docker-compose.yml

version: '3.8'

x-app-common: &jitsi_admin_app
  build: .
  environment:
    APACHE_DOCUMENT_ROOT: "public/"
    PHP_EXTENSION_XDEBUG: "1"
    PHP_INI_MEMORY_LIMIT: "1G"
    PHP_EXTENSION_LDAP: 1
    PHP_EXTENSION_INTL: 1
    DATABASE_URL: mysql://jitsiadmin:${JITSI_ADMIN_PW}@${RANDOMTAG}db-ja:3306/jitsiadmin
    MERCURE_URL: http://websocket-ja:3000/.well-known/mercure
    MERCURE_PUBLIC_URL: ${HTTP_METHOD}://websocket.${PUBLIC_URL}
    MERCURE_JWT_SECRET: ${MERCURE_JWT_SECRET}
    MAILER_DSN: ${MAILER_DSN}
    registerEmailAdress: ${registerEmailAdress}
    WEBSOCKET_SECRET: ${MERCURE_JWT_SECRET}


services:
  traefik-ja:
    image: "traefik:v2.5"

    command:
      #- "--log.level=DEBUG"
      - "--api.insecure=false"
      - "--providers.docker=true"
      #- "--api.dashboard=true"

      - "--providers.docker.exposedbydefault=false"

      - "--entrypoints.unsecure.address=:80"
      - "--entrypoints.web.address=:443"
      # Global HTTP -> HTTPS
      - "--entrypoints.unsecure.http.redirections.entryPoint.to=web"
      - "--entrypoints.unsecure.http.redirections.entryPoint.scheme=https"
      # SSL configuration
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=unsecure"
      - "--certificatesresolvers.letsencrypt.acme.email=${registerEmailAdress}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.entrypoints=unsecure"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https@docker"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

      - "traefik.http.routers.traefik-ja.rule=Host(`traefik.${PUBLIC_URL}`)"
      - "traefik.http.routers.traefik-ja.entrypoints=web"
      - "traefik.http.routers.traefik-ja.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik-ja.service=api@internal"
      - "traefik.http.routers.traefik-ja.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/" # test:test



    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      -  ./data/letsencrypt:/letsencrypt
      - ./tools/traefik/config.yml:/etc/traefik/dynamic_conf/conf.yml:ro

  #Here is the websocket hub
  websocket-ja:
    hostname: ${RANDOMTAG}websocket-ja
    build: nodejs
    restart: unless-stopped
    depends_on:
      - traefik-ja

    environment:
      WEBSOCKET_SECRET: '${MERCURE_JWT_SECRET}'
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/healthz"]
      interval: 10s
      retries: 5
      timeout: 10s
      start_period: 10s

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.websocket-ja.rule=Host(`${PUBLIC_URL}`) && PathPrefix(`/ws`)"
      - "traefik.http.routers.websocket-ja.entrypoints=web"
      - "traefik.http.routers.websocket-ja.tls=true"
      - "traefik.http.services.websocket-ja.loadbalancer.server.port=3000"
      - "traefik.http.routers.websocket-ja.tls.certresolver=letsencrypt"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=http"
      - "traefik.http.routers.app-secure.middlewares=sslheader@docker"

