docker-compose.yml

version: '3.3'

services:
  database:
    restart: always
    image: mariadb:10.0.23
    deploy:
      placement:
        constraints:
          - node.labels.database == true
    command: mysqld --character-set-server=utf8 --collation-server=utf8_unicode_ci --init-connect='SET NAMES UTF8;' --innodb-flush-log-at-trx-commit=0
    environment:
      - MYSQL_ROOT_PASSWORD
      - MYSQL_DATABASE
    volumes:
      - db:/var/lib/mysql

  adminer:
    restart: always
    image: adminer
    deploy:
      placement:
        constraints:
          - node.labels.database == true
    depends_on:
      - database
      
  registry:
    restart: always
    image: registry
    deploy:
      placement:
        constraints:
          - node.labels.registry == true
    ports:
      - 5000:5000
    environment:
      REGISTRY_STORAGE_DELETE_ENABLED: "true"
      # SSL
      REGISTRY_HTTP_TLS_CERTIFICATE: /run/secrets/cert.crt
      REGISTRY_HTTP_TLS_KEY: /run/secrets/privkey.key
      # Authentication
      REGISTRY_AUTH_TOKEN_REALM: https://${MACHINE_FQDN}/v2/token
      REGISTRY_AUTH_TOKEN_SERVICE: ${MACHINE_FQDN}
      REGISTRY_AUTH_TOKEN_ISSUER: ${MACHINE_FQDN}
      REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE: /run/secrets/cert.crt
      # Portus endpoint
      REGISTRY_NOTIFICATIONS_ENDPOINTS: >
        - name: portus
          url: https://${MACHINE_FQDN}/v2/webhooks/events
          timeout: 2000ms
          threshold: 5
          backoff: 1s
    secrets:
      - cert.crt
      - privkey.key
    volumes:
      - /registry:/var/lib/registry

  portus:
    restart: always
    image: opensuse/portus:2.3
    deploy:
      placement:
        constraints:
          - node.labels.portus == true
    ports:
      - 3000:3000
    environment:
      - PORTUS_MACHINE_FQDN_VALUE=${MACHINE_FQDN}
      - PORTUS_DELETE_ENABLED=true
      - PORTUS_REGISTRY_JWT_EXPIRATION_TIME_VALUE=150
      # DB
      - PORTUS_DB_HOST=database
      - PORTUS_DB_DATABASE=${MYSQL_DATABASE}
      - PORTUS_DB_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - PORTUS_DB_POOL=5
      # Secrets
      - PORTUS_SECRET_KEY_BASE
      - PORTUS_KEY_PATH=/run/secrets/privkey.key
      - PORTUS_PASSWORD
      # SSL
      - PORTUS_PUMA_TLS_KEY=/run/secrets/privkey.key
      - PORTUS_PUMA_TLS_CERT=/run/secrets/cert.crt
    secrets:
      - cert.crt
      - privkey.key
    volumes:
      - static:/srv/Portus/public
    depends_on:
      - database
      - registry
      
  background:
    restart: always
    image: opensuse/portus:2.3
    deploy:
      placement:
        constraints:
          - node.labels.portus == true
    environment:
      - PORTUS_MACHINE_FQDN_VALUE=${MACHINE_FQDN}
      - CCONFIG_PREFIX=PORTUS
      - PORTUS_BACKGROUND=true
      - PORTUS_BACKGROUND_REGISTRY_ENABLED=true
      - PORTUS_BACKGROUND_SYNC_ENABLED=true
      - PORTUS_BACKGROUND_SYNC_STRATEGY=update-delete
      # DB
      - PORTUS_DB_HOST=database
      - PORTUS_DB_DATABASE=${MYSQL_DATABASE}
      - PORTUS_DB_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - PORTUS_DB_POOL=5
      # Secrets
      - PORTUS_SECRET_KEY_BASE
      - PORTUS_KEY_PATH=/run/secrets/privkey.key
      - PORTUS_PASSWORD
    secrets:
      - cert.crt
      - privkey.key
    depends_on:
      - database
      - registry
      - portus

  nginx:
    restart: always
    image: nels/docker-nginx
    deploy:
      placement:
        constraints:
          - node.labels.portus == true
    ports:
      - 80:80
      - 443:443
    volumes:
      - static:/srv/Portus/public:ro
    secrets:
      - cert.crt
      - privkey.key
    depends_on:
      - registry
      - portus

volumes:
  db:
  static:
  
secrets:
    cert.crt:
        external: true
    privkey.key:
        external: true