.drone-prod-stack.example.yml

version: '3.7'

services:
  drone-server:
    image: drone/drone:1.6.5
    ports:
      - protocol: tcp
        published: 8090
        target: 80
    # hostname: drone-server
    volumes:
      - /var/swarm/drone/server/sqlite-data:/data:rw
      - /var/swarm/drone/server/config:/config:ro
      # https://docs.docker.com/storage/bind-mounts/
    logging:
      driver: json-file
      options:
        max-size: '5m'
        max-file: '3'
    # depends_on:
    #   - traefik
    env_file:
      - /var/swarm/drone/server/config/.env.drone.server
    environment:
      - DRONE_SERVER_HOST_TRAEFIK
      - DRONE_SERVER_PORT_TRAEFIK
    networks:
      drone_rpc:
        aliases:
          - drone-net
    deploy:
      labels:
        # network
        - 'traefik.enable=true'
        - 'traefik.docker.network=drone_rpc'

        # routers http
        - 'traefik.http.routers.drone-http.rule=(Host(`${DRONE_SERVER_HOST_TRAEFIK}`) && (PathPrefix(`/authorize`) || PathPrefix(`/login`) || PathPrefix(`/rpc`)))'
        - 'traefik.http.routers.drone-http.entrypoints=drone-server'
        - 'traefik.http.routers.drone-http.service=drone-server@docker'
        # - 'traefik.http.middlewares.drone-strip-prefix.stripPrefix.prefixes=/rpc'
        # - 'traefik.http.routers.drone-http.middlewares=drone-strip-prefix@docker'
        # - 'traefik.http.routers.drone-http.middlewares=drone_https_mdlwr@docker'
        # - 'traefik.http.routers.drone-http.middlewares=https_redirect'

        # routers https
        # - 'traefik.http.routers.drone-https.entrypoints=drone_server_entry'
        # - 'traefik.http.routers.drone-https.rule=Host(`${DRONE_SERVER_HOST_TRAEFIK}`)'
        # - 'traefik.http.routers.drone-https.tls=true'
        # - 'traefik.http.routers.drone-https.tls.certresolver=default'
        # - 'traefik.http.routers.drone-https.tls.certresolver=mycert'

        # middlewares
        ## - 'traefik.http.middlewares.drone-https_mdlwr.redirectscheme.scheme=https'
        # - 'traefik.http.middlewares.https_redirect.redirectscheme.scheme=https'
        # - 'traefik.http.middlewares.https_redirect.redirectscheme.permanent=true'

        # services
        - 'traefik.http.services.drone-server.loadbalancer.server.port=${DRONE_SERVER_PORT_TRAEFIK}'
        - 'traefik.http.services.drone-server.loadbalancer.server.scheme=http'

      # placement:
      #   constraints:
      #     - node.role != manager
      mode: replicated
      # Switching to dnsrr, to use an external load balancer without the routing mesh:
      # https://docs.docker.com/engine/swarm/ingress/#without-the-routing-mesh
      # endpoint_mode: dnsrr # drone-server:8088
      replicas: 1
      update_config:
        parallelism: 1
        delay: 5s
        failure_action: pause
        order: start-first
        monitor: 10s
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3

  # drone/drone-runner-docker:1.2
  drone-agent:
    image: drone/drone-runner-docker:1.2.1
    ports:
      - protocol: tcp
        published: 3002
        target: 3000
    # command: agent
    logging:
      driver: json-file
      options:
        max-size: '5m'
        max-file: '3'
    depends_on:
      - drone-server
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/swarm/drone/agent/data:/data:rw
      - /var/swarm/drone/agent/config:/config:ro
    env_file:
      - /var/swarm/drone/agent/config/.env.drone.agent
    environment:
      - DRONE_AGENT_HOST
      - DRONE_AGENT_PORT_TRAEFIK
    networks:
      drone_rpc:
        aliases:
          - drone-net
    deploy:
      labels:
        - 'traefik.enable=true'
        - 'traefik.docker.network=drone_rpc'

        # routers http
        - 'traefik.http.routers.drone_ci.entrypoints=drone-agent'
        - 'traefik.http.routers.drone_ci.rule=Host(`${DRONE_AGENT_HOST}`)'

        # service
        - 'traefik.http.services.drone-agent.loadbalancer.server.port=${DRONE_AGENT_PORT_TRAEFIK}'
        - 'traefik.http.services.drone-agent.loadbalancer.server.scheme=http'
      placement:
        # constraints:
        #   - node.role != manager
        preferences:
          - spread: node.labels.drone_ci
      mode: replicated
      # endpoint_mode: dnsrr
      replicas: 1
      update_config:
        parallelism: 1
        delay: 5s
        failure_action: pause
        order: start-first
        monitor: 10s
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3

