHP}
    environment:
      APP_ENV: "${SPIN_DEPLOYMENT_ENVIRONMENT}"
    networks:
      - web-public
    volumes:
      - "storage_private:/var/www/html/storage/app/private/"
      - "storage_public:/var/www/html/storage/app/public/"
      - "storage_sessions:/var/www/html/storage/framework/sessions"
      - "storage_logs:/var/www/html/storage/logs"
    deploy:
      replicas: 1
      update_config:
        failure_action: rollback
        parallelism: 1
        delay: 5s
        order: start-first
      rollback_config:
        parallelism: 0
        order: stop-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 3
        window: 120s
  postgres:
    networks:
      - web-public
    environment:
      POSTGRES_DB: "${DB_DATABASE}"
      POSTGRES_USER: "${DB_USERNAME}"
      POSTGRES_PASSWORD: "${DB_PASSWORD}"
    deploy:
      placement:
        constraints:
          - node.role==manager
    volumes:
      - postgres_data:/var/lib/postgresql
      - postgres_shared:/shared
  ssh:
    # We use an SSH image so we can securely tunnel into the Docker network with 
    # tools like Sequel Pro, TablePlus, Sequel Ace, etc.
    # Learn more how to secure your tunnel here: https://github.com/serversideup/docker-ssh
    image: serversideup/docker-ssh:v3
    ports:
      - target: 2222
        published: 2222
        mode: host
    environment:
      # Be sure to set the authorized keys in the .env file or GitHub Actions secrets
      AUTHORIZED_KEYS: "${AUTHORIZED_KEYS}"
      # You can lock to a specific IP too (AllowUsers tunnel@1.2.3.4)
      ALLOWED_IPS: "AllowUsers tunnel"
    volumes:
      - tunnel_ssh_host_keys:/etc/ssh/ssh_host_keys
    networks:
      - web-public
  redis:
    command: "redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}"
    volumes:
      - redis_data:/data
    networks:
      - web-public
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 5s
        order: start-first
  horizon:
    image: ${SPIN_IMAGE_DOCKERFILE_PHP}
    environment:
      APP_ENV: "${SPIN_DEPLOYMENT_ENVIRONMENT}"
    stop_grace_period: 30s
    networks:
      - web-public
    volumes:
      - "storage_private:/var/www/html/storage/app/private/"
      - "storage_public:/var/www/html/storage/app/public/"
      - "storage_sessions:/var/www/html/storage/framework/sessions"
      - "storage_logs:/var/www/html/storage/logs"
    deploy:
      update_config:
        failure_action: rollback
        parallelism: 1
        delay: 5s
        order: stop-first
      rollback_config:
        parallelism: 0
        order: stop-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 3
        window: 120s
  reverb:
    image: ${SPIN_IMAGE_DOCKERFILE_PHP}
    environment:
      APP_ENV: "${SPIN_DEPLOYMENT_ENVIRONMENT}"
    networks:
      - web-public
    volumes:
      - "storage_private:/var/www/html/storage/app/private/"
      - "storage_public:/var/www/html/storage/app/public/"
      - "storage_sessions:/var/www/html/storage/framework/sessions"
      - "storage_logs:/var/www/html/storage/logs"
    deploy:
      replicas: 1
      update_config:
        failure_action: rollback
        parallelism: 1
        delay: 5s
        order: start-first
      rollback_config:
        parallelism: 0
        order: stop-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 3
        window: 120s
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.laravel-reverb.rule=Host(`${REVERB_HOST}`)"
        - "traefik.http.routers.laravel-reverb.entrypoints=websecure"
        - "traefik.http.routers.laravel-reverb.tls=true"
        - "traefik.http.routers.laravel-reverb.tls.certresolver=letsencryptresolver"
        - "traefik.http.services.laravel-reverb.loadbalancer.server.port=8000"
        - "traefik.http.services.laravel-reverb.loadbalancer.server.scheme=http"

  ssr:
    image: ${SPIN_IMAGE_DOCKERFILE_SSR}
    networks:
      - web-public
    command: node bootstrap/ssr/ssr.js
    deploy:
      replicas: 1
      update_config:
        failure_action: rollback
        parallelism: 1
        delay: 5s
        order: start-first
      rollback_config:
        parallelism: 0
        order: stop-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 3
        window: 120s
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:13714/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  rustfs:
    image: rustfs/rustfs:latest
    environment:
      RUSTFS_ACCESS_KEY: "${RUSTFS_ACCESS_KEY}"
      RUSTFS_SECRET_KEY: "${RUSTFS_SECRET_KEY}"
      RUSTFS_VOLUMES: '/data'
      RUSTFS_ADDRESS: '0.0.0.0:9000'
      RUSTFS_CONSOLE_ADDRESS: '0.0.0.0:9001'
      RUSTFS_CONSOLE_ENABLE: 'true'
      RUSTFS_EXTERNAL_ADDRESS: ':9000'
      RUSTFS_CORS_ALLOWED_ORIGINS: '*'
      RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS: '*'
      RUSTFS_LOG_LEVEL: 'info'
      RUSTFS_OBS_LOGGER_LEVEL: 'info'
    volumes:
      - rustfs_storage:/data
    networks:
      - web-public
    deploy:
      replicas: 1
      labels:
        - traefik.enable=true

        - traefik.http.routers.rustfs.rule=Host(`storage.${SPIN_APP_DOMAIN}`)
        - traefik.http.routers.rustfs.entrypoints=websecure
        - traefik.http.routers.rustfs.tls=true
        - traefik.http.routers.rustfs.tls.certresolver=letsencryptresolver
        - traefik.http.routers.rustfs.service=rustfs
        - traefik.http.services.rustfs.loadbalancer.server.port=9000
        - traefik.http.services.rustfs.loadbalancer.server.scheme=http

        - traefik.http.routers.rustfs-console.rule=Host(`console-storage.${SPIN_APP_DOMAIN}`)
        - traefik.http.routers.rustfs-console.entrypoints=websecure
        - traefik.http.routers.rustfs-console.tls=true
        - traefik.http.routers.rustfs-console.tls.certresolver=letsencryptresolver
        - traefik.http.routers.rustfs-console.service=rustfs-console
        - traefik.http.services.rustfs-console.loadbalancer.server.port=9001
        - traefik.http.services.rustfs-console.loadbalancer.server.scheme=http

#  rustfs-bucket-init:
#    image: minio/mc:latest
#    entrypoint: >
#      /bin/sh -c "
#      sleep 10 &&
#      mc alias set rustfs http://rustfs:9000 $RUSTFS_ACCESS_KEY $RUSTFS_SECRET_KEY &&
#      mc mb rustfs/\${RUSTFS_BUCKET} --ignore-existing || true
#      "
#    environment:
#      RUSTFS_ACCESS_KEY: "${RUSTFS_ACCESS_KEY}"
#      RUSTFS_SECRET_KEY: "${RUSTFS_SECRET_KEY}"
#      RUSTFS_BUCKET: "media"
#    networks:
#      - web-public
#    deploy:
#      restart_policy:
#        condition: on-failure
#        delay: 5s
#        max_attempts: 2

configs:
  traefik:
    name: "traefik-${SPIN_MD5_HASH_TRAEFIK_YML}.yml"
    file: ./.infrastructure/conf/traefik/prod/traefik.yml
volumes:
  certificates:
  storage_private:
  storage_public:
  storage_sessions:
  storage_logs:
  postgres_data:
  postgres_shared:
  tunnel_ssh_host_keys:
  redis_data:
  rustfs_storage:
networks:
  web-public: