docker-compose.yml

---
services:
  traefik:
    image: ${TCS_IMAGE_TRAEFIK}
    restart: always
    command:
      - "--api.insecure=true"
      - "--providers.file=true"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.https.address=:443"
    ports:
      - ${TCS_LISTEN_ADDRESS}:443:443
      - ${TCS_LISTEN_ADDRESS_INTERNAL_SERVICES}:8080:8080
    volumes:
      - "./files/traefik/certificates:/etc/traefik/certificates:ro"
      - "./files/traefik/certificates.yml:/etc/traefik/dynamic/certificates.yml:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  phpredisadmin:
    image: ${TCS_IMAGE_PHPREDISADMIN}
    restart: always
    environment:
      REDIS_1_HOST: redis
      REDIS_1_NAME: redis
    ports:
      - ${TCS_LISTEN_ADDRESS_INTERNAL_SERVICES}:10000:80

  phpmyadmin:
    image: ${TCS_IMAGE_PHPMYADMIN}
    restart: always
    environment:
      PMA_HOST: mariadb
    ports:
      - ${TCS_LISTEN_ADDRESS_INTERNAL_SERVICES}:10001:80
    depends_on:
      mariadb:
        condition: service_healthy

  mariadb:
    image: ${TCS_IMAGE_MARIADB}
    restart: always
    environment:
      MARIADB_ROOT_PASSWORD: ${TCS_DATABASE_ROOT_PASSWORD}
      MARIADB_DATABASE: tcs
      MARIADB_USER: tcs
      MARIADB_PASSWORD: ${TCS_DATABASE_PASSWORD}
    volumes:
      - mariadb:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "--silent"]

  minio:
    image: ${TCS_IMAGE_MINIO}
    restart: always
    command: server /data --address ":9000" --console-address ":9001"
    ports:
      - ${TCS_LISTEN_ADDRESS_INTERNAL_SERVICES}:9001:9001
    environment:
      MINIO_SERVER_URL: https://${TCS_DOMAIN_MINIO}
    volumes:
      - minio-1:/data1
      - minio-2:/data2
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.minio.loadbalancer.server.port=9000"
      - "traefik.http.services.minio.loadbalancer.passhostheader=true"
      - "traefik.http.routers.minio-secure.rule=Host(`${TCS_DOMAIN_MINIO}`)"
      - "traefik.http.routers.minio-secure.entrypoints=https"
      - "traefik.http.routers.minio-secure.tls=true"

  opa:
    image: ${TCS_IMAGE_OPA}
    restart: always
    command: run --server -c /config.yaml /tcs.rego
    volumes:
      - ./files/opa/config.yaml:/config.yaml:ro
      - ./files/opa/tcs.rego:/tcs.rego:ro

  redis:
    image: ${TCS_IMAGE_REDIS}
    restart: always

  rabbitmq:
    image: ${TCS_IMAGE_RABBITMQ}
    restart: always

  keycloak:
    image: ${TCS_IMAGE_KEYCLOAK}
    restart: always
    command: start-dev --proxy edge --import-realm --http-port 80
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: ${TCS_KEYCLOAK_ADMIN_PASSWORD}
    volumes:
      - ./files/keycloak:/opt/keycloak/data/import:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.keycloak.loadbalancer.server.port=80"
      - "traefik.http.routers.keycloak-secure.rule=Host(`${TCS_DOMAIN_KEYCLOAK}`)"
      - "traefik.http.routers.keycloak-secure.entrypoints=https"
      - "traefik.http.routers.keycloak-secure.tls=true"

  beat:
    image: ${TCS_IMAGE}
    restart: always
    command: "python3 -m tcs.cmd.beat"
    volumes:
      - ./tcs:/app
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - redis
      - rabbitmq

  flower:
    image: ${TCS_IMAGE}
    restart: always
    command: "python3 -m tcs.cmd.flower"
    volumes:
      - ./tcs:/app
    depends_on:
      - redis
      - rabbitmq
    ports:
      - ${TCS_LISTEN_ADDRESS_INTERNAL_SERVICES}:10002:5555

  worker:
    image: ${TCS_IMAGE}
    restart: always
    command: "python3 -m tcs.cmd.worker"
    volumes:
      - ./tcs:/app
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - redis
      - rabbitmq

  api:
    image: ${TCS_IMAGE}
    restart: always
    command: "python3 -m tcs.cmd.api"
    volumes:
      - ./tcs:/app
    depends_on:
      redis:
        condition: service_started
      rabbitmq:
        condition: service_started
      beat:
        condition: service_started
      keycloak:
        condition: service_started
      mariadb:
        condition: service_healthy
      worker:
        condition: service_started
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.api.loadbalancer.server.port=8080"
      - "traefik.http.services.api.loadbalancer.passhostheader=true"
      - "traefik.http.routers.api-secure.rule=Host(`${TCS_DOMAIN_API}`)"
      - "traefik.http.routers.api-secure.entrypoints=https"
      - "traefik.http.routers.api-secure.tls=true"

volumes:
  mariadb:
  minio-1:
  minio-2:

networks:
  default:
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: 1400