devops-exercise/docker-compose.yml at master · james64/devops-exercise · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
version: '3.7'

services:
  traefik:
    image: traefik:v2.2
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.services.wtf.loadbalancer.server.port=80"
    command:
      - "--accesslog=true"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.swarmMode=true"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      # tls
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.email=jakub.dubovsky@seznam.cz"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.myresolver.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.myresolver.acme.dnschallenge=true"
      - "--certificatesresolvers.myresolver.acme.dnschallenge.provider=digitalocean"
      - "--certificatesresolvers.myresolver.acme.dnschallenge.delaybeforecheck=0"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    environment:
      - "DO_AUTH_TOKEN_FILE=/mnt/nfs-data/digitalocean"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/mnt/nfs-data/letsencrypt:/letsencrypt:z"
      - "/mnt/nfs-data/digitalocean:/mnt/nfs-data/digitalocean:ro"
    networks:
      - net1

  whoami:
    image: "containous/whoami"
    networks:
      - net1
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.services.whoami.loadbalancer.server.port=80"
        - "traefik.http.middlewares.http_redirect.redirectscheme.scheme=https"
        # http
        - "traefik.http.routers.whoami.rule=Host(`whoami.dubovsky.devops.klikuj.cz`)"
        - "traefik.http.routers.whoami.middlewares=http_redirect"
        #- "traefik.http.routers.whoami.entrypoints=web"
        # tls
        - "traefik.http.routers.whoami-sec.rule=Host(`whoami.dubovsky.devops.klikuj.cz`)"
        - "traefik.http.routers.whoami-sec.entrypoints=websecure"
        - "traefik.http.routers.whoami-sec.tls=true"
        - "traefik.http.routers.whoami-sec.tls.certresolver=myresolver"
        - "traefik.http.routers.whoami-sec.tls.domains[0].main=dubovsky.devops.klikuj.cz"
        - "traefik.http.routers.whoami-sec.tls.domains[0].sans=*.dubovsky.devops.klikuj.cz"

  gitlab:
    image: gitlab/gitlab-ce:latest
    networks:
      - net1
    volumes:
      - "/var/opt/gitlab/data:/var/opt/gitlab"
      - "/var/opt/gitlab/logs:/var/log/gitlab"
      - "/var/opt/gitlab/config:/etc/gitlab"
    environment:
      GITLAB_OMNIBUS_CONFIG: "from_file('/omnibus_config.rb')"
    configs:
      - source: gitlab
        target: /omnibus_config.rb
    secrets:
      - gitlab_root_password
    deploy:
      placement:
        constraints:
          - "node.hostname==jakub-dubovsky-large"
      labels:
        - "traefik.enable=true"
        - "traefik.http.services.gitlab.loadbalancer.server.port=80"
        - "traefik.http.middlewares.http_redirect.redirectscheme.scheme=https"
        # http
        - "traefik.http.routers.gitlab.rule=Host(`gitlab.dubovsky.devops.klikuj.cz`)"
        - "traefik.http.routers.gitlab.middlewares=http_redirect"
        #- "traefik.http.routers.gitlab.entrypoints=web"
        # tls
        - "traefik.http.routers.gitlab-sec.rule=Host(`gitlab.dubovsky.devops.klikuj.cz`)"
        - "traefik.http.routers.gitlab-sec.entrypoints=websecure"
        - "traefik.http.routers.gitlab-sec.tls=true"
        - "traefik.http.routers.gitlab-sec.tls.certresolver=myresolver"
        - "traefik.http.routers.gitlab-sec.tls.domains[0].main=dubovsky.devops.klikuj.cz"
        - "traefik.http.routers.gitlab-sec.tls.domains[0].sans=*.dubovsky.devops.klikuj.cz"

networks:
  net1:
    driver: overlay
    attachable: true

configs:
  gitlab:
    file: ./gitlab.rb

secrets:
  gitlab_root_password:
    file: ./gitlab_root_password