docker-production.yml

version: "3.7"

#
# @link https://docs.docker.com/engine/swarm/
#

x-logging:
  &default-logging
  driver: journald

x-common:
  &default-common
  env_file:
    - ./cli/timezone.env
  networks:
    - backend
  # dns:
  #   - 114.114.114.114

x-deploy:
  &default-deploy
  restart_policy:
    condition: any
    delay: 15s
    max_attempts: 2
    window: 123s
  update_config:
    parallelism: 2
    delay: 10s
    order: stop-first

x-labels:
  &default-labels
  labels:
    - com.khs1994.lnmp=true
    - com.khs1994.lnmp.app.env=production_swarm_mode

x-build:
  &default-build
  # Dockerfile: my.Dockerfile
  args:
    ALPINE_URL: mirrors.ustc.edu.cn # dl-cdn.alpinelinux.org

x-build-debian:
  &default-build-debian
  # Dockerfile: my.Dockerfile
  args:
    DEB_URL: mirrors.ustc.edu.cn # deb.debian.org
    DEB_SECURITY_URL: mirrors.ustc.edu.cn/debian-security/ # security.debian.org

x-php-common:
  &default-php
  image: khs1994/php:7.2.11-fpm-alpine
  volumes:
    - ./app:/app
    - zoneinfo-data:/usr/share/zoneinfo
  environment:
    - APP_ENV=production
  configs:
    - source: php_ini
      target: /usr/local/etc/php/php.ini
    - source: php_fpm_conf_d_zz_docker_conf
      target: /usr/local/etc/php-fpm.d/zz-docker.conf
  secrets:
    - source: ssh_id_rsa
      target: /root/.ssh/id_rsa
      mode: 0600
    - source: ssh_config
      target: /root/.ssh/config
  depends_on:
    - mysql
    - redis
  networks:
    - backend

services:
  #
  # Swarm mode
  #
  # khs1994.com Docker Swarm mode
  #
  #
  # $ docker-compose -f docker-production.yml build
  # $ docker-compose -f docker-production.yml push
  #
  #
  # $ docker stack deploy -c docker-production.yml lnmp
  # $ docker stack ps lnmp
  #
  #
  # 1. less `volumes`
  # 2. config put `configs`
  # 3. secrets put `secrets`
  # 4. use log driver journald
  #
  #
  # 1. `docker stack deploy` not support env
  #
  #
  # Don't edit this file
  #
  # $ cp docker-production.yml docker-production.khs1994.yml
  #
  # Then Edit `docker-production.*.yml`
  #

  mysql:
    << : *default-common
    << : *default-labels
    build:
      << : *default-build-debian
      context: ./dockerfile/mysql/
      dockerfile: Dockerfile
    #
    # image: username/lnmp-mysql:tag
    #
    # image: khs1994/lnmp-mysql:8.0.13
    #
    image: mysql:8.0.13
    environment:
      # MYSQL_ROOT_PASSWORD: mytest
      MYSQL_ROOT_PASSWORD_FILE: /etc/db_root_password
      MYSQL_DATABASE: test
    # ports:
    #   - "127.0.0.1:3306:3306"
    volumes:
      - ./backup/init.production:/docker-entrypoint-initdb.d:ro
      - ./backup/mysql:/backup
      - mysql-data:/var/lib/mysql
    command: ["mysqld","--character-set-server=utf8mb4","--default-authentication-plugin=mysql_native_password"]
    # logging: *default-logging
    deploy:
      << : *default-deploy
      << : *default-labels
      placement:
        constraints: [node.role == manager]
      # resources:
      #   limits:
      #     cpus: '0.50'
      #     memory: 50M
      #   reservations:
      #     cpus: '0.25'
      #     memory: 20M
    secrets:
      - source: db_root_password
        target: /etc/db_root_password
    configs:
      - source: mysql_conf_d_docker_cnf
        target: /etc/mysql/conf.d/docker.cnf

