status/docker-compose.yml at main · nethesis/status · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
version: '3.8'

networks:
  cachet-network:
    driver: bridge

volumes:
  traefik-certs:
    driver: local
  cachet-db:
    driver: local
  cachet-storage:
    driver: local

services:
  # PostgreSQL Database for Cachet
  postgres:
    image: docker.io/library/postgres:18.1-alpine
    container_name: cachet-postgres
    restart: unless-stopped
    networks:
      - cachet-network
    environment:
      POSTGRES_DB: ${DB_DATABASE:-cachet}
      POSTGRES_USER: ${DB_USERNAME:-cachet}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --lc-collate=en_US.UTF-8 --lc-ctype=en_US.UTF-8"
    volumes:
      - cachet-db:/var/lib/postgresql/
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME:-cachet}"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Cachet Application
  cachet:
    image: ghcr.io/nethesis/cachet-status-page:${CACHET_TAG:-latest}
    container_name: cachet-app
    restart: unless-stopped
    networks:
      - cachet-network
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # Application (from podman-setup/.env - HIGHEST PRIORITY)
      - APP_NAME=${APP_NAME:-Cachet}
      - APP_ENV=${APP_ENV:-local}
      - APP_KEY=${APP_KEY}
      - APP_DEBUG=${APP_DEBUG:-true}
      - APP_URL=${APP_URL}
      - ASSET_URL=${ASSET_URL:-}
      - APP_FORCE_HTTPS=${APP_FORCE_HTTPS:-false}
      - APP_TIMEZONE=${APP_TIMEZONE:-UTC}
      - CACHET_ADMIN_NAME=${CACHET_ADMIN_NAME}
      - CACHET_ADMIN_USERNAME=${CACHET_ADMIN_USERNAME}
      - CACHET_ADMIN_PASSWORD=${CACHET_ADMIN_PASSWORD}

      # Database (from podman-setup/.env - HIGHEST PRIORITY)
      - DB_CONNECTION=${DB_CONNECTION}
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_DATABASE=${DB_DATABASE}
      - DB_USERNAME=${DB_USERNAME}
      - DB_PASSWORD=${DB_PASSWORD}

      # Cache & Session
      - CACHE_STORE=database
      - SESSION_DRIVER=database
      - QUEUE_CONNECTION=database

      # Cachet specific
      - CACHET_BEACON=${CACHET_BEACON:-false}
      - CACHET_EMOJI=${CACHET_EMOJI:-true}
      - CACHET_TRUSTED_PROXIES=*
    volumes:
      - cachet-storage:/var/www/html/storage
      - ./cachet/.env:/var/www/html/.env:ro
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Python Middleware - Webhook Handler
  middleware:
    image: ghcr.io/nethesis/middleware-status-page:${MIDDLEWARE_TAG:-latest}
    container_name: cachet-middleware
    restart: unless-stopped
    networks:
      - cachet-network
    depends_on:
      cachet:
        condition: service_healthy
    environment:
      # Cachet API configuration
      - CACHET_API_URL=${CACHET_API_URL:-http://cachet/api/v1}
      - CACHET_API_TOKEN=${CACHET_API_TOKEN:-secret}
      # Python app settings
      - FLASK_ENV=production
      - PYTHONUNBUFFERED=1
      - ENVIRONMENT=${ENVIRONMENT:-local}
    volumes:
      # Mount config files as read-only
      - ./middleware/config.json:/app/config.json:ro,z
      - ./middleware/prometheus.yml:/app/prometheus.yml:ro,z
    healthcheck:
      test: ["CMD", "python3", "/app/healthcheck.py"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # Traefik - Reverse Proxy with Let's Encrypt
  traefik:
    image: docker.io/library/traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    networks:
      - cachet-network
    ports:
      - "${HTTP_PORT:-8080}:80"     # HTTP entrypoint
      - "${HTTPS_PORT:-8443}:443"   # HTTPS entrypoint
    volumes:
      - ./traefik/traefik.${ENVIRONMENT:-local}.yml:/etc/traefik/traefik.yml:ro,z
      - ./traefik/dynamic:/etc/traefik/dynamic:ro,z
      - traefik-certs:/letsencrypt:z
    environment:
      - TZ=${TZ:-Europe/Rome}
      - ENVIRONMENT=${ENVIRONMENT:-local}
      - CACHET_DOMAIN=${CACHET_DOMAIN:-localhost}
      - WEBHOOK_DOMAIN=${WEBHOOK_DOMAIN:-localhost}
      - CERT_RESOLVER=${CERT_RESOLVER:-letsencrypt}
      - WEBHOOK_BASIC_AUTH=${WEBHOOK_BASIC_AUTH}
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 10s
      timeout: 5s
      retries: 3