docker-compose.yml

version: "3.8"

services:
  async_api:
    image: async_api
    container_name: async_api
    restart: always
    build:
      context: .
      dockerfile: backend/async_api/Dockerfile
    expose:
      - 8000
    environment:
      - DEBUG_MODE=false
      - URL_DATABASE=postgresql+asyncpg://handbook_user:<password>@postgresql/handbook # change
      - REDIS_HOST=redis_server
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.fastapi.rule=Host(`api.<domain>`)" # change
      - "traefik.http.routers.fastapi.tls=true"
      - "traefik.http.routers.fastapi.tls.certresolver=letsencrypt"
      # middlewares
      - "traefik.http.routers.fastapi.middlewares=security"
      - "traefik.http.middlewares.security.headers.accesscontrolallowmethods=GET,POST,HEAD"
      - "traefik.http.middlewares.security.headers.accesscontrolallowheaders=Content-Type,X-Use-Cache"
      - "traefik.http.middlewares.security.headers.accesscontrolallowcredentials=false"
      - "traefik.http.middlewares.security.headers.accesscontrolalloworiginlist=*" # change
      - "traefik.http.middlewares.security.headers.accesscontrolmaxage=600"
      - "traefik.http.middlewares.security.headers.framedeny=true"
      - "traefik.http.middlewares.security.headers.stsseconds=31536000"
      - "traefik.http.middlewares.security.headers.forcestsheader=true"
      - "traefik.http.middlewares.security.headers.customresponseheaders.server="
    depends_on:
      - postgresql
      - redis_server
    networks:
      - proxy_network

  admin:
    image: admin
    container_name: admin
    restart: always
    build:
      context: .
      dockerfile: backend/admin/Dockerfile
    expose:
      - 8001
    environment:
      - DEBUG_MODE=false
      - ALLOWED_HOSTS=["<host>"] # change
      - REDIS_HOST=redis_server
      - DATABASE_HOST=postgresql
      # for db async_api
      - DB_BACKEND_NAME=handbook
      - DB_BACKEND_USER=handbook_user
      - DB_BACKEND_PASSWORD=<password> # change
      # for db admin
      - DB_ADMIN_NAME=django_handbook
      - DB_ADMIN_USER=django_user
      - DB_ADMIN_PASSWORD=<password> # change
      # other
      - CSRF_COOKIE_SECURE=True
      - SESSION_COOKIE_SECURE=True
      - CORS_ALLOWED_ORIGINS=["https://<host>"] # change
      - CSRF_TRUSTED_ORIGINS=["https://<host>"] # change
      - SECRET_APP=<token> # without symbols$
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.admin.rule=Host(`admin-panel.<domain>`)" # change
      - "traefik.http.routers.admin.tls=true"
      - "traefik.http.routers.admin.tls.certresolver=letsencrypt"
      # middlewares
      - "traefik.http.routers.admin.middlewares=admin_security"
      - "traefik.http.middlewares.admin_security.headers.stsseconds=31536000"
      - "traefik.http.middlewares.admin_security.headers.forcestsheader=true"
      - "traefik.http.middlewares.admin_security.headers.customresponseheaders.server="
    volumes:
      - shared-media:/app/media
    depends_on:
      - postgresql
      - redis_server
    networks:
      - proxy_network

  postgresql:
    image: postgres:16.1
    container_name: postgresql_handbook
    restart: always
    expose:
      - 5432
    environment:
      - POSTGRES_PASSWORD=<password> # change
      # for async_api
      - BACKEND_USER=handbook_user
      - BACKEND_PASSWORD=<password> # change
      - BACKEND_DB=handbook
      # for admin
      - ADMIN_USER=django_user
      - ADMIN_PASSWORD=<password> # change
      - ADMIN_DB=django_handbook
    volumes:
      - ./scripts/init-user-db.sh:/docker-entrypoint-initdb.d/init-user-db.sh
      - pg-data:/var/lib/postgresql/data
    networks:
      - proxy_network

  redis_server:
    image: redis:7.2
    container_name: redis
    restart: always
    command: redis-server --maxmemory 512mb --maxmemory-policy allkeys-lru --loglevel warning --appendonly no
    expose:
      - 6379
    networks:
      - proxy_network

  media_server:
    image: joseluisq/static-web-server:2.24
    container_name: media_server
    restart: unless-stopped
    expose:
      - 8787
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.sws.rule=Host(`media.<domain>`)" # change
      - "traefik.http.routers.sws.tls=true"
      - "traefik.http.routers.sws.tls.certresolver=letsencrypt"
      # middlewares
      - "traefik.http.routers.sws.middlewares=sws_security"
      - "traefik.http.middlewares.sws_security.headers.stsseconds=31536000"
      - "traefik.http.middlewares.sws_security.headers.framedeny=true"
      - "traefik.http.middlewares.sws_security.headers.contentsecuritypolicy=frame-ancestors 'self'"
    volumes:
      - shared-media:/public:ro
    networks:
      - proxy_network

  traefik:
    image: traefik:2.11
    container_name: traefik
    restart: always
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.email=<email>" # change
      - "--certificatesresolvers.letsencrypt.acme.storage=/certificates/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--providers.file.directory=/etc/traefik_conf"
      - "--providers.file.watch=true"
    ports:
      - 80:80
      - 443:443
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./certificates:/certificates"
      - "./conf:/etc/traefik_conf"
    networks:
      - proxy_network

volumes:
  pg-data:
  shared-media:


networks:
  proxy_network:
    external: true