  # mariadb:
  #   << : *default-common
  #   << : *default-labels
  #   build:
  #     << : *default-build-debian
  #     context: ./dockerfile/mariadb/
  #     dockerfile: Dockerfile
  #   #
  #   # image: username/lnmp-mariadb:tag
  #   #
  #   # image: khs1994/lnmp-mariadb:10.3.10
  #   #
  #   image: "mariadb:10.3.10"
  #   environment:
  #     MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
  #     MYSQL_DATABASE: test
  #     # MYSQL_USER:
  #     # MYSQL_PASSWORD:
  #   # ports:
  #   #   - "127.0.0.1:3306:3306"
  #   volumes:
  #     # https://github.com/docker-library/docs/tree/master/mariadb#initializing-a-fresh-instance
  #     - ./backup/init.production:/docker-entrypoint-initdb.d:ro
  #     - mariadb-data:/var/lib/mysql
  #     - ./backup/mariadb:/backup
  #   command:
  #     - mysqld
  #     - --character-set-server=utf8mb4
  #   deploy:
  #     << : *default-deploy
  #     << : *default-labels
  #     placement:
  #       constraints: [node.role == manager]
  #   # logging: *default-logging
  #   secrets:
  #     - db_root_password
  #   configs:
  #     - source: mariadb_conf_d_docker_cnf
  #       target: /etc/mysql/conf.d/docker.cnf

  redis:
    << : *default-common
    << : *default-labels
    build:
      << : *default-build
      # << : *default-build-debian
      context: ./dockerfile/redis/
      dockerfile: Dockerfile
    #
    # image: username/lnmp-redis:tag
    #
    # image: khs1994/lnmp-redis:5.0.0
    #
    image: redis:5.0.0-alpine
    # ports:
    #   - "127.0.0.1:6379:6379"
    volumes:
      - redis-data:/data
    command: [
      "redis-server",
      "/redis.conf",
      "--daemonize no",
      "--bind 0.0.0.0",
      "--appendonly yes",
      # "--save \"\"",
      "--aof-use-rdb-preamble yes"
      ]
    # logging: *default-logging
    deploy:
      << : *default-deploy
      << : *default-labels
      # replicas: 2
      placement:
        constraints: [node.role == manager]
    configs:
      - source: redis_conf
        target: /redis.conf

  # memcached:
  #   << : *default-common
  #   << : *default-labels
  #   build:
  #     << : *default-build
  #     # << : *default-build-debian
  #     context: ./dockerfile/memcached/
  #     dockerfile: Dockerfile
  #   #
  #   # image: username/lnmp-memcached:tag
  #   #
  #   # image: khs1994/lnmp-memcached:1.5.7
  #   #
  #   image: memcached:1.5.7-alpine
  #   # ports:
  #   #   - "127.0.0.1:11211:11211"
  #   volumes:
  #     - zoneinfo-data:/usr/share/zoneinfo
  #   deploy:
  #     << : *default-deploy
  #     << : *default-labels
  #     placement:
  #       constraints: [node.role == manager]
  #   # logging: *default-logging

  # rabbitmq:
  #   << : *default-common
  #   << : *default-labels
  #   build:
  #     << : *default-build
  #     # << : *default-build-debian
  #     context: ./dockerfile/rabbitmq/
  #     dockerfile: Dockerfile
  #   #
  #   # image: username/lnmp-rabbitmq:tag
  #   #
  #   # image: khs1994/lnmp-rabbitmq:3.7.3
  #   #
  #   image: rabbitmq:3.7.3-management-alpine
  #   volumes:
  #     - rabbitmq-data:/var/lib/rabbitmq
  #     - zoneinfo-data:/usr/share/zoneinfo
  #   # ports:
  #   #   - "127.0.0.1:15672:15672"
  #   #   - "127.0.0.1:5672:5672"
  #   deploy:
  #     << : *default-deploy
  #     << : *default-labels
  #     placement:
  #       constraints: [node.role == manager]
  #   # logging: *default-logging

  # postgresql:
  #   << : *default-common
  #   << : *default-labels
  #   build:
  #     << : *default-build
  #     # << : *default-build-debian
  #     context: ./dockerfile/postgresql/
  #     dockerfile: Dockerfile
  #   #
  #   # image: username/lnmp-postgresql:tag
  #   #
  #   # image: khs1994/lnmp-postgresql:11.0
  #   #
  #   image: postgres:11.0-alpine
  #   environment:
  #     - POSTGRES_PASSWORD_FILE=/run/secrets/db_root_password
  #     - POSTGRES_DB=test
  #   volumes:
  #     - zoneinfo-data:/usr/share/zoneinfo
  #     - postgresql-data:/var/lib/postgresql/data
  #   # ports:
  #   #   - "127.0.0.1:5432:5432"
  #   deploy:
  #     << : *default-deploy
  #     << : *default-labels
  #     placement:
  #       constraints: [node.role == manager]
  #   # logging: *default-logging
  #   secrets:
  #     # default is mysql password
  #     - db_root_password

  # mongodb:
  #   << : *default-common
  #   << : *default-labels
  #   build:
  #     << : *default-build-debian
  #     context: ./dockerfile/mongodb/
  #     dockerfile: Dockerfile
  #   #
  #   # image: username/lnmp-mongodb:tag
  #   #
  #   # image: khs1994/lnmp-mongodb:4.1.4
  #   #
  #   image: mongo:4.1.4
  #   volumes:
  #     # - ./config/mongodb/mongod.conf:/etc/mongod.conf:ro
  #     - mongodb-data:/data/db
  #   deploy:
  #     << : *default-deploy
  #     << : *default-labels
  #     placement:
  #       constraints: [node.role == manager]
  #   # logging: *default-logging
  #   # ports:
  #   #    - "127.0.0.1:27017:27017"
  #   command: ["mongod","--config","/etc/mongod.conf"]
  #   configs:
  #     - source: mongod_conf
  #       target: /etc/mongod.conf

  pcit:
    << : *default-common
    << : *default-labels
    << : *default-php
    image: khs1994/pcit:alpine
    volumes:
      - ./pcit/.env.production:/app/pcit/.env.production
      - ./pcit/key:/app/pcit/framework/storage/private_key
      - pcit-tmp:/tmp
      - zoneinfo-data:/usr/share/zoneinfo
    working_dir: /app/pcit/bin
    command:
      - /bin/sh
      - pcitd
      - up
    # logging: *default-logging
    deploy:
      << : *default-deploy
      << : *default-labels
      # replicas: 2
      placement:
        constraints: [node.role == manager]
      resources:
        limits:
          cpus: '0.50'
          memory: 50M
        reservations:
          cpus: '0.25'
          memory: 20M

  php7:
    << : *default-common
    << : *default-labels
    << : *default-php
    build:
      << : *default-build
      # << : *default-build-debian
      # context: ./dockerfile/php/
      context: ./app/demo/
      dockerfile: Dockerfile
      # args:
      #   foo: bar
      # cache_from:
      #   - alpine:3.7
    command: php-fpm -R -F
    networks:
      - frontend
      - backend
    environment:
      - APP_ENV=production
      - LNMP_DOCKER_VERSION=v18.06.06 x86_64 Docker Swarm
    # logging: *default-logging
    deploy:
      << : *default-deploy
      << : *default-labels
      # replicas: 2
      placement:
        constraints: [node.role == manager]

  # php7-laravel-queue:
  #   << : *default-common
  #   << : *default-labels
  #   << : *default-php
  #   command:
  #     - php
  #     - /app/laravel/artisan
  #     - queue:work
  #     - --tries=3
  #   # logging: *default-logging
  #   deploy:
  #     << : *default-deploy
  #     << : *default-labels
  #     replicas: 1
  #     placement:
  #       constraints: [node.role == manager]

  nginx:
    << : *default-common
    << : *default-labels
    build:
      << : *default-build
      # << : *default-build-debian
      # context: ./dockerfile/nginx/
      context: ./config/nginx
      dockerfile: Dockerfile
    #
    # image: username/lnmp-nginx:tag
    #
    # image: khs1994/lnmp-nginx:1.15.6
    #
    image: khs1994/nginx:1.15.6-alpine
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ./app:/app
      # - ./config/nginx:/etc/nginx/conf.d:ro
    networks:
      - frontend
    depends_on:
      - php7
      - minio
    # logging: *default-logging
    deploy:
      << : *default-deploy
      << : *default-labels
      # replicas: 2
      placement:
        constraints: [node.role == manager]
    configs:
      - source: nginx_conf
        target: /etc/nginx/nginx.conf
        # uid: '103'
        # gid: '103'
        # mode: 0440
      #
      # one domain one conf file
      #
      - source: nginx_80_conf
        target: /etc/nginx/conf.d/80.conf
      - source: nginx_301_conf
        target: /etc/nginx/conf.d/301.conf
      - source: nginx_ssl_conf
        target: /etc/nginx/conf.d/ssl.config
      - source: nginx_khs1994_com_conf
        target: /etc/nginx/conf.d/khs1994.com.conf
      #
      #
      # Example Don't Edit
      #
      #
      # - source: nginx_domain_com_conf
      #   target: /etc/nginx/conf.d/domain.com.conf
    secrets:
      #
      # ECC + RSA
      #
      # @link https://github.com/khs1994-docker/lnmp/issues/239
      #
      - source: khs1994_com_ssl_crt
        target: /etc/nginx/conf.d/ssl/khs1994.com.crt
      - source: khs1994_com_ssl_key
        target: /etc/nginx/conf.d/ssl/khs1994.com.key
      - source: khs1994_com_ssl_rsa_crt
        target: /etc/nginx/conf.d/ssl/khs1994.com.rsa.crt
      - source: khs1994_com_ssl_rsa_key
        target: /etc/nginx/conf.d/ssl/khs1994.com.rsa.key
      # - source: developer_khs1994_com_ssl_crt
      #   target: /etc/nginx/conf.d/ssl/developer.khs1994.com.crt
      # - source: developer_khs1994_com_ssl_key
      #   target: /etc/nginx/conf.d/ssl/developer.khs1994.com.key
      # - source: developer_khs1994_com_ssl_rsa_crt
      #   target: /etc/nginx/conf.d/ssl/developer.khs1994.com.rsa.crt
      # - source: developer_khs1994_com_ssl_rsa_key
      #   target: /etc/nginx/conf.d/ssl/developer.khs1994.com.rsa.key
      #
      #
      # - source: auth_htpasswd
      #   target: /etc/nginx/conf.d/auth/nginx.htpasswd
      #
      #
      # Example Don't Edit
      #
      #
      #  ECC + RSA
      #
      #
      # - source: domain_com_ssl_crt
      #   target: /etc/nginx/conf.d/ssl/domain.com.crt
      # - source: domain_com_ssl_key
      #   target: /etc/nginx/conf.d/ssl/domain.com.key
      # - source: domain_com_ssl_rsa_crt
      #   target: /etc/nginx/conf.d/ssl/domain.com.rsa.crt
      # - source: domain_com_ssl_rsa.key
      #   target: /etc/nginx/conf.d/ssl/domain.com.rsa.key
    # healthcheck:
    #   test: ["CMD", "curl", "-f", "http://localhost"]
    #   interval: 1m30s
    #   timeout: 10s
    #   retries: 3
    #   start_period: 40s

  # httpd:
  #   << : *default-common
  #   << : *default-labels
  #   build:
  #     << : *default-build
  #     # << : *default-build-debian
  #     context: ./config/httpd
  #     dockerfile: Dockerfile
  #   #
  #   # image: username/lnmp-httpd:tag
  #   #
  #   # image: khs1994/lnmp-httpd:2.4.37
  #   #
  #   image: "httpd:2.4.37-alpine"
  #   ports:
  #     - "443:443"
  #     - "80:80"
  #   volumes:
  #     - ./app:/app
  #     # - ./config/etc/httpd/httpd.conf:/usr/local/apache2/conf/httpd.conf
  #     # - ./config/httpd:/usr/local/apache2/conf.d
  #     - zoneinfo-data:/usr/share/zoneinfo
  #   working_dir: /app
  #   networks:
  #     - frontend
  #   depends_on:
  #     - php7
  #   # logging: *default-logging
  #   deploy:
  #     << : *default-deploy
  #     << : *default-labels
  #     placement:
  #       constraints: [node.role == manager]
  #   configs:
  #     - source: httpd_conf
  #       target: /usr/local/apache2/conf/httpd.conf
  #     - source: vhost_khs1994_com_conf
  #       target: /usr/local/apache2/conf.d/vhost.khs1994.com.conf
  #     #
  #     #
  #     # Example Don't Edit
  #     #
  #     #
  #     # - source: vhost_domain_com_conf
  #     #   target: /usr/local/apache2/conf.d/vhost.domain.com.conf
  #   secrets:
  #     - source: khs1994_com_ssl_crt
  #       target: /usr/local/apache2/conf.d/ssl/khs1994.com.crt
  #     - source: khs1994_com_ssl_key
  #       target: /usr/local/apache2/conf.d/ssl/khs1994.com.key
  #     - source: developer_khs1994_com_ssl_crt
  #       target: /usr/local/apache2/conf.d/ssl/developer.khs1994.com.crt
  #     - source: developer_khs1994_com_ssl_key
  #       target: /usr/local/apache2/conf.d/ssl/developer.khs1994.com.key
  #     #
  #     #
  #     # Example Don’t Edit
  #     #
  #     #
  #     # - source: domain_com_ssl_crt
  #     #   target: /usr/local/apache2/conf.d/ssl/domain.com.crt
  #     # - source: domain_com_ssl_key
  #     #   target: /usr/local/apache2/conf.d/ssl/domain.com.key

  # registry:
  #   << : *default-common
  #   << : *default-labels
  #   build:
  #     << : *default-build
  #     # << : *default-build-debian
  #     context: ./config/registry
  #     dockerfile: Dockerfile
  #   #
  #   # image: username/lnmp-registry:tag
  #   #
  #   # image: khs1994/lnmp-registry:latest
  #   #
  #   image: registry:latest
  #   networks:
  #     - frontend
  #     - backend
  #   # ports:
  #   #   - "127.0.0.1:5000:5000"
  #   volumes:
  #     # - ./config/registry:/etc/docker/registry
  #     - registry-data:/var/lib/registry
  #   deploy:
  #     << : *default-deploy
  #     << : *default-labels
  #     placement:
  #       constraints: [node.role == manager]
  #   # logging: *default-logging
  #   configs:
  #     - source: registy_yml
  #       target: /etc/docker/registry/config.yml

  minio:
    << : *default-common
    << : *default-labels
    image: minio/minio:RELEASE.2018-10-18T00-28-58Z
    command:
      - server
      - /data
    environment:
      MINIO_ACCESS_KEY_FILE: miniokey
      MINIO_SECRET_KEY_FILE: miniosecret
      MINIO_REGION: ${MINIO_REGION:-''}
      MINIO_BROWSER: ${MINIO_BROWSER:-on}
      MINIO_WORM: ${MINIO_WORM:-off}
      MINIO_DOMAIN: ${MINIO_DOMAIN:-''}
    networks:
      - backend
      - frontend
    volumes:
      - minio-data:/data
    secrets:
      - miniokey
      - miniosecret

networks:
  frontend:
    << : *default-labels

  backend:
    << : *default-labels


volumes:
  mysql-data:
    << : *default-labels

  # mariadb-data:
  #   << : *default-labels

  redis-data:
    << : *default-labels

  # rabbitmq-data:
  #   << : *default-labels
  #
  # postgresql-data:
  #   << : *default-labels
  #
  # mongodb-data:
  #   << : *default-labels

  zoneinfo-data:
    << : *default-labels
  # registry-data:
  #   << : *default-labels

  pcit-tmp:
    << : *default-labels

  minio-data:
    << : *default-labels

secrets:
  db_root_password:
    << : *default-labels
    file: secrets/db_root_password.txt

  #
  #
  # ECC + RSA
  #
  #

  khs1994_com_ssl_key:
    << : *default-labels
    file: ./config/nginx/ssl/khs1994.com.key

  khs1994_com_ssl_crt:
    << : *default-labels
    file: ./config/nginx/ssl/khs1994.com.crt

  khs1994_com_ssl_rsa_key:
    << : *default-labels
    file: ./config/nginx/ssl/khs1994.com.rsa.key

  khs1994_com_ssl_rsa_crt:
    << : *default-labels
    file: ./config/nginx/ssl/khs1994.com.rsa.crt

  #
  # developer_khs1994_com_ssl_crt:
  #   file: ./config/nginx/ssl/developer.khs1994.com.crt
  #   << : *default-labels
  #
  # developer_khs1994_com_ssl_key:
  #   file: ./config/nginx/ssl/developer.khs1994.com.key
  #   << : *default-labels
  #
  # developer_khs1994_com_ssl_rsa_crt:
  #   file: ./config/nginx/ssl/developer.khs1994.com.rsa.crt
  #   << : *default-labels
  #
  # developer_khs1994_com_ssl_rsa_key:
  #   file: ./config/nginx/ssl/developer.khs1994.com.rsa.key
  #   << : *default-labels
  #
  #
  # auth_htpasswd:
  #   file: ./config/nginx/auth/nginx.htpasswd
  #   << : *default-labels
  #
  #
  # Example Don't Edit
  #
  #
  # domain_com_ssl_key:
  #   file: ./config/nginx/ssl/domain.com.key
  #   << : *default-labels
  #
  # domain_com_ssl_crt:
  #   file: ./config/nginx/ssl/domain.com.crt
  #   << : *default-labels
  #
  # domain_com_ssl_key:
  #   file: ./config/nginx/ssl/domain.com.key
  #   << : *default-labels
  #
  # domain_com_ssl_crt:
  #   file: ./config/nginx/ssl/domain.com.crt
  #   << : *default-labels
  #
  # SSH use in  CI/CD
  #
  #
  ssh_id_rsa:
    file: /root/.ssh/id_rsa
    << : *default-labels

  #
  # SSH config
  #
  ssh_config:
    file: ./secrets/ssh_config
    << : *default-labels

  miniokey:
    file: ./secrets/minio/key.txt
    << : *default-labels
  miniosecret:
    file: ./secrets/minio/secret.txt
    << : *default-labels

configs:
  mysql_conf_d_docker_cnf:
    file: ./config/mysql/docker.production.cnf
    << : *default-labels

  # mariadb_conf_d_docker_cnf:
  #   file: ./config/mariadb/docker.production.cnf
  #   << : *default-labels

  nginx_conf:
    file: ./config/etc/nginx/nginx.production.conf
    << : *default-labels

  nginx_80_conf:
    file: ./config/nginx/80.conf
    << : *default-labels

  nginx_301_conf:
    file: ./config/nginx/301.conf
    << : *default-labels

  nginx_ssl_conf:
    file: ./config/nginx/ssl.config
    << : *default-labels

  nginx_khs1994_com_conf:
    file: ./config/nginx/khs1994.com.conf
    << : *default-labels
  #
  #
  # NGINX Example Don't Edit
  #
  #
  # nginx_domain_com_conf:
  #   file ./config/nginx/domain.com.conf
  #   << : *default-labels
  #
  #
  #
  # httpd_conf:
  #   file: ./config/etc/httpd/httpd.production.conf
  #   << : *default-labels
  #
  #
  #
  # vhost_khs1994_com_conf:
  #   file: ./config/httpd/khs1994.com.conf
  #   << : *default-labels
  #
  #
  # Apache Example Don't Edit
  #
  #
  # vhost_domain_com_conf:
  #   file: ./config/httpd/domain.com.conf
  #   << : *default-labels


  php_ini:
    file: ./config/php/php.production.ini
    << : *default-labels

  php_development_ini:
    file: ./config/php/php.development.ini
    << : *default-labels

  php_ini_error_log:
    file: ./config/php/docker-error-log.ini
    << : *default-labels

  php_fpm_conf_d_zz_docker_conf:
    file: ./config/php/zz-docker.production.conf
    << : *default-labels

  redis_conf:
    file: ./config/redis/redis.production.conf
    << : *default-labels

  # mongod_conf:
  #   file: ./config/mongodb/mongod.production.conf
  #   << : *default-labels
  #
  # registy_yml:
  #   file: ./config/registry/config.production.yml
  #   << : *default-labels