docker-compose.yml

x-user: &user
  user: "${UID}:${GID}"
x-default: &default-env
  TZ: Asia/Bangkok
x-postgres: &postgres-env
  POSTGRES_USER: "${DB_USER}"
  POSTGRES_PASSWORD: "${DB_PASSWORD}"
x-app-env: &app-env
  NODE_ENV: "${NODE_ENV}"
  TOKEN_SECRET: "${TOKEN_SECRET}"
  APP_DOMAIN: "${APP_DOMAIN}"
x-backend-env: &backend-env
  API_PORT: "${API_PORT}"
  DB_USER: "${DB_USER}"
  DB_HOST: "${DB_HOST}"
  DB_NAME: "${DB_NAME}"
  DB_PASSWORD: "${DB_PASSWORD}"
  DB_PORT: ${DB_PORT}
x-frontend-env: &frontend-env
  NUXT_PUBLIC_BASE_API_URL: "${NUXT_PUBLIC_BASE_API_URL}"
  NUXT_TOKEN_API: "${NUXT_TOKEN_API}"
  NUXT_PUBLIC_EDITOR_TOKEN: "${NUXT_PUBLIC_EDITOR_TOKEN}"

services:
  traefik:
    image: traefik
    restart: unless-stopped
    command:
      - --ping=true
      - --ping.entryPoint=ping
      # providers docker
      - --providers.docker=true
      - --providers.docker.watch=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.defaultRule="Host(`{{ trimPrefix `/` .Name }}.docker.localhost`)"
      - --serversTransport.insecureSkipVerify=true
      - --providers.docker.network=traefik_proxy
      - --entryPoints.ping.address=:8081
      - --entrypoints.web-80.address=:80
      - --entrypoints.web-443.address=:443
      - --entrypoints.web-443.http.tls.certresolver=letsencrypt
      - --entrypoints.web-80.http.redirections.entryPoint.to=web-443
      - --entrypoints.web-80.http.redirections.entryPoint.scheme=https
      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web-80
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=info@pb.grtn.org
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
    healthcheck:
      retries: 3
      test: ["CMD", "wget", "-c", "http://localhost:8081/ping"]
      timeout: 3s
    volumes:
      - "letsencrypt-data:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - default
      - traefik_proxy
    ports:
      - "80:80"
      - "443:443/tcp"
      - "443:443/udp"

  backend:
    user: "${UID}:${GID}"
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped
    build:
      context: ./backend
      dockerfile: Dockerfile
    environment:
      <<: [*default-env, *app-env, *backend-env]
    volumes:
      - ./backend/uploads:/app/uploads
    labels:
      - traefik.enable=true
      - traefik.http.services.backend.loadbalancer.server.port=8090
      - "traefik.http.routers.backend.rule=Host(`api.${APP_DOMAIN}`)"
      - traefik.http.routers.backend.entrypoints=web-443
      - traefik.http.routers.backend.middlewares=cors-backend
      - "traefik.http.middlewares.cors-backend.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
      - "traefik.http.middlewares.cors-backend.headers.accesscontrolallowheaders=*"
      - traefik.http.middlewares.cors-backend.headers.addvaryheader=true
      - "traefik.http.middlewares.cors-backend.headers.accesscontrolalloworiginlist=*"
      - com.centurylinklabs.watchtower.enable=true
    networks:
      - traefik_proxy

  frontend:
    user: "${UID}:${GID}"
    depends_on:
      backend:
        condition: service_started
    restart: unless-stopped
    build:
      context: ./frontend
      dockerfile: Dockerfile
    environment:
      <<: [*default-env, *app-env, *frontend-env]
    labels:
      - traefik.enable=true
      - traefik.http.services.frontend.loadbalancer.server.port=3000
      - "traefik.http.routers.frontend.rule=Host(`${APP_DOMAIN}`)"
      - traefik.http.routers.frontend.entrypoints=web-443
      - traefik.http.routers.frontend.middlewares=cors-frontend
      - "traefik.http.middlewares.cors-frontend.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
      - "traefik.http.middlewares.cors-frontend.headers.accesscontrolallowheaders=*"
      - traefik.http.middlewares.cors-frontend.headers.addvaryheader=true
      - "traefik.http.middlewares.cors-frontend.headers.accesscontrolalloworiginlist=*"
      - com.centurylinklabs.watchtower.enable=true
    networks:
      - traefik_proxy

  postgres:
    image: postgres
    restart: unless-stopped
    environment:
      <<: [*default-env, *postgres-env]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - traefik_proxy
    ports:
      - 127.0.0.1:5432:5432

volumes:
  letsencrypt-data:
  postgres-data:

networks:
  traefik_proxy:
    name: traefik_proxy