docker-compose.production.swarm.example.yml

version: '3.7'

services:
  frontend:
    image: fuzzysouls/tg-aggregator-frontend:latest
    ports:
      # - 3333:3333 # old syntax of the published service port
      # published=<PUBLISHED-PORT>,target=<CONTAINER-PORT>
      - protocol: tcp
        published: 3333
        target: 3333
    networks:
      traefik_proxy:
        aliases:
          - traefik_proxy-net
    environment:
      - FRONTEND_HOST
      - SERVER_IP
    # - 'ES_CONNECTION_URI'
    deploy:
      labels:
        # network
        - 'traefik.enable=true'
        - 'traefik.docker.network=traefik_proxy'

        # configuration of the port and protocol of the internal docker service
        # that traefik needs to look for to load balance and make it accessible
        - 'traefik.http.services.frontend.loadbalancer.server.port=3333'
        - 'traefik.http.services.frontend.loadbalancer.server.scheme=http'
        - 'traefik.http.services.frontend.loadbalancer.passhostheader=true'
        - 'traefik.http.services.frontend.loadbalancer.sticky=true'

        # routers https
        - 'traefik.http.routers.frontend-https.tls=true'
        - 'traefik.http.routers.frontend-https.entrypoints=web-secure'
        # - 'traefik.http.routers.frontend-https.tls.certresolver=default'
        - 'traefik.http.routers.frontend-https.rule=Host(`${FRONTEND_HOST}`)'

        # routers
        # - 'traefik.http.routers.frontend-http.entrypoints=web'
        # - 'traefik.http.routers.frontend-http.rule=(Host(`${FRONTEND_HOST}`) && PathPrefix(`/`))'
        # - 'traefik.http.middlewares.frontend-strip-prefix.stripPrefix.prefixes=/'
        # - 'traefik.http.routers.frontend-http.middlewares=frontend-strip-prefix@docker'
        # - 'traefik.http.routers.frontend-http.service=frontend'
        # - 'traefik.http.routers.frontend-http.middlewares=frontend_https_mdlwr@docker'

        # middlewares
        - 'traefik.http.middlewares.frontend_https_mdlwr.redirectscheme.scheme=https'
        # - 'traefik.http.middlewares.frontend_https_mdlwr.redirectscheme.permanent=true'
        - 'traefik.http.middlewares.frontend_https_mdlwr.redirectscheme.port=443'

        # TODO: assign the service named 'frontend-service' in swarm
        # https://docs.traefik.io/routing/providers/docker/#service-definition
        # - 'traefik.port=3000'
      replicas: 1
      restart_policy:
        condition: on-failure
      # placement:
      #   constraints:
      #     - node.role == worker

  # dynamic configuration: https://docs.traefik.io/reference/dynamic-configuration/docker/
  backend:
    image: fuzzysouls/tg-aggregator-backend:latest
    ports:
      - protocol: tcp
        published: 8080
        target: 8080
      # - '9000:9000/tcp' # see ./server/Dockerfile.prod: pm2-runtime start server.js --web 9000
    networks:
      traefik_proxy:
        aliases:
          - traefik_proxy-net
    environment:
      - FRONTEND_HOST
      # required during the run of the backend service (backend container):
      - BOT_TOKEN
      - DB_CONNECTION_STRING
      - NODE_ENV
    deploy:
      labels:
        # network
        - 'traefik.enable=true'
        - 'traefik.docker.network=traefik_proxy'

        # routers
        - 'traefik.http.routers.backend-http.entrypoints=backend'
        - 'traefik.http.routers.backend-http.rule=(Host(`${FRONTEND_HOST}`) && PathPrefix(`/api/v1/posts`))'
        - 'traefik.http.routers.backend-http.service=backend'
        - 'traefik.http.routers.backend-http.middlewares=backend_https_mdlwr@docker'

        # middlewares
        - 'traefik.http.middlewares.backend_https_mdlwr.redirectscheme.scheme=https'
        - 'traefik.http.middlewares.backend_https_mdlwr.redirectscheme.permanent=true'
        - 'traefik.http.middlewares.backend_https_mdlwr.redirectscheme.port=8443'

        # routers https
        - 'traefik.http.routers.backend-https.entrypoints=backend-secure'
        - 'traefik.http.routers.backend-https.rule=( Host(`${FRONTEND_HOST}`) && PathPrefix(`/api/v1/posts`) )'
        - 'traefik.http.routers.backend-https.tls=true'

        # no need for TLS on the backend, as it's in internal network anyway

        # prefix api/v1/posts:
        # https://docs.traefik.io/migration/v1-to-v2/#strip-and-rewrite-path-prefixes

        # docker service's configuration (connection happens over the internal overlay network)
        - 'traefik.http.services.backend.loadbalancer.server.port=8080'
        - 'traefik.http.services.backend.loadbalancer.server.scheme=http'
        - 'traefik.http.services.backend.loadbalancer.passhostheader=true'
        - 'traefik.http.services.backend.loadbalancer.sticky=true'
        # https://docs.traefik.io/routing/providers/docker/#service-definition
        # https://docs.traefik.io/migration/v1-to-v2/#http-to-https-redirection-is-now-configured-on-routers
        # https://community.containo.us/t/middleware-redirectscheme-seemingly-ignored/3805/2
        # https://community.containo.us/t/does-insecureskipverify-work-differently-in-traefik-2-x/3677
        # prefix api/v1/posts:
        # https://docs.traefik.io/migration/v1-to-v2/#strip-and-rewrite-path-prefixes
      mode: replicated
      replicas: 1
      restart_policy:
        condition: on-failure
        max_attempts: 3
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: pause
        order: start-first
        monitor: 30s
      placement:
        constraints:
          - node.role == worker
      resources:
        limits:
          cpus: '0.50'
          memory: 256M
        reservations:
          cpus: '0.33'
          memory: 128M
# do not use the 'bridge' network on swarm in production if you need port communications between nodes: https://docs.docker.com/network/overlay/
# networks:
#   microservices:
#     driver: overlay
#     external: false # TODO: will the frontend service still be reachable (crawling requests)?
#     attachable: true
# internal: true # to block access to the outside world
# ----------------------------------
# services:
#   search:
#     build: './search'
#     image: elasticsearch
#     ports:
#       - "9200:9200"
#     ports:
#       - '9243:9100'
#     depends_on:
#       - db
#     environment:
#       - ELASTICSEARCH_URI=

#   db:
#     image: mongo
#     ports:
#       - '27017:27017'
#     # volumes:
# ----------------------------------
# delegate load balancing to swarm by setting:
# - "traefik.docker.lbswarm=true"
# https://docs.traefik.io/v2.0/routing/providers/docker/#traefikdockerlbswarm