docker-compose.yml

version: "3.8"

services:

  # Securing docker.sock access
  docker-proxy:
    container_name: docker-proxy
    environment:
      CONTAINERS: 1
    image: tecnativa/docker-socket-proxy
    networks:
      - backend
    ports:
      - 2375
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  # Traefik front-end
  traefik:
    depends_on:
      - docker-proxy
    image: traefik
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - frontend
      - backend
    ports:
      - 80:80
      - 443:443
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./traefik/traefik.yml:/traefik.yml:ro
      - ./traefik/acme.json:/acme.json
      - ./traefik/access.log:/data/access.log
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`$TRAEFIK_URL`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=$TRAEFIK_BASIC_AUTH_PASSWD"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`$TRAEFIK_URL`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=http"
      - "traefik.http.routers.traefik-secure.service=api@internal"

  ## Matomo Analytics
  db:
    image: mariadb
    container_name: mariadb
    networks:
      - backend
    command: --max-allowed-packet=64MB
    restart: always
    volumes:
      - ./matomo/db:/var/lib/mysql
    # environment:
    #   - MYSQL_ROOT_PASSWORD=supers1cret0
    env_file:
      - ./matomo/db.env
  matomo:
    depends_on:
      - db
    image: matomo
    container_name: matomo
    restart: always
    networks:
      - backend
    volumes:
      - ./matomo/www-data:/var/www/html
    environment:
      - MATOMO_DATABASE_HOST=db
    env_file:
      - ./matomo/db.env
    ports:
      - target: 80
        protocol: tcp
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.matomo.entrypoints=http"
      - "traefik.http.routers.matomo.rule=Host(`$MATOMO_URL`)"
      - "traefik.http.middlewares.matomo-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.matomo.middlewares=matomo-https-redirect"
      - "traefik.http.routers.matomo-secure.entrypoints=https"
      - "traefik.http.routers.matomo-secure.rule=Host(`$MATOMO_URL`)"
      - "traefik.http.routers.matomo-secure.tls=true"
      - "traefik.http.routers.matomo-secure.tls.certresolver=http"
      - "traefik.http.routers.matomo-secure.service=matomo"
      - "traefik.http.services.matomo.loadbalancer.server.port=80"

  ## Remark42
  remark42:
    image: umputun/remark42:latest
    container_name: "remark42"
    hostname: "remark42"
    restart: always
    networks:
      - backend
    volumes:
      - ./remark42/var:/srv/var
    ports:
      - target: 80
        protocol: tcp
    env_file:
      - ./remark42/remark42.env
    environment:
      - APP_UID=1000  # runs Remark42 app with non-default UID
      - TIME_ZONE=Europe/Madrid
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.remark42.entrypoints=http"
      - "traefik.http.routers.remark42.rule=Host(`$REMARK42_URL`)"
      - "traefik.http.middlewares.remark42-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.remark42.middlewares=remark42-https-redirect"
      - "traefik.http.routers.remark42-secure.entrypoints=https"
      - "traefik.http.routers.remark42-secure.rule=Host(`$REMARK42_URL`)"
      - "traefik.http.routers.remark42-secure.tls=true"
      - "traefik.http.routers.remark42-secure.tls.certresolver=http"
      - "traefik.http.routers.remark42-secure.service=remark42"
      - "traefik.http.services.remark42.loadbalancer.server.port=80"
      - "traefik.http.middlewares.remark42.headers.accesscontrolalloworiginlist=*"

  # MyWebsite
  mywebsite:
    depends_on:
      - traefik
    image: httpd:2.4-alpine
    container_name: "mywebsite"
    hostname: "mywebsite"
    restart: always
    networks:
      - backend
    volumes:
      - ./mywebsite/_site:/usr/local/apache2/htdocs/
    ports:
      - target: 80
        protocol: tcp
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mywebsite.entrypoints=http"
      - "traefik.http.routers.mywebsite.rule=Host(`$MYWEBSITE_URL`)"
      - "traefik.http.middlewares.mywebsite-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.mywebsite.middlewares=mywebsite-https-redirect"
      - "traefik.http.routers.mywebsite-secure.entrypoints=https"
      - "traefik.http.routers.mywebsite-secure.rule=Host(`$MYWEBSITE_URL`)"
      - "traefik.http.routers.mywebsite-secure.tls=true"
      - "traefik.http.routers.mywebsite-secure.tls.certresolver=http"
      - "traefik.http.routers.mywebsite-secure.service=mywebsite"
      - "traefik.http.services.mywebsite.loadbalancer.server.port=80"

networks:
  frontend:
    external: true
  backend:
    external: true