compose.prod.yml

# Production template
# Replace “my-registry/roadiz_skeleton” with your own project registry URL
name: ${APP_NAMESPACE}
services:
    db:
        image: my-registry/roadiz_skeleton/api-mariadb:${DEPLOY_TAG}
        restart: always
        cap_add:
            - SYS_NICE  # CAP_SYS_NICE
        networks:
            default:
        volumes:
            - db_data:/var/lib/mysql
        environment:
            MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
            MARIADB_DATABASE: ${MARIADB_DATABASE}
            MARIADB_USER: ${MARIADB_USER}
            MARIADB_PASSWORD: ${MARIADB_PASSWORD}

    # Use Redis for Cache, Messaging and Sessions
    redis:
        image: redis:7-alpine
        mem_limit: 256m
        restart: always
        volumes:
            - redis:/data
        networks:
            - default

    varnish:
        image: my-registry/roadiz_skeleton/api-varnish:${DEPLOY_TAG}
        restart: always
        # https://github.com/varnish/docker-varnish/issues/53
        user: root
        # Prevent cache-tags to overflow headers max size
        # https://github.com/api-platform/core/issues/3168
        # https://www.varnish-software.com/developers/tutorials/troubleshooting-varnish/
        command: "-p http_resp_hdr_len=16384 -p http_resp_size=65536"
        ulimits:
            memlock: -1
        tmpfs: /var/lib/varnish/varnishd:exec
        depends_on:
            - nginx
        links:
            - nginx:nginx
        environment:
            VARNISH_SIZE: ${VARNISH_SIZE}
        networks:
            - frontproxynet
            - default
        labels:
            # Traefik v3 -----------------------------------------------------
            - "traefik.enable=true"
            - "traefik.http.services.${APP_NAMESPACE}.loadbalancer.server.scheme=http"
            - "traefik.http.services.${APP_NAMESPACE}.loadbalancer.server.port=80"
            - "traefik.http.services.${APP_NAMESPACE}.loadbalancer.passhostheader=true"
            # HTTP Router for API documentation only (htpasswd)
            - "traefik.http.routers.${APP_NAMESPACE}-api-docs.rule=HostRegexp(${HOSTNAME}) && PathPrefix(`/api/docs`)"
            - "traefik.http.routers.${APP_NAMESPACE}-api-docs.priority=13"
            - "traefik.http.routers.${APP_NAMESPACE}-api-docs.tls=true"
            - "traefik.http.routers.${APP_NAMESPACE}-api-docs.tls.certresolver=letsencrypt"
            - "traefik.http.routers.${APP_NAMESPACE}-api-docs.tls.domains[0].main=project-name.fr"
            - "traefik.http.routers.${APP_NAMESPACE}-api-docs.tls.domains[0].sans=www.project-name.fr,project-name.com,www.project-name.com"
            - "traefik.http.routers.${APP_NAMESPACE}-api-docs.service=${APP_NAMESPACE}"
            - "traefik.http.routers.${APP_NAMESPACE}-api-docs.middlewares=${APP_NAMESPACE}-redirectregex,${APP_NAMESPACE}-sts,${APP_NAMESPACE}-docs-auth"
            # HTTP Router for Backend only (no htpasswd)
            - "traefik.http.routers.${APP_NAMESPACE}-api.rule=HostRegexp(${HOSTNAME}) && PathRegexp(${PATH_PREFIX})"
            - "traefik.http.routers.${APP_NAMESPACE}-api.priority=12"
            - "traefik.http.routers.${APP_NAMESPACE}-api.tls=true"
            - "traefik.http.routers.${APP_NAMESPACE}-api.tls.certresolver=letsencrypt"
            - "traefik.http.routers.${APP_NAMESPACE}-api.tls.domains[0].main=project-name.fr"
            - "traefik.http.routers.${APP_NAMESPACE}-api.tls.domains[0].sans=www.project-name.fr,project-name.com,www.project-name.com"
            - "traefik.http.routers.${APP_NAMESPACE}-api.service=${APP_NAMESPACE}"
            - "traefik.http.routers.${APP_NAMESPACE}-api.middlewares=${APP_NAMESPACE}-redirectregex,${APP_NAMESPACE}-sts"
            ## Middlewares
            # Added htpasswd protection on docs router: use htpasswd -n to create a password
            - "traefik.http.middlewares.${APP_NAMESPACE}-docs-auth.basicauth.users=${API_DOCS_BASIC_AUTH}"
            # Add domain redirection (${APP_NAMESPACE} non-www to www redir)
            - "traefik.http.middlewares.${APP_NAMESPACE}-redirectregex.redirectregex.regex=${REDIRECT_REGEX}"
            - "traefik.http.middlewares.${APP_NAMESPACE}-redirectregex.redirectregex.replacement=${REDIRECT_REPLACEMENT}"
            - "traefik.http.middlewares.${APP_NAMESPACE}-redirectregex.redirectregex.permanent=true"
            # HSTS headers
            - "traefik.http.middlewares.${APP_NAMESPACE}-sts.headers.stsincludesubdomains=false"
            - "traefik.http.middlewares.${APP_NAMESPACE}-sts.headers.stspreload=true"
            - "traefik.http.middlewares.${APP_NAMESPACE}-sts.headers.stsseconds=31536000"
            - "traefik.http.middlewares.${APP_NAMESPACE}-sts.headers.isdevelopment=false"

    nginx:
        image: my-registry/roadiz_skeleton/api-nginx:${DEPLOY_TAG}
        restart: always
        depends_on:
            - app
        # Nginx does not resolve `app` hostname correctly
        links:
            - app:app
        networks:
            - default
        volumes:
            #- ./robots.txt:/app/public/robots.txt:ro
            - app_file_data:/app/public/files:ro
            - app_assets_data:/app/public/assets:ro

    app: &app_template
        image: my-registry/roadiz_skeleton/api-php:${DEPLOY_TAG}
        restart: always
        depends_on:
            - db
            - redis
        volumes:
            - app_file_data:/app/public/files
            - app_assets_data:/app/public/assets
            - app_private_file_data:/app/var/files
            - app_secret_data:/app/config/secrets
            - app_jwt_data:/app/config/jwt
            ## Use docker-compose env file as .env.local in container or use env vars
            - ./.env:/app/.env.prod.local:ro
        networks:
            - default
        environment:
            # Can only override env in docker environment
            # because these are hardcoded in Docker image definition
            APP_ENV: prod
            APP_RUNTIME_ENV: prod
            APP_DEBUG: 0

    migrate:
        <<: *app_template
        mem_limit: 1g
        networks:
            - default
        depends_on:
            - db
            - redis
        entrypoint: 'docker-migrate-entrypoint'
        restart: no

    worker:
        <<: *app_template
        mem_limit: 1g
        stop_signal: SIGTERM
        networks:
            - default
        entrypoint: [ "php", "-d", "memory_limit=-1", "/app/bin/console", "messenger:consume", "async", "--time-limit=1800" ]
        restart: always

    scheduler:
        <<: *app_template
        mem_limit: 512m
        stop_signal: SIGTERM
        networks:
            - default
        entrypoint: [ "php", "-d", "memory_limit=-1", "/app/bin/console", "messenger:consume", "scheduler_default", "--time-limit=1800" ]
        restart: always

    # RESTIC incremental backup services
    restic:
        # Keep the same hostname for all Restic services
        hostname: restic-api-backup
        image: restic/restic:latest
        networks:
            - default
        environment:
            AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
            AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
            S3_STORAGE_CLASS: ${S3_STORAGE_CLASS}
            RESTIC_REPOSITORY: ${RESTIC_REPOSITORY}
            RESTIC_PASSWORD: ${RESTIC_PASSWORD}
        volumes:
            # If no restore needed, this volume should remain read-only
            - app_file_data:/srv/public/files:ro
            - app_assets_data:/srv/public/assets:ro
            - app_private_file_data:/srv/var/files:ro
            - restic_cache:/root/.cache/restic
    backup_files:
        # Keep the same hostname for all Restic services
        extends:
            service: restic
        command: 'backup -o s3.storage-class=${S3_STORAGE_CLASS} --tag files /srv'
    backup_mysql:
        # Keep the same hostname for all Restic services
        hostname: restic-api-backup
        image: ambroisemaupate/restic-database
        environment:
            AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
            AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
            S3_STORAGE_CLASS: ${S3_STORAGE_CLASS}
            RESTIC_REPOSITORY: ${RESTIC_REPOSITORY}
            RESTIC_PASSWORD: ${RESTIC_PASSWORD}
            # MySQL credentials
            MYSQL_HOST: db
            MYSQL_DATABASE: ${MARIADB_DATABASE}
            MYSQL_PASSWORD: ${MARIADB_PASSWORD}
            MYSQL_USER: ${MARIADB_USER}
            MYSQL_DUMP_FILENAME: ${MYSQL_DUMP_FILENAME}
        volumes:
            - restic_cache:/root/.cache/restic
        depends_on:
            - db
        command: 'backup -o s3.storage-class=${S3_STORAGE_CLASS} --tag db ${MYSQL_DUMP_FILENAME}'
    forget:
        extends:
            service: restic
        # Forget all snapshots older than 7 days and keep 12 monthly snapshots
        command: 'forget -o s3.storage-class=${S3_STORAGE_CLASS} --keep-daily 7 --keep-monthly 12 --prune'


volumes:
    app_file_data:
    app_assets_data:
    app_private_file_data:
    app_secret_data:
    app_jwt_data:
    redis:
    restic_cache:
    db_data:

networks:
    frontproxynet:
        external: true
    default:
        ipam:
            driver: default
            config:
                -   subnet: ${DEFAULT_GATEWAY}/24