docker-compose.yml

services:
  traefik:
    image: traefik
    restart: always
    command:
      - "--certificatesresolvers.stackresolver.acme.email=$EMAIL"
      - "--configFile=/etc/traefik.yml"
    labels:
      - "traefik.http.routers.dashboard.rule=Host(`$HOSTNAME`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.dashboard.tls.certresolver=stackresolver"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.middlewares.auth.basicauth.users=$ADMIN:$ADMIN_PASS"
      - "traefik.http.routers.dashboard.middlewares=auth"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./logs/:/logs/:rw
      - ./certs:/letsencrypt
      - ./conf/traefik.yml:/etc/traefik.yml:ro
      - ./conf/traefik/:/etc/traefik
    depends_on:
      - adminer
      - logpager
      - guac
      - www

  logpager:
    image: ghcr.io/jonbirge/logpager:dev
    restart: always
    environment:
      SQL_HOST: db
      SQL_USER: sqluser
      SQL_PASS: $SQL_PASS
    labels:
      - "traefik.http.routers.logpagerdev.rule=Host(`$HOSTNAME`) && PathPrefix(`/logs`)"
      - "traefik.http.routers.logpagerdev.tls.certresolver=stackresolver"
      - "traefik.http.middlewares.striplogdev.stripprefix.prefixes=/logs/"
      - "traefik.http.routers.logpagerdev.middlewares=topten@file,striplogdev"
    volumes:
      - /var/log/auth.log:/auth.log:ro
      - /var/log/auth.log.1:/auth.log.1:ro
      - ./logs/access.log:/access.log:ro
      - ./logs/access.log.1:/access.log.1:ro
      - ./logs/blacklist.csv:/blacklist.csv:rw
      - ../logpager/src:/var/www:ro  # live development
    depends_on:
      - db

  www:
    image: nginx
    restart: always
    labels:
      - "traefik.http.routers.www.rule=(Host(`$DOMAIN`) || Host(`www.$DOMAIN`)) && PathPrefix(`/`)"
      - "traefik.http.routers.www.tls.certresolver=pubresolver"
    volumes:
      - ./www:/usr/share/nginx/html:rw
      - ./conf/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - php

  php:
    image: bitnami/php-fpm
    restart: always
    volumes:
      - ./www:/usr/share/nginx/html:rw

  db:
    image: mysql
    restart: always
    volumes:
      - ./db:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: $SQL_ROOT_PASS
      MYSQL_USER: sqluser
      MYSQL_PASSWORD: $SQL_PASS

  adminer:
    image: adminer
    restart: always
    environment:
      ADMINER_DESIGN: nette
    labels:
      - "traefik.http.routers.adminer.rule=Host(`$HOSTNAME`) && PathPrefix(`/adminer`)"
      - "traefik.http.routers.adminer.tls.certresolver=stackresolver"
      - "traefik.port=8080"
      - "traefik.http.routers.adminer.middlewares=usonly@file"
    depends_on:
      - db

  guacd:
    image: guacamole/guacd
    restart: always

  guac:
    image: guacamole/guacamole
    restart: always
    volumes:
      - guac-config:/config
    environment:
      TOTP_ENABLED: "true"
      MYSQL_HOSTNAME: db
      MYSQL_DATABASE: guacamole_db
      MYSQL_USER: sqluser
      MYSQL_PASSWORD: $SQL_PASS
      GUACAMOLE_HOME: /config
      GUACD_HOSTNAME: guacd
    labels:
      - "traefik.http.routers.guacamole.rule=Host(`$HOSTNAME`) && PathPrefix(`/guacamole`)"
      - "traefik.http.routers.guacamole.tls.certresolver=stackresolver"
      - "traefik.http.routers.guacamole.middlewares=topten@file"
    depends_on:
      - db
      - guacd

  watchtower:
    image: containrrr/watchtower
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --interval 3600

volumes:
  guac-config: