stack-prod.yml

version: '3.8'
services:

  # Wordpress
  srv:
    image: <%= $(bin/get image --tag) %>

    deploy:
      mode: global

      # On a single-node swarm, allow this service on the manager node
      # On a multi-node swarm, only allow this service to worker nodes
      <% if [ "$(bin/get nodes|wc -w)" != "1" ]; then %>
      placement:
        constraints: [node.role == worker]
      <% fi %>

      resources:
        limits:
          cpus: '1.5'
          memory: 800M

      update_config:
        order: start-first
        failure_action: rollback
        parallelism: 1
        delay: 5s

      rollback_config:
        order: start-first
        failure_action: pause
        parallelism: 1

      labels:
        traefik.enable: "true"
        traefik.docker.network: "proxy"

        <% ROUTER="$(bin/get app)" -%>
        <% SERVICE="$(bin/get app)" -%>
        <% MIDDLE="$(bin/get app)-basicauth" %>
        <% CSP="$(bin/get app)-csp" %>
        # Password-protected staging production host 
        traefik.http.routers.<%= $ROUTER -%>.entrypoints: "websecure"
        traefik.http.routers.<%= $ROUTER -%>.rule: "Host(`<%= $(bin/get host) -%>`)"
        traefik.http.routers.<%= $ROUTER -%>.tls.certresolver: "resolver-dns"
        traefik.http.routers.<%= $ROUTER -%>.tls.domains[0].main: "<%= $(bin/get swarm) %>"
        traefik.http.routers.<%= $ROUTER -%>.tls.domains[0].sans: "*.<%= $(bin/get swarm) %>"
        traefik.http.routers.<%= $ROUTER -%>.middlewares: "<%= $MIDDLE %>@docker"
        traefik.http.routers.<%= $ROUTER -%>.middlewares: "<%= $MIDDLE %>@docker,<%= $CSP %>@docker"
        traefik.http.services.<%= $SERVICE -%>.loadbalancer.server.port: "443"
        traefik.http.services.<%= $SERVICE -%>.loadbalancer.server.scheme: "https"
        # traefik.http.services.<%= $SERVICE -%>.loadbalancer.sticky.cookie: "true"
        # traefik.http.services.<%= $SERVICE -%>.loadbalancer.sticky.cookie.name: "<%= $SERVICE -%>_sticky"
        traefik.http.middlewares.<%= $MIDDLE -%>.basicauth.users: "<%= $(bin/get basic_auth $(bin/get host_user) $(bin/get host_password)) %>"
        traefik.http.middlewares.<%= $MIDDLE -%>.basicauth.realm: "<%= $(bin/get app) %>"
        traefik.http.middlewares.<%= $CSP -%>.headers.customResponseHeaders.Content-Security-Policy: "frame-ancestors 'self'"

        # Set these when ready to launch
        # MAIN_DOMAIN="example.com"
        # SANS_DOMAIN="www.example.com"
        <% MAIN_DOMAIN="" -%>
        <% SANS_DOMAIN="" -%>
        <% if [ ! -z "$MAIN_DOMAIN" ]; then -%>

        <% ROUTER="$(echo $MAIN_DOMAIN | tr . -)" -%>
        <% MIDDLE="$(echo $MAIN_DOMAIN | tr . -)-redirect" %>
        # Public domain (with www redirection) for <%= $MAIN_DOMAIN %>
        traefik.http.routers.<%= $ROUTER -%>.entrypoints: "websecure"
        traefik.http.routers.<%= $ROUTER -%>.rule: "Host(<%= $(bin/get csv $MAIN_DOMAIN $SANS_DOMAIN) %>)"
        traefik.http.routers.<%= $ROUTER -%>.tls.certresolver: "resolver-tls"
        traefik.http.routers.<%= $ROUTER -%>.tls.domains[0].main: "<%= $MAIN_DOMAIN %>"
        traefik.http.routers.<%= $ROUTER -%>.tls.domains[0].sans: "<%= $SANS_DOMAIN %>"
        traefik.http.routers.<%= $ROUTER -%>.middlewares: "<%= $MIDDLE %>@docker"
        traefik.http.routers.<%= $ROUTER -%>.service: "<%= $SERVICE %>"
        traefik.http.middlewares.<%= $MIDDLE -%>.redirectregex.regex: "^https://<%= $SANS_DOMAIN %>/(.*)"
        traefik.http.middlewares.<%= $MIDDLE -%>.redirectregex.replacement: "https://<%= $MAIN_DOMAIN %>/$${1}"
        traefik.http.middlewares.<%= $MIDDLE -%>.redirectregex.permanent: "true"

        # Domain redirections
        # for DOMAIN in "oldsite.com" "retiredsite.com"; do
        <% for DOMAIN in ""; do -%>
        <% if [ ! -z "$DOMAIN" ]; then -%>
        <% ROUTER="$(echo $MAIN_DOMAIN.$DOMAIN | tr . -)" -%>
        <% MIDDLE="$(echo $MAIN_DOMAIN.$DOMAIN | tr . -)-redirect" %>
        # Redirect <%= $DOMAIN %> to <%= $MAIN_DOMAIN %>
        traefik.http.routers.<%= $ROUTER -%>.entrypoints: "websecure"
        traefik.http.routers.<%= $ROUTER -%>.rule: "Host(`<%= $DOMAIN -%>`,`www.<%= $DOMAIN -%>`)"
        traefik.http.routers.<%= $ROUTER -%>.tls.certresolver: "resolver-tls"
        traefik.http.routers.<%= $ROUTER -%>.tls.domains[0].main: "<%= $DOMAIN -%>"
        traefik.http.routers.<%= $ROUTER -%>.tls.domains[0].sans: "www.<%= $DOMAIN -%>"
        traefik.http.routers.<%= $ROUTER -%>.middlewares: "<%= $MIDDLE %>@docker"
        traefik.http.routers.<%= $ROUTER -%>.service: "<%= $SERVICE %>"
        traefik.http.middlewares.<%= $MIDDLE -%>.redirectregex.regex: "^https://(<%= $DOMAIN %>|www.<%= $DOMAIN %>)/(.*)"
        traefik.http.middlewares.<%= $MIDDLE -%>.redirectregex.replacement: "https://<%= $MAIN_DOMAIN %>/$${2}"
        traefik.http.middlewares.<%= $MIDDLE -%>.redirectregex.permanent: "true"
        <% fi %>
        <% done %>

        <% fi %>


    environment:
      WP_ENV: "production"
      HOST: "<%= $(bin/get host) %>"

      DB_HOST: "db:3306"
      DB_NAME: "<%= $(bin/get db_name) %>"
      DB_USER: "<%= $(bin/get db_user) %>"
      DB_PASSWORD: "<%= $(bin/get db_password) %>"

      SMTP_HOST: "<%= $(bin/get SMTP_HOST) %>"
      SMTP_PORT: "<%= $(bin/get SMTP_PORT) %>"
      SMTP_USER: "<%= $(bin/get SMTP_USER) %>"
      SMTP_PASSWORD: "<%= $(bin/get SMTP_PASSWORD) %>"

    volumes:
      - <%= $(bin/get uploads) %>:/srv/web/content/uploads
      - cache:/srv/web/content/cache
      - settings:/srv/web/content/settings
      - <%= $(bin/get dump) %>:/srv/dump.sql

    networks:
      - backend
      - proxy
      - db

  # Cron
  cron:
    image: nonfiction/wordpress-cron:v3

    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.role == manager]

      resources:
        limits:
          cpus: '0.5'
          memory: 50M

    environment:
      HOST: "<%= $(bin/get host) %>"
      HOST_USER: "<%= $(bin/get host_user) %>"
      HOST_PASSWORD: "<%= $(bin/get host_password) %>"
      DB_HOST: "db"
      DB_PORT: "3306"
      DB_USER: "<%= $(bin/get db_user) %>"
      DB_PASSWORD: "<%= $(bin/get db_password) %>"
      DB_NAME: "<%= $(bin/get db_name) %>"

    volumes:
      - <%= $(bin/get dump) %>:/cron/dump.sql

    networks:
      - proxy
      - db

  # Object Cache
  redis:
    image: redis:alpine

    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.role == manager]

      resources:
        limits:
          cpus: '0.50'
          memory: 100M

    command: >
      redis-server
      --databases 1
      --maxmemory 50mb
      --maxmemory-policy allkeys-lru

    networks:
      - backend


networks:
  backend:
  proxy:
    name: proxy
    driver: overlay
    external: true
  db:
    name: db
    driver: overlay
    external: true

volumes:
  cache:
  settings: