prod-stack.yml

version: "3.7"

x-logging:
  &default-logging
  options:
    max-size: '12m'
    max-file: '5'
  driver: json-file
x-deploy-php:
  &default-php-deploy
  replicas: 1
  labels:
    - "traefik.enable=false"
  placement:
    constraints:
      - "node.labels.weaksauce==false"
  resources:
    limits:
      memory: 2048M
      cpus: "1"
    reservations:
      memory: 200M
  update_config:
    parallelism: 1
    failure_action: rollback
    order: start-first
x-deploy:
  &default-deploy
  replicas: 1
  labels:
    - "traefik.enable=false"
  placement:
    constraints:
      - "node.labels.weaksauce==false"
  resources:
    limits:
      memory: 2048M
  update_config:
    parallelism: 1
    failure_action: rollback
    order: start-first

services:
  app:
    image: ${IMAGE_NAME}
    networks:
      - proxy
      - default
    expose:
      - "80"
    environment:
      CONTAINER_ROLE: app
    secrets:
      - source: dotenv
        target: .env
    deploy:
      replicas: 1
      placement:
        constraints:
          - "node.labels.weaksauce==false"
        preferences:
          - spread: node.labels.site
      update_config:
        parallelism: 1
        failure_action: rollback
        order: start-first
      resources:
        limits:
          memory: 2048M
        reservations:
          memory: 128M
      labels:
        # note: this assumes traefik v2
        - "traefik.enable=true"
        - "traefik.http.routers.${TRAEFIK_BACKEND}.rule=Host(`${TRAEFIK_HOSTNAME}`)"
        - "traefik.http.routers.${TRAEFIK_BACKEND}.entrypoints=web"
        - "traefik.http.services.${TRAEFIK_BACKEND}.loadbalancer.server.port=80" # it seems you always need to give traefik a port so it 'notices' the service
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.rule=Host(`${TRAEFIK_HOSTNAME}`)"
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.entrypoints=web-secured"
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.tls.certresolver=mytlschallenge"
    stop_grace_period: 2m
    logging: *default-logging

  scheduler:
    image: ${IMAGE_NAME}
    deploy: *default-php-deploy
    stop_grace_period: 1m
    networks:
      - default
    environment:
      CONTAINER_ROLE: scheduler
    secrets:
      - source: dotenv
        target: .env
    logging: *default-logging

  queue:
    image: ${IMAGE_NAME}
    deploy: *default-php-deploy
    stop_grace_period: 1m
    networks:
      - default
    environment:
      CONTAINER_ROLE: queue
    secrets:
      - source: dotenv
        target: .env
    logging: *default-logging

  migrations:
    image: ${IMAGE_NAME}
    deploy: *default-php-deploy
    stop_grace_period: 1m
    networks:
      - default
    environment:
      CONTAINER_ROLE: migrations
    secrets:
      - source: dotenv
        target: .env

  redis:
    # redis v5.0.5 tag as of 2019-06-25
    # you can get the sha of an image by doing :
    #  docker pull redis:5.0.5
    #  docker images --digests | grep redis
    image: redis@sha256:ca2d9251c2818df48c6598e01a5bdeab46040dc7ab236abe075d7c7343465177
    deploy: *default-deploy
    logging: *default-logging
    networks:
      - default
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]

secrets:
  dotenv:
    external: true
    name: ${DOTENV_NAME}

networks:
  default:
  proxy:
    external: true