Do not expose containers by default in traefik

[github/Chocobozzz/PeerTube.git] / support / docker / production / docker-compose.yml

diff --git a/support/docker/production/docker-compose.yml b/support/docker/production/docker-compose.yml
index 9c6b6f6e3deaeb675b7c7832cb6f3d49e04d9897..51de964e87a339f7f3f8a91c7023d40b73c49579 100644 (file)
--- a/support/docker/production/docker-compose.yml
+++ b/support/docker/production/docker-compose.yml
@@ -2,51 +2,101 @@ version: "3.3"
 
 services:
 
-  peertube:
+  # The reverse-proxy only does SSL termination and automatic certificate generation. You can
+  # replace it with any other reverse-proxy, in which case you can remove 'traefik.*' labels.
+  reverse-proxy:
+    image: traefik:v1.7
+    network_mode: "host"
+    command:
+      - "--docker"                                # Tells Træfik to listen to docker
+      - "--acme.email=${TRAEFIK_ACME_EMAIL}"      # Let's Encrypt ACME email
+      - "--acme.domains=${TRAEFIK_ACME_DOMAINS}"  # Let's Encrypt ACME domain list
+    ports:
+      - "80:80"    # The HTTP port
+      - "443:443"  # The HTTPS port
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock # So that Træfik can listen to the Docker events
+      - ./docker-volume/traefik/acme.json:/etc/acme.json
+      - ./docker-volume/traefik/traefik.toml:/traefik.toml
+    restart: "always"
+
+  # The webserver is not required, but recommended since a lot of optimizations went to its
+  # nginx configuration file. It runs the default nginx configuration without HTTPS nor SSL,
+  # so use it in production in tandem with an SSL-terminating reverse-proxy like above.
+  webserver:
     build:
-      context: ../../../
-      dockerfile: ./support/docker/production/Dockerfile.stretch
-    image: peertube:stretch
-    environment:
-      PEERTUBE_HOSTNAME: my.domain.tld
-      PEERTUBE_PORT: 443
-      PEERTUBE_HTTPS: "true"
-      PEERTUBE_ADMIN_EMAIL: admin@domain.tld
-      PEERTUBE_DB_HOSTNAME: postgres
-      PEERTUBE_DB_USERNAME: postgres_user
-      PEERTUBE_DB_PASSWORD: postgres_password
-      PEERTUBE_SIGNUP_ENABLED: "true"
-      PEERTUBE_TRANSCODING_ENABLED: "true"
-      PEERTUBE_REDIS_HOSTNAME: redis
-      PEERTUBE_SMTP_HOSTNAME: mail.domain.tld
-      PEERTUBE_SMTP_PORT: 25
-      PEERTUBE_SMTP_FROM: noreply@peertube.domain.tld
-      PEERTUBE_SMTP_TLS: "true"
-    # Traefik labels are suggested as an example for people using Traefik,
-    # remove them if you are using another reverse proxy.
+      context: .
+      dockerfile: Dockerfile.nginx
+    env_file:
+      - .env
+    # If you provide your own reverse-proxy, otherwise not suitable for production:
+    #ports:
+    #  - "80:80"
+    volumes:
+      - type: bind
+        # Switch sources if you downloaded the nginx configuration without the whole repository
+        #source: ./peertube
+        source: ../../nginx/peertube
+        target: /etc/nginx/conf.d/peertube.template
+      - assets:/var/www/peertube/peertube-latest/client/dist:ro
+      - ./docker-volume/data:/var/www/peertube/storage
+    depends_on:
+      - peertube
+    restart: "always"
     labels:
       traefik.enable: "true"
-      traefik.frontend.rule: "Host:${PEERTUBE_HOSTNAME}"
-      traefik.port: "9000"
+      traefik.frontend.rule: "Host:${PEERTUBE_WEBSERVER_HOSTNAME}"
+      traefik.port: "80"
+
+  peertube:
+    # If you don't want to use the official image and build one from sources:
+    #build:
+    #  context: .
+    #  dockerfile: ./support/docker/production/Dockerfile.buster
+    image: chocobozzz/peertube:production-buster
+    env_file:
+      - .env
+    # If you provide your own webserver and reverse-proxy, otherwise not suitable for production:
+    #ports:
+    #  - "80:9000"
     volumes:
-      - ./data:/data
+      - assets:/app/client/dist
+      - ./docker-volume/data:/data
+      - ./docker-volume/config:/config
     depends_on:
       - postgres
       - redis
+      - postfix
     restart: "always"
 
   postgres:
-    image: postgres:10-alpine
-    environment:
-      POSTGRES_USER: postgres_user
-      POSTGRES_PASSWORD: postgres_password
-      POSTGRES_DB: peertube
+    image: postgres:12-alpine
+    env_file:
+      - .env
     volumes:
-      - ./db:/var/lib/postgresql/data
+      - ./docker-volume/db:/var/lib/postgresql/data
     restart: "always"
 
   redis:
-    image: redis:4-alpine
+    image: redis:5-alpine
     volumes:
-      - ./redis:/data
+      - ./docker-volume/redis:/data
     restart: "always"
+
+  postfix:
+    image: mwader/postfix-relay
+    env_file:
+      - .env
+    volumes:
+      - ./docker-volume/opendkim/keys:/etc/opendkim/keys
+    restart: "always"
+
+networks:
+  default:
+    ipam:
+      driver: default
+      config:
+      - subnet:  172.18.0.0/16
+
+volumes:
+  assets: