docker-compose.yml

version: '3'
services:
  kemu-traefik:
    container_name: kemu-traefik
    image: traefik:v2.5
    privileged: true
    depends_on:
      - kemu-api
      - kemu-db
      - kemu-frontend
    command:
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.file.filename=/etc/traefik/traefik-dynamic.yml

      # Let's Encrypt
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json

      # Listen for https on 443, and http on 80 which just redirects to https
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls.certresolver=letsencrypt
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      
    ports:
      - 443:443
      - 80:80
      - 127.0.0.1:9092:8080

    volumes:
      - ./letsencrypt:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik-dynamic.yml:/etc/traefik/traefik-dynamic.yml

  kemu-frontend:
    container_name: kemu-frontend
    build: ./website
    restart: always
    environment:
      - PORT=3000
      - HOST=0.0.0.0
      - BASE_URL=http://api:3000/
      - BROWSER_BASE_URL=https://${DOMAIN}
    labels:
      - traefik.enable=true
      - traefik.http.routers.frontend.rule=Host(`${DOMAIN}`)
      - traefik.http.routers.frontend.entrypoints=websecure
      - traefik.http.routers.frontend.middlewares=security-headers@file

  kemu-api:
    container_name: kemu-api
    build: 
      context: ./
      dockerfile: backend.Dockerfile
    restart: always
    depends_on:
      - kemu-db
    environment:
      - ROCKET_PORT=3000
      - ROCKET_ADDRESS=0.0.0.0
      - BROWSER_BASE_URL=https://${DOMAIN}
      - ROCKET_DATABASES={postgres_database={url=postgres://api:${DB_PASS}@kemu-db:5432/api}}
      - JWT_EXPIRY_TIME_HOURS=${JWT_EXPIRY_HOURS}
      - JWT_SECRET=${JWT_SECRET}
      - DATABASE_URL=postgres://api:${DB_PASS}@kemu-db:5432/api # This seems like a duplicate, but it is needed to automate migrations
      
    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)
      - traefik.http.routers.api.entrypoints=websecure
      - traefik.http.routers.api.middlewares=security-headers@file

  kemu-db:
    container_name: kemu-db
    image: postgres:alpine
    restart: always
    environment:
      - POSTGRES_DB=api
      - POSTGRES_USER=api
      - POSTGRES_PASSWORD=${DB_PASS}
    volumes:
      - api-pgdata:/var/lib/postgresql/data

volumes:
  api-pgdata:
    external: true