docker-compose.prod.yml

version: "3.8"

services:
  reverse-proxy:
    image: traefik:v2.10
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=prompt-network"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=valeryia.andraichuk@tum.de"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin"
      - "--experimental.plugins.jwt.version=v0.7.1"
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./letsencrypt:/letsencrypt
    networks:
      - prompt-network

  server:
    image: "ghcr.io/ls1intum/prompt/prompt-server:${SERVER_IMAGE_TAG}"
    container_name: prompt-server
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.server.rule=Host(`${SERVER_HOST}`) && PathPrefix(`/api`)"
      - "traefik.http.services.server.loadbalancer.server.port=8080"
      - "traefik.http.routers.server.entrypoints=websecure"
      - "traefik.http.routers.server.tls.certresolver=letsencrypt"
      - "traefik.http.middlewares.api-ratelimit.ratelimit.average=300"
      - "traefik.http.middlewares.api-ratelimit.ratelimit.burst=100"
      - "traefik.http.routers.server.middlewares=api-ratelimit"
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - ./thesis_uploads:/thesis_application_uploads
      - ./mailing_templates:/mailing_templates
    expose:
      - "8080"
    environment:
      - TZ=Europe/Berlin
      - ENVIRONMENT
      - SPRING_DATASOURCE_URL
      - SPRING_DATASOURCE_USERNAME
      - SPRING_DATASOURCE_PASSWORD
      - SPRING_JPA_HIBERNATE_DDL_AUTO=update
      - CLIENT_HOST
      - ATLASSIAN_USERNAME
      - ATLASSIAN_PASSWORD
      - JIRA_URL
      - BITBUCKET_URL
      - BAMBOO_URL
      - CONFLUENCE_URL
      - KEYCLOAK_CLIENT_SECRET
      - KEYCLOAK_ISSUER_URI
      - KEYCLOAK_JWK_SET_URI
      - IOS_SENDER_MAIL
      - CHAIR_MEMBER_RECIPIENTS
    networks:
      - prompt-network

  db:
    image: "postgres:15.2-alpine"
    container_name: prompt-db
    environment:
      - POSTGRES_USER=${SPRING_DATASOURCE_USERNAME}
      - POSTGRES_PASSWORD=${SPRING_DATASOURCE_PASSWORD}
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${SPRING_DATASOURCE_USERNAME}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - prompt-network

  client:
    image: "ghcr.io/ls1intum/prompt/prompt-client:${CLIENT_IMAGE_TAG}"
    container_name: prompt-client
    environment:
      - TZ=Europe/Berlin
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.client.rule=Host(`${SERVER_HOST}`)"
      - "traefik.http.routers.client.entrypoints=websecure"
      - "traefik.http.routers.client.tls.certresolver=letsencrypt"
      - "traefik.http.middlewares.client-compress.compress=true"
      - "traefik.http.middlewares.redirect-to-thesis-track.redirectregex.regex=^https?://[^/]+/(applications/thesis|management/thesis-applications)(.*)"
      - "traefik.http.middlewares.redirect-to-thesis-track.redirectregex.replacement=${THESIS_HOST}/$$1"
      - "traefik.http.routers.client.middlewares=client-compress,redirect-to-thesis-track"
    expose:
      - "80"
    depends_on:
      - server
    networks:
      - prompt-network

  postfix:
    image: ghcr.io/ls1admin/postfix:latest
    container_name: prompt-postfix
    restart: unless-stopped
    volumes:
      - ./postfix-config:/config
    hostname: ${SERVER_HOST}
    networks:
      - prompt-network

networks:
  # Create network manually in advance: docker network create prompt-network
  prompt-network:
    name: prompt-network
    external: true