  # global routing server & dashboard configuration / reverse proxy
  # https://github.com/cbirkenbeul/docker-homelab/tree/master/traefik
  traefik:
    image: traefik:v2.1.6
    command:
      - '--configFile=/etc/traefik/config/traefik.toml' # read it from the mounted volume
      # - "--certificatesResolvers.my-resolver.acme.dnsChallenge=true"
    environment:
      - TRAEFIK_HOST
      - TRAEFIK_DASHBOARD_SERVICE_PORT
    env_file:
      - /var/swarm/traefik/.env.provider
    ports:
      # web endpoint, see: ./traefik/config/traefik.toml
      - '80:80/tcp'
      # web-secure endpoint
      - '443:443/tcp'
      # backend-secure endpoint
      - '8443:8443/tcp'
      - protocol: tcp
        published: 9010
        target: 9009
      # - old syntax: '9010:9009/tcp' # traefik dashboard
    networks:
      traefik_proxy:
        aliases:
          - traefik-proxy-net
      # microservices:
      #   aliases:
      #     - microservices-net
    logging:
      driver: json-file
      options:
        max-size: '10m'
        max-file: '3'
    deploy:
      restart_policy:
        condition: on-failure
        # condition: any
      mode: replicated
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: pause
        order: start-first
        monitor: 30s
      placement:
        constraints:
          - node.role == manager
      labels:
        # network
        - 'traefik.enable=true'
        - 'traefik.docker.network=traefik_proxy'

        # routers http
        - 'traefik.http.routers.api.rule=(Host(`${TRAEFIK_HOST}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`)))'
        - 'traefik.http.routers.api.entryPoints=traefik'
        - 'traefik.http.routers.api.service=api@internal'
        - 'traefik.http.routers.api.tls=true'
        - 'traefik.http.routers.api.middlewares=auth-mdlwr,gzip'

        ## - 'traefik.http.routers.api.middlewares=api_tls_mdlwr@docker'
        # - 'traefik.http.routers.api.middlewares=https_redirect'
        # http://www.htaccesstools.com/htpasswd-generator/

        # optional certificate's configuration
        # - 'traefik.http.routers.api.tls.certresolver=my-resolver'
        # - 'traefik.http.routers.api_tls.tls.domains[0].main=traefik.company.com'
        # - 'traefik.http.routers.api.tls.domains[0].sans=*.company.org'

        # services
        - 'traefik.http.services.traefik.loadbalancer.server.port=${TRAEFIK_DASHBOARD_SERVICE_PORT}'
        - 'traefik.http.services.traefik.loadbalancer.server.scheme=http'
        # - 'traefik.http.services.traefik-svc.loadbalancer.server.scheme=https'
        # - 'traefik.port=`$TRAEFIK_DASHBOARD_PORT`'

        # middlewares
        ## - 'traefik.http.middlewares.api_tls_mdlwr.redirectscheme.scheme=https'
        ## - 'traefik.http.middlewares.api_tls_mdlwr.redirectscheme.permanent=true'
        ##### - 'traefik.http.middlewares.api_tls_mdlwr.redirectscheme.port=${TRAEFIK_DASHBOARD_PORT}'
        # GZip compression for traffic
        - 'traefik.http.middlewares.gzip.compress=true'
        - 'traefik.http.middlewares.auth-mdlwr.basicauth.users=${TRAEFIK_AUTH_DATA}'

        # https://blog.creekorful.com/how-to-expose-traefik-2-dashboard-securely-docker-swarm/
        # configuration example: https://docs.traefik.io/migration/v1-to-v2/
        # https://docs.traefik.io/operations/dashboard/#secure-mode
        # TODO: paste <user>/<pass> in the above line by generating with:
        # sudo apt install apache2-utils -y
        # echo $(htpasswd -nbB <USER> "<PASS>") | sed -e s/\\$/\\$\\$/g
        # You can then access the dashboard at http://traefik.example.com:9009 or at http://<Traefik IP>:9009/dashboard/
        # or just do: curl -s 127.0.0.1:9009/api/rawdata | jq .
    depends_on:
      - backend
      - frontend
      - drone-server
      # - search
      # - db
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /etc/localtime:/etc/localtime
      - /var/swarm/traefik/acme:/etc/traefik/acme
      - /var/swarm/traefik/config:/etc/traefik/config
      - /var/swarm/traefik/config/dynamic:/etc/traefik/config/dynamic
      - /var/swarm/traefik/certs:/etc/traefik/certs
      - /var/swarm/traefik/logs:/logs
      # - /var/swarm/traefik/access.log:/traefik.access.log
      # - /var/swarm/traefik/.htpasswd:/.htpasswd

networks:
  traefik_proxy:
    driver: overlay
    external: true
    attachable: true
  drone_rpc:
    driver: overlay
    external: true
    attachable: true
  microservices:
    driver: overlay
    external: false
    attachable: true
# Shell commands:
# docker network create --scope=swarm --driver=overlay --attachable traefik_proxy
# docker network create --scope=swarm --driver=overlay --attachable drone_rpc
# docker network create --scope=swarm --driver=overlay --attachable microservices
# docker-compose -f drone-traefik.prod.yml -f microservices.prod.yml config > final-stack.yml
# docker stack deploy -c final-stack.yml drone-ci-traefik
# Consider this set-up script: https://github.com/Starttoaster/docker-traefik