    volumes:
      - caddy_data:/data
      - caddy_config:/config

  #Here is the Jitsi-Admin app
  app-ja:
    <<: *jitsi_admin_app
    depends_on:
      db-ja:
        condition: service_healthy
    healthcheck:
      test: [ "CMD", "curl", "-s", "-f", "-i", "http://localhost:80/health/check" ]
      interval: 20s
      timeout: 10s
      start_period: 30s
      retries: 10
    environment:
      APACHE_DOCUMENT_ROOT: "public/"
      PHP_EXTENSION_XDEBUG: "1"
      PHP_INI_MEMORY_LIMIT: "1G"
      PHP_EXTENSION_LDAP: 1
      PHP_EXTENSION_INTL: 1
      PHP_INI_UPLOAD_MAX_FILESIZE: 8M
      PHP_INI_POST_MAX_SIZE: 8M
      DATABASE_URL: mysql://jitsiadmin:${JITSI_ADMIN_PW}@${RANDOMTAG}db-ja:3306/jitsiadmin
      MAILER_TRANSPORT: smtp
      OAUTH_KEYCLOAK_CLIENT_ID: jitsiadmin
      OAUTH_KEYCLOAK_CLIENT_SECRET: ${OAUTH_KEYCLOAK_CLIENT_SECRET}
      OAUTH_KEYCLOAK_SERVER: ${HTTP_METHOD}://${PUBLIC_URL}/keycloak
      OAUTH_KEYCLOAK_REALM: jitsiadmin
      MERCURE_URL: http://${RANDOMTAG}websocket-ja:3000/.well-known/mercure
      MERCURE_PUBLIC_URL: ${HTTP_METHOD}://${PUBLIC_URL}
      MERCURE_JWT_SECRET: ${MERCURE_JWT_SECRET}
      WEBSOCKET_SECRET: ${MERCURE_JWT_SECRET}
      MAILER_DSN: ${MAILER_DSN}
      laF_version: ${GIT_VERSION}
      registerEmailAdress: ${registerEmailAdress}
      laF_baseUrl: ${HTTP_METHOD}://${PUBLIC_URL}
      VICH_BASE: ${HTTP_METHOD}://${PUBLIC_URL}
      input_settings_allow_timezone: 1
      allowTimeZoneSwitch: 1
      CRON_USER_1: root
      CRON_SCHEDULE_1: "* * * * *"
      CRON_COMMAND_1: "php /var/www/html/bin/console cron:run"

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app-ja.tls=true"
      - "traefik.http.routers.app-ja.rule=Host(`${PUBLIC_URL}`)"
      - "traefik.http.routers.app-ja.entrypoints=web"
      - "traefik.http.services.app-ja.loadbalancer.server.port=80"
      - "traefik.http.routers.app-ja.tls.certresolver=letsencrypt"
      - "traefik.http.services.app-ja.loadbalancer.sticky=true"
      - "traefik.http.services.app-ja.loadbalancer.sticky.cookie.name=jad"
      - "traefik.http.services.app-ja.loadbalancer.sticky.cookie.secure=true"
    volumes:
      - theme_data:/var/www/html/theme
      - image_upload:/var/www/html/public/uploads/images
      - theme_assests_data:/var/www/html/public/theme

  app-queu:
    <<: *jitsi_admin_app
    restart: unless-stopped
    deploy:
      mode: replicated
      replicas: 2
    depends_on:
      app-ja:
        condition: service_healthy
    command: php /var/www/html/bin/console messenger:consume async --memory-limit=126m
    volumes:
      - theme_data:/var/www/html/theme

  db-ja:
    image: mariadb:latest
    hostname: ${RANDOMTAG}db-ja
    healthcheck:
      test: [ "CMD", "mariadb-admin" ,"ping", "-h", "localhost","-ptest" ]
      timeout: 20s
      retries: 10
    environment:
      MARIADB_ROOT_PASSWORD: test
    volumes:
      - mariadb:/var/lib/mysql
      - ./docker/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d


  keycloak-ja:
    image: quay.io/keycloak/keycloak:22.0.3
    depends_on:
      app-ja:
        condition: service_healthy
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PW}
      KC_DB: mariadb
      KC_DB_PASSWORD: ${KEYCLOAK_PW}
      KC_DB_URL: jdbc:mariadb://${RANDOMTAG}db-ja:3306/keycloak
      KC_DB_USERNAME: keycloak
      KC_HOSTNAME_URL: ${HTTP_METHOD}://${PUBLIC_URL}/keycloak
      KC_HOSTNAME_PATH: ${HTTP_METHOD}://${PUBLIC_URL}/keycloak
      KC_HOSTNAME_ADMIN_URL: ${HTTP_METHOD}://${PUBLIC_URL}/keycloak
      KC_HTTP_RELATIVE_PATH: /keycloak
      KC_PROXY: passthrough

    command:
      - start-dev
      - --import-realm
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.keycloak-ja.tls=true"
      - "traefik.http.routers.keycloak-ja.rule=Host(`${PUBLIC_URL}`) && PathPrefix(`/keycloak`)"
      - "traefik.http.routers.keycloak-ja.entrypoints=web"
      - "traefik.http.services.keycloak-ja.loadbalancer.server.port=8080"
      - "traefik.http.routers.keycloak-ja.tls.certresolver=letsencrypt"

    volumes:
      - ./docker/keycloak/:/opt/keycloak/data/import


volumes:
  mariadb:
  caddy_data:
  caddy_config:
  image_upload:
  theme_data:
  theme_assests_data: