docker-stack.yaml

services:
  traefik:
    image: traefik:v3.1
    command:
#      - "--api=true"
#      - "--api.insecure=true"
      - "--providers.docker"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=${SSL_EMAIL}"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      # Add new entrypoints for Minio ports if you want Traefik to handle TLS on them
#      - "--entrypoints.minio-server.address=:9000"
      - "--entrypoints.minio-console.address=:9001"
#      - "--entrypoints.kokoro.address=:8880"
#      - "--entrypoints.ncat.address=:8080"
      - "--accesslog=true"
      - "--accesslog.filepath=/var/log/traefik/access.log"
    ports:
      - mode: host
        protocol: tcp
        published: 80
        target: 80
      - mode: host
        protocol: tcp
        published: 443
        target: 443
      # Publish the new entrypoint ports on the host if needed for external access
      - mode: host
        protocol: tcp
        published: 9001
        target: 9001
    volumes:
      - letsencrypt:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock
      - traefik-data:/data
      - /DockerContainers/traefik_logs:/var/log/traefik

  web:
    image: ghcr.io/tismoj/zenstats:${GIT_COMMIT_HASH:-latest}
#    image: ghcr.io/dreamsofcode-io/zenstats:broken-quote
#    image: ghcr.io/dreamsofcode-io/zenstats:baaf221054f44ec2b6d85f60e94b70a0619665be
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.web.loadbalancer.server.port=8080"
      - "traefik.http.routers.web.rule=Host(`${WEB_APP_DOMAIN}`)"
      - "traefik.http.routers.web.entrypoints=websecure"
      - "traefik.http.routers.web.tls.certresolver=myresolver"
    secrets:
      - db-password
    environment:
      - POSTGRES_HOST=db
      - POSTGRES_PASSWORD_FILE=/run/secrets/db-password
      - POSTGRES_USER=postgres
      - POSTGRES_DB=app
      - POSTGRES_PORT=5432
      - POSTGRES_SSLMODE=disable
    deploy:
      update_config:
        parallelism: 1
        max_failure_ratio: 0.80
        failure_action: rollback
        order: start-first
    depends_on:
      - db

  db:
    image: postgres
    user: postgres
    volumes:
      - db-data:/var/lib/postgresql/data
    secrets:
      - db-password
    environment:
      - POSTGRES_DB=app
      - POSTGRES_PASSWORD_FILE=/run/secrets/db-password
    healthcheck:
      test: [ "CMD", "pg_isready" ]
      interval: 10s
      timeout: 5s
      retries: 5

  n8n:
#    image: docker.n8n.io/n8nio/n8n
#    image: n8n-playwright:latest
    image: ghcr.io/tismoj/n8n-playwright:${GIT_COMMIT_HASH:-latest}
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.n8n.loadbalancer.server.port=443"
      - "traefik.http.routers.n8n.rule=Host(`${N8N_APP_DOMAIN}`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
      - "traefik.http.routers.n8n.tls.certresolver=myresolver"
    volumes:
      - n8n-data:/home/node/.n8n
    environment:
      - N8N_HOST=n8n.contabo-cvps-n1.trackmyownfiles.com
      - N8N_PORT=443
      - N8N_PROTOCOL=https
      - NODE_ENV=production
      - GENERIC_TIMEZONE=Asia/Manila
      - N8N_EXPRESS_LIMIT_TRUST_PROXY=true

  minio:
    image: quay.io/minio/minio
    labels:
      - "traefik.enable=true"
      # Minio Server (Port 9000)
      - "traefik.http.services.minio-server.loadbalancer.server.port=9000"
      - "traefik.http.routers.minio-server.rule=Host(`${MINIO_APP_DOMAIN}`)"
      - "traefik.http.routers.minio-server.entrypoints=websecure"
      - "traefik.http.routers.minio-server.service=minio-server@docker" # Explicitly link to the 'minio-server' service
      # If you want TLS on this port, uncomment the following
 #     - "traefik.http.routers.minio-server.tls=true"
      - "traefik.http.routers.minio-server.tls.certresolver=myresolver"
      # Minio Console (Port 9001)
      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
      - "traefik.http.routers.minio-console.rule=Host(`minio.contabo-cvps-n1.trackmyownfiles.com`)"
      - "traefik.http.routers.minio-console.entrypoints=minio-console" # Use the new entrypoint
      - "traefik.http.routers.minio-console.service=minio-console@docker" # Explicitly link to the 'minio-console' service
      # TLS is generally not needed for the console on a separate port, but you can add it if desired
      - "traefik.http.routers.minio-console.tls=true"
      - "traefik.http.routers.minio-console.tls.certresolver=myresolver"
    volumes:
      - minio-data:/data
    secrets:
      - minio-root-password
    environment:
      - MINIO_ROOT_USER=admin
      - MINIO_ROOT_PASSWORD_FILE=/run/secrets/minio-root-password
    command: ["server", "/data", "--console-address", ":9001"]

  baserow:
    image: baserow/baserow:1.33.2
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.baserow.loadbalancer.server.port=80"
      - "traefik.http.routers.baserow.rule=Host(`${BASEROW_APP_DOMAIN}`)"
      - "traefik.http.routers.baserow.entrypoints=websecure"
      - "traefik.http.routers.baserow.tls.certresolver=myresolver"
    volumes:
      - baserow-data:/baserow/data
    environment:
      - BASEROW_PUBLIC_URL=https://baserow.contabo-cvps-n1.trackmyownfiles.com

  kokoro:
    image: ghcr.io/remsky/kokoro-fastapi-cpu:v0.2.2
#    labels:
#      - "traefik.enable=true"
#      # Kokoro-TTS-CPU (Port 8880)
#      - "traefik.http.services.kokoro.loadbalancer.server.port=8880"
#      - "traefik.http.routers.kokoro.rule=Host(`${KOKORO_APP_DOMAIN}`)"
#      - "traefik.http.routers.kokoro.entrypoints=kokoro" # Use the new entrypoint
#      - "traefik.http.routers.kokoro.service=kokoro@docker" # Explicitly link to the 'kokoro' service
#      # If you want TLS on this port, uncomment the following
#      - "traefik.http.routers.kokoro.tls=true"
#      - "traefik.http.routers.kokoro.tls.certresolver=myresolver"

  ncat:
    image: stephengpope/no-code-architects-toolkit:latest
    labels:
      - "traefik.enable=true"
      # no-code-architects-toolkit (Port 8080)
      - "traefik.http.services.ncat.loadbalancer.server.port=8080"
      - "traefik.http.routers.ncat.rule=Host(`${NCAT_APP_DOMAIN}`)"
      - "traefik.http.routers.ncat.entrypoints=websecure"
#      - "traefik.http.routers.ncat.entrypoints=web,websecure"
#      - "traefik.http.routers.ncat.service=ncat@docker" # Explicitly link to the 'nca' service
      # If you want TLS on this port, uncomment the following
#      - "traefik.http.routers.ncat.tls=true"
      - "traefik.http.routers.ncat.tls.certresolver=myresolver"
#    secrets:
#      - NCAT_API_KEY
#      - S3_ACCESS_KEY
#      - S3_SECRET_KEY
    environment:
      - API_KEY=${NCAT_API_KEY}
      - S3_ACCESS_KEY=${S3_ACCESS_KEY}
      - S3_SECRET_KEY=${S3_SECRET_KEY}
#      - API_KEY_FILE=/run/secrets/NCAT_API_KEY
#      - S3_ACCESS_KEY_FILE=/run/secrets/S3_ACCESS_KEY
#      - S3_SECRET_KEY_FILE=/run/secrets/S3_SECRET_KEY
      - S3_ENDPOINT_URL=${S3_ENDPOINT_URL}
      - S3_REGION=${S3_REGION}
      - S3_BUCKET_NAME=${S3_BUCKET_NAME}

volumes:
  baserow-data:
    external: true
  db-data:
  letsencrypt:
  n8n-data:
    external: true
  minio-data:
    external: true
  traefik-data:

secrets:
  db-password:
    external: true
  minio-root-password:
    external: true
#  NCAT_API_KEY:
#    external: true
#  S3_ACCESS_KEY:
#    external: true
#  S3_SECRET_KEY:
#    external: true