failover-stack-4-swarm.yml

# WARNING: This stack depends on traefik.yml stack
# use to create a swarm template in Portainer
# STACK_BASE_PATH [base folder where to host files, must exists]
# STACK_BASE_PATH=/srv/data/docker/containers/failover ; grep device failover-stack-4-swarm.yml|grep -v "#"|awk '{print $2}'|while read dir; do eval mkdir -p $dir; done

version: '3.7'

x-default-opts: 
  &default-opts
  deploy:
    restart_policy:
      condition: on-failure
      delay: 5s
      #max_attempts: 3
      window: 20s

x-envs: &common-vars
  TZ: Europe/Rome
  MYSQL_ROOT_PASSWORD_FILE: /var/lib/mysql/db-root.pwd
  MYSQL_PASSWORD_FILE: /var/lib/mysql/db-password.pwd
  MYSQL_USER_FILE: /var/lib/mysql/db-user.txt
  MYSQL_HOST: ${MYSQL_HOST:-db}
  FQDN_PMA: ${FQDN_PMA:-nohost.tld}
  FQDN_NGINX: ${FQDN_NGINX:-nohost.tld}

services:
  nginx:
    image: nginx:1-alpine
    hostname: nginx
    volumes:
      - nginx_conf:/etc/nginx/conf.d:ro
      - app:/usr/share/nginx/html
      - ${STACK_BASE_PATH}/nginx/entrypoint.sh:/entrypoint.sh:ro
    environment:
      TZ: Europe/Rome
    depends_on:
      - app
    entrypoint: ["/entrypoint.sh"]
    command: ["nginx", "-g", "daemon off;"]
    healthcheck:
      test: ["CMD", "/bin/sh", "-c", "nc -w 7 -zv 0.0.0.0 80 || (echo \"Very bad things are happening here...\" && exit 1)"]
      interval: 30s
      timeout: 10s
      start_period: 90s
      retries: 6
    stop_grace_period: 20s
    networks:
      - private
      - traefik-public
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.port=80"
        - "traefik.tags=traefik-public"
        - "traefik.redirectorservice.frontend.entryPoints=http"
        - "traefik.redirectorservice.frontend.redirect.entryPoint=https"
        - "traefik.webservice.frontend.entryPoints=https"
        - "traefik.frontend.rule=Host:${FQDN_NGINX}"
        - "traefik.frontend.headers.SSLRedirect=true"
        - "traefik.frontend.entryPoints=http,https"
        - "traefik.frontend.passHostHeader=true"
        - "traefik.frontend.auth.basic.usersFile=/auth/cron"

  app:
    image: neomediatech/php-fpm-debian:8-fpm-redis
    hostname: app
    volumes:
      - app:/usr/share/nginx/html
      - logs:/logs
    environment:
      TZ: Europe/Rome
    depends_on:
      - db
    healthcheck:
      test: ["CMD", "nc", "-w", "7", "-zv", "0.0.0.0", "9000"]
      interval: 30s
      timeout: 30s
      start_period: 60s
      retries: 20
    networks:
      - private

  db:
    image: mariadb:10
    hostname: db
    <<: *default-opts    
    volumes:
      - db:/var/lib/mysql
    environment:
      << : *common-vars
      MYSQL_DATABASE_FILE: /var/lib/mysql/db-name.txt
    networks:
      - private
    healthcheck:
      test: ["CMD", "/bin/bash", "-c", "read p < $$MYSQL_PASSWORD_FILE ; read u < $$MYSQL_USER_FILE ; mysql -p$$p -u$$u -e status | grep Uptime || (echo \"MariaDB is down\" && exit 1)"]
      interval: 30s
      timeout: 30s
      start_period: 5s
      retries: 20

  pma:
    image: phpmyadmin/phpmyadmin
    hostname: pma
    <<: *default-opts
    environment:
      << : *common-vars    
      PMA_HOST: ${MYSQL_HOST}
      PMA_PORT: 3306
    networks:
      - private
      - traefik-public
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      update_config:
        parallelism: 1
        delay: 10s
      restart_policy:
        condition: any
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.port=80"
        - "traefik.tags=traefik-public"
        - "traefik.redirectorservice.frontend.entryPoints=http"
        - "traefik.redirectorservice.frontend.redirect.entryPoint=https"
        - "traefik.webservice.frontend.entryPoints=https"
        - "traefik.frontend.rule=Host:${FQDN_PMA}"
        - "traefik.frontend.headers.SSLRedirect=true"
        - "traefik.frontend.entryPoints=http,https"
        - "traefik.frontend.passHostHeader=true"
        - "traefik.frontend.auth.basic.usersFile=/auth/htpasswd"
    depends_on:
      - db

  redis:
    image: redis:alpine
    hostname: redis
    environment:
      TZ: Europe/Rome
    networks:
      - private
    #command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - redis_db:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 20s
      timeout: 10s
      retries: 5
    # according to https://github.com/moby/moby/pull/37701#issuecomment-448014841
    # on docker 19.03 you will be able to set /proc/sys/net/core/somaxconn to 511 instead of default 128
    # like this example below (maybe syntax will change)
    sysctls:
      - net.core.somaxconn=511
    stop_grace_period: 1m

networks:
  private:
    driver: overlay
    attachable: true

  traefik-public:
    external: true

volumes:
  db:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${STACK_BASE_PATH}/db
  nginx_conf:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${STACK_BASE_PATH}/nginx/conf
  app:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${STACK_BASE_PATH}/app
  redis_db:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${STACK_BASE_PATH}/redis/db
  logs:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${STACK_BASE_PATH}/logs