homelab/ansible/roles/swarm-bootstrap/templates/docker-stack.yml.j2

networks:
  gitea:
    driver: overlay
    attachable: true
    name: gitea
  traefik:
    driver: overlay
    attachable: true
    name: traefik
  portainer:
    driver: overlay
    attachable: true
    name: portainer

volumes:
  gitea:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: {{gluster_mount_path}}/swarm-bootstrap/gitea
    name: gitea
  portainer_data:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: {{gluster_mount_path}}/swarm-bootstrap/portainer
    name: portainer_data
  traefik:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: {{gluster_mount_path}}/swarm-bootstrap/traefik
    name: traefik

secrets:
  cf_dns_api_token:
    file: "{{gluster_mount_path}}/swarm-bootstrap/traefik/secrets/cf-dns-api-token.secret"

services:
  traefik:
    image: traefik:v3.3
    dns:
      - 1.1.1.1
    command:
      - "--log.level=DEBUG"
      - "--api.dashboard=true"
      # Allow invalid TLS certs internally
      - "--api.insecure=true"
      # Swarm settings
      - "--providers.swarm=true"
      - "--providers.swarm.exposedByDefault=false"
      - "--providers.swarm.endpoint=unix:///var/run/docker.sock"
      # HTTP
      - "--entrypoints.web.address=:{{traefik_listen_port}}"
      # Redirect to HTTPS
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:{{traefik_secure_listen_port}}"
      # TLS
      - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
      - "--certificatesresolvers.letsencrypt.acme.caserver={{'https://acme-v02.api.letsencrypt.org/directory' if traefik_tls_mode == 'production' else 'https://acme-staging-v02.api.letsencrypt.org/directory'}}"
      - "--certificatesresolvers.letsencrypt.acme.email={{cf_email}}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/data/letsencrypt/acme.json"
    ports:
      - "{{traefik_listen_port}}:{{traefik_listen_port}}"
      - "{{traefik_secure_listen_port}}:{{traefik_secure_listen_port}}"
      - "{{traefik_admin_port}}:8080"
    secrets:
      - "cf_dns_api_token"
    environment:
      - "CLOUDFLARE_EMAIL={{cf_email}}"
      - "CF_DNS_API_TOKEN_FILE=/run/secrets/cf_dns_api_token"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - traefik:/data
    networks:
      - traefik
    deploy:
      labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`traefik.{{app_domain_name}}`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.middlewares=auth"
      # TODO: Store this in a secret
      # It's not thaaat big of a deal cuz it's hashed anyway though.
      - "traefik.http.middlewares.auth.basicauth.users={{traefik_htpasswd}}"
      # Dummy service for Swarm port detection. The port can be any valid integer value.
      - "traefik.http.services.dummy-svc.loadbalancer.server.port=9999"
      mode: global
      placement:
        constraints: [node.role == manager]

  whoami:
    image: "traefik/whoami"
    networks:
      - traefik
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.whoami.rule=Host(`whoami.stingray.mnke.org`)"
        - "traefik.http.routers.whoami.entrypoints=websecure"
        - "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
        - "traefik.http.services.whoami.loadbalancer.server.port=80"
        - "traefik.swarm.network=traefik"

  agent:
    image: portainer/agent:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
    networks:
      - portainer
    environment:
      AGENT_SECRET: {{portainer_agent_secret}}
    deploy:
      mode: global
      placement:
        constraints: [node.platform.os == linux]

  portainer:
    image: portainer/portainer:latest
    command: "-H tcp://tasks.agent:9001 --tlsskipverify --bind :9000 --tunnel-port 8000 --admin-password {{portainer_htpasswd}}"
    ports:
      - "9000:9000"
      - "8000:8000"
    volumes:
      - portainer_data:/data
    networks:
      - portainer
      - traefik
    environment:
      # TODO: Load this in a secret
      AGENT_SECRET: {{portainer_agent_secret}}
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.portainer.rule=Host(`portainer.{{app_domain_name}}`)"
        - "traefik.http.routers.portainer.entrypoints=websecure"
        - "traefik.http.routers.portainer.tls.certresolver=letsencrypt"
        - "traefik.http.services.portainer.loadbalancer.server.port=9000"
        - "traefik.swarm.network=traefik"
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.role == manager]

  gitea:
    image: docker.io/gitea/gitea:1.23.1
    environment:
      - USER_UID={{git_user_id}}
      - USER_GID={{git_group_id}}
      - USER=git
      - GITEA_APP_NAME=mnke
      - GITEA__server__DOMAIN={{gitea_primary_domain_name}}
      - GITEA__server__ROOT_URL=https://{{gitea_primary_domain_name}}
    networks:
      - gitea
      - traefik
    volumes:
      - gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3000:3000"
      - "222:22"
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.gitea.rule=Host(`git.{{app_domain_name}}`) || Host(`{{gitea_primary_domain_name}}`)"
        - "traefik.http.routers.gitea.entrypoints=websecure"
        - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
        - "traefik.http.services.gitea.loadbalancer.server.port=3000"
        - "traefik.swarm.network=traefik"
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.role == manager]