docker-compose.yaml

services:

  traefik:
    build:
      context: ./
      dockerfile: ./build/Dockerfile-traefik
    image: traefik:custom
    container_name: traefik
    restart: unless-stopped
    volumes:
      - certificates:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - auth_network
      - passwords_network
      - cloud_network
      - dav_network
      - bookmarks_network
      - maps_network
      - mail_network
      - git_network
      - notes_network
    ports:
      - "443:443"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`${STATUS_DOMAIN}`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.tls=true"
      - "traefik.http.routers.api.tls.certresolver=default"
      - "traefik.http.middlewares.auth.basicauth.users=${STATUS_CREDENTIALS}"
      - "traefik.http.routers.api.middlewares=auth"
      - "traefik.http.routers.api.middlewares=security@file"
    healthcheck:
      test: traefik healthcheck
      interval: 120s
      retries: 5
      start_period: 30s
      timeout: 10s

  # MySQL (database: Passbolt, Davis, Gitea)
  mysql:
    build:
      context: ./
      dockerfile: ./build/Dockerfile-mysql
    image: mariadb:custom
    container_name: mysql
    environment:
      - MARIADB_AUTO_UPGRADE=1
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - PASSBOLT_DATABASE=${PASSBOLT_DATABASE}
      - PASSBOLT_DB_USERNAME=${PASSBOLT_DB_USERNAME}
      - PASSBOLT_DB_PASSWORD=${PASSBOLT_DB_PASSWORD}
      - DAVIS_DATABASE=${DAVIS_DATABASE}
      - DAVIS_DB_USERNAME=${DAVIS_DB_USERNAME}
      - DAVIS_DB_PASSWORD=${DAVIS_DB_PASSWORD}
      - GITEA_DATABASE=${GITEA_DATABASE}
      - GITEA_DB_USERNAME=${GITEA_DB_USERNAME}
      - GITEA_DB_PASSWORD=${GITEA_DB_PASSWORD}
    restart: unless-stopped
    volumes:
      - database_mysql_volume:/var/lib/mysql
    networks:
      - passwords_network
      - dav_network
      - git_network
    healthcheck:
      test: healthcheck.sh --su-mysql --connect --innodb_initialized
      interval: 120s
      retries: 5
      start_period: 30s
      timeout: 10s

  # PostgreSQL (database: Outline)
  postgres:
    build:
      context: ./
      dockerfile: ./build/Dockerfile-pgsql
    image: postgres:custom
    container_name: postgres
    environment:
      - POSTGRES_PASSWORD=${PGSQL_ROOT_PASSWORD}
      - OUTLINE_DATABASE=${OUTLINE_DATABASE}
      - OUTLINE_DB_USERNAME=${OUTLINE_DB_USERNAME}
      - OUTLINE_DB_PASSWORD=${OUTLINE_DB_PASSWORD}
    restart: unless-stopped
    volumes:
      - database_pgsql_volume:/var/lib/postgresql/data
    networks:
      - notes_network
    healthcheck:
      test: ["CMD", "pg_isready"]
      interval: 30s
      timeout: 20s
      retries: 3

  # Redis (RAM storage)
  redis:
    image: redis
    restart: unless-stopped
    container_name: redis
    networks:
      - notes_network
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 30s
      retries: 3

  # Authelia (OIDC provider)
  authelia:
    build:
      context: ./
      dockerfile: ./build/Dockerfile-authelia
    image: authelia:custom
    container_name: authelia
    restart: unless-stopped
    networks:
      - auth_network
    volumes:
      - authelia_config:/config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.authelia.entrypoints=websecure"
      - "traefik.http.routers.authelia.rule=Host(`${AUTH_DOMAIN}`)"
      - "traefik.http.routers.authelia.tls=true"
      - "traefik.http.routers.authelia.tls.certresolver=default"
      - "traefik.http.routers.authelia.middlewares=security@file"
    #   - 'traefik.http.middlewares.authelia.forwardauth.address=https://${AUTH_DOMAIN}/api/authz/forward-auth?authelia_url=https://${AUTH_DOMAIN}'
    #   - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
    #   - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email'

  # Passbolt (password manager)
  passbolt:
    build:
      context: ./
      dockerfile: ./build/Dockerfile-passbolt
    image: passbolt:custom
    container_name: passbolt
    environment:
      - APP_FULL_BASE_URL=https://${PASSWORDS_DOMAIN}
      - DATASOURCES_DEFAULT_HOST=mysql
      - DATASOURCES_DEFAULT_DATABASE=${PASSBOLT_DATABASE}
      - DATASOURCES_DEFAULT_USERNAME=${PASSBOLT_DB_USERNAME}
      - DATASOURCES_DEFAULT_PASSWORD=${PASSBOLT_DB_PASSWORD}
      - EMAIL_DEFAULT_FROM=no-reply@${TOP_DOMAIN}
      - EMAIL_TRANSPORT_DEFAULT_HOST=${MAIL_HOST}
      - EMAIL_TRANSPORT_DEFAULT_PORT=${MAIL_PORT}
      - EMAIL_TRANSPORT_DEFAULT_TLS=true
      - EMAIL_TRANSPORT_DEFAULT_USERNAME=no-reply@${TOP_DOMAIN}
      - EMAIL_TRANSPORT_DEFAULT_PASSWORD=${MAIL_NO_REPLY_PASSWORD}
      - PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED=TRUE
      - PASSBOLT_PLUGINS_MOBILE_ENABLED=TRUE
      - PASSBOLT_SECURITY_SMTP_SETTINGS_ENDPOINTS_DISABLED=TRUE
    restart: unless-stopped
    command: ["/usr/bin/wait-for.sh", "mysql:3306", "--", "/docker-entrypoint.sh"]
    tty: true
    depends_on:
      - mysql
    volumes:
      - passbolt_gpg_volume:/etc/passbolt/gpg:ro
      - passbolt_jwt_volume:/etc/passbolt/jwt:ro
    networks:
      - passwords_network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.passbolt.entrypoints=websecure"
      - "traefik.http.routers.passbolt.rule=Host(`${PASSWORDS_DOMAIN}`)"
      - "traefik.http.routers.passbolt.tls=true"
      - "traefik.http.routers.passbolt.tls.certresolver=default"
      - "traefik.http.routers.passbolt.middlewares=security@file"
    healthcheck:
      test: curl --fail http://localhost:80 || exit 1
      interval: 120s
      retries: 5
      start_period: 30s
      timeout: 10s

  # Filebrowser (cloud files server)
  filebrowser:
    # https://hub.docker.com/r/filebrowser/filebrowser/tags
    image: filebrowser/filebrowser:v2.56.0-s6
    container_name: filebrowser
    environment:
      - FB_PASSWORD=${FILEBROWSER_PASSWORD_HASHED}
      - FB_USERNAME=${FILEBROWSER_USERNAME}
      - FB_DATABASE=/database/filebrowser.db
    restart: unless-stopped
    volumes:
      - files_filebrowser_volume:/srv
      - database_filebrowser_volume:/database
    networks:
      - cloud_network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.filebrowser.entrypoints=websecure"
      - "traefik.http.routers.filebrowser.rule=Host(`${CLOUD_DOMAIN}`)"
      - "traefik.http.routers.filebrowser.tls=true"
      - "traefik.http.routers.filebrowser.tls.certresolver=default"
      - "traefik.http.routers.filebrowser.middlewares=security@file"

  davis:
    image: ghcr.io/tchapi/davis-standalone:5.4.0
    container_name: davis
    environment:
      - APP_ENV=prod
      - APP_SECRET=${DAVIS_APP_SECRET}
      - APP_TIMEZONE=Europe/Paris
      - DATABASE_DRIVER=mysql
      - DATABASE_URL=mysql://${DAVIS_DB_USERNAME}:${DAVIS_DB_PASSWORD}@mysql:3306/${DAVIS_DATABASE}?charset=utf8mb4&serverVersion=10.9.3-MariaDB
      - MAILER_DSN=smtp://no-reply%40${TOP_DOMAIN}:${MAIL_NO_REPLY_PASSWORD}@${MAIL_HOST}:${MAIL_PORT} # %40 = encoded @
      - ADMIN_LOGIN=${DAVIS_ADMIN_LOGIN}
      - ADMIN_PASSWORD=${DAVIS_ADMIN_PASSWORD}
      - AUTH_REALM=${DAVIS_AUTH_REALM}
      - AUTH_METHOD=Basic
      - IMAP_AUTH_URL=null
      - CALDAV_ENABLED=true
      - CARDDAV_ENABLED=true
      - WEBDAV_ENABLED=true
      - INVITE_FROM_ADDRESS=no-reply@${TOP_DOMAIN}
      - WEBDAV_PUBLIC_DIR=/webdav
      - WEBDAV_TMP_DIR=/tmp
      - PUBLIC_CALENDARS_ENABLED=true
      - SYMFONY_TRUSTED_PROXIES=REMOTE_ADDR
    restart: unless-stopped
    depends_on:
      - mysql
    volumes:
      - files_webdav_volume:/webdav
    networks:
      - dav_network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.davis.entrypoints=websecure"
      - "traefik.http.routers.davis.rule=Host(`${DAV_DOMAIN}`)"
      - "traefik.http.routers.davis.tls=true"
      - "traefik.http.routers.davis.tls.certresolver=default"
      - "traefik.http.routers.davis.middlewares=security@file"
    healthcheck:
      test: curl --fail http://localhost:9000 || exit 1
      interval: 120s
      retries: 5
      start_period: 30s
      timeout: 10s

  linkding:
    # https://hub.docker.com/r/sissbruecker/linkding/tags
    image: sissbruecker/linkding:1.45.0
    container_name: linkding
    restart: unless-stopped
    volumes:
      - files_linkding_volume:/etc/linkding/data
    networks:
      - bookmarks_network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.linkding.entrypoints=websecure"
      - "traefik.http.routers.linkding.rule=Host(`${BOOKMARKS_DOMAIN}`)"
      - "traefik.http.routers.linkding.tls=true"
      - "traefik.http.routers.linkding.tls.certresolver=default"
      - "traefik.http.routers.linkding.middlewares=security@file"
    healthcheck:
      test: curl --fail http://localhost:9090/login/ || exit 1
      interval: 120s
      retries: 5
      start_period: 30s
      timeout: 10s

  # Mails (bound on a specific IP for the reverse to be unique)
  mailserver:
    build:
      context: ./
      dockerfile: ./build/Dockerfile-mailserver
      args:
        mail_principal_user: ${MAIL_PRINCIPAL_USER}
        mail_principal_password: ${MAIL_PRINCIPAL_PASSWORD}
        mail_no_reply_password: ${MAIL_NO_REPLY_PASSWORD}
        top_domain: ${TOP_DOMAIN}
    image: mailserver:custom
    container_name: mail
    restart: unless-stopped
    networks:
      - mail_network
    hostname: ${MAIL_DOMAIN}  # (The DNS MX record should point to this value)
    ports:
      - "${MAIL_HOST_IP}:25:25"    # SMTP  (explicit TLS => STARTTLS)
      - "${MAIL_HOST_IP}:143:143"  # IMAP4 (explicit TLS => STARTTLS)
      - "${MAIL_HOST_IP}:465:465"  # ESMTP (implicit TLS)
      - "${MAIL_HOST_IP}:587:587"  # ESMTP (explicit TLS => STARTTLS)
      - "${MAIL_HOST_IP}:993:993"  # IMAP4 (implicit TLS)
    volumes:
      - mails_data_volume:/var/mail
      - certificates:/etc/letsencrypt
      - mails_state_volume:/var/mail-state/
    environment:
      - LOG_LEVEL=info
      - OVERRIDE_HOSTNAME=${MAIL_DOMAIN}
      - TZ=Europe/Paris
      - ENABLE_RSPAMD=1
      - ENABLE_OPENDKIM=0
      - ENABLE_OPENDMARC=0
      - ENABLE_POLICYD_SPF=0
      - ENABLE_AMAVIS=0
      - ENABLE_SPAMASSASSIN=0
      - ENABLE_CLAMAV=1
      - ENABLE_FAIL2BAN=1
      - SSL_TYPE=letsencrypt
      - SSL_DOMAIN=${MAIL_DOMAIN}
      - POSTFIX_MESSAGE_SIZE_LIMIT=204800000  # 200 MB, useful for moving large threads with images
      - POSTMASTER_ADDRESS=postmaster@${TOP_DOMAIN}
    cap_add:
      - NET_ADMIN # For Fail2Ban to work
    healthcheck:
      test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
      timeout: 30s
      retries: 0

  # This container is also used by traefik as the endpoint
  # to get certificates for MAIL_DOMAIN.
  webmail:
    build:
      context: ./
      dockerfile: ./build/Dockerfile-snappymail
      args:
        top_domain: ${TOP_DOMAIN}
    image: snappymail:custom
    container_name: snappymail
    restart: unless-stopped
    networks:
      - mail_network
    volumes:
      - snappymail_data:/var/lib/snappymail
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mail.entrypoints=websecure"
      - "traefik.http.routers.mail.rule=Host(`${MAIL_DOMAIN}`)"
      - "traefik.http.routers.mail.tls=true"
      - "traefik.http.routers.mail.tls.certresolver=default"
      - "traefik.http.routers.mail.middlewares=security@file"
      - "traefik.http.services.mail.loadbalancer.server.port=8888"
  
  # kvtiles (Maps)
  maps:
    # See https://hub.docker.com/r/akhenakh/kvtiles/tags
    image: akhenakh/kvtiles:planet-10-latest
    container_name: maps
    restart: unless-stopped
    command: ["-tilesKey=${MAPS_API_KEY}"] # entrypoint is ["./kvtilesd"]
    networks:
      - maps_network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.maps.entrypoints=websecure"
      - "traefik.http.routers.maps.rule=Host(`${MAPS_DOMAIN}`)"
      - "traefik.http.routers.maps.tls=true"
      - "traefik.http.routers.maps.tls.certresolver=default"
      - "traefik.http.routers.maps.middlewares=security@file"
      - "traefik.http.services.maps.loadbalancer.server.port=8080"
    profiles: # https://stackoverflow.com/a/65957695
      - donotstart # [deactivated as resource hungry]

  # Gitea (git)
  # See https://docs.gitea.io/en-us/install-with-docker/
  # and https://github.com/go-gitea/gitea for the version
  gitea:
    image: gitea/gitea:1.25.4
    container_name: git
    environment:
      - USER_UID=2022
      - USER_GID=2022
      - GITEA__APP_NAME=${GIT_DOMAIN}
      - GITEA__database__DB_TYPE=mysql
      - GITEA__database__HOST=mysql:3306
      - GITEA__database__NAME=${GITEA_DATABASE}
      - GITEA__database__USER=${GITEA_DB_USERNAME}
      - GITEA__database__PASSWD=${GITEA_DB_PASSWORD}
      - GITEA__mailer__ENABLED=true
      - GITEA__mailer__MAILER_TYPE=smtp
      - GITEA__mailer__HOST=${MAIL_HOST}:${MAIL_PORT}
      - GITEA__mailer__USER=no-reply@${TOP_DOMAIN}
      - GITEA__mailer__PASSWD=${MAIL_NO_REPLY_PASSWORD}
      - GITEA__mailer__FROM=no-reply@${TOP_DOMAIN}
      - GITEA__openid__ENABLE_OPENID_SIGNIN=false
      - GITEA__openid__ENABLE_OPENID_SIGNUP=false
      - GITEA__service__DISABLE_REGISTRATION=true
      - GITEA__service__ENABLE_TIMETRACKING=false
      - GITEA__service__NO_REPLY_ADDRESS=noreply.git
      - GITEA__service.explore__REQUIRE_SIGNIN_VIEW=true
      - GITEA__service.explore__DISABLE_USERS_PAGE=true
      - GITEA__server__ROOT_URL=https://${GIT_DOMAIN}
      - GITEA__server__SSH_DOMAIN=${GIT_DOMAIN}
      - GITEA__admin__DISABLE_REGULAR_ORG_CREATION=true
      - GITEA__security__INSTALL_LOCK=true
      - GITEA__i18n__LANGS=en-US
      - GITEA__i18n__NAMES=English
      # You need to copy the custom files to files_gitea_volume for this to work
      # - GITEA__ui__THEMES=github,github-dark
      # - GITEA__ui__DEFAULT_THEME=github-dark
    restart: unless-stopped
    depends_on:
      - mysql
    volumes:
      - files_gitea_volume:/data
      - /home/git/.ssh/:/data/git/.ssh
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      - git_network
    ports:
      - "127.0.0.1:2222:22"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.gitea.entrypoints=websecure"
      - "traefik.http.routers.gitea.rule=Host(`${GIT_DOMAIN}`)"
      - "traefik.http.routers.gitea.tls=true"
      - "traefik.http.routers.gitea.tls.certresolver=default"
      - "traefik.http.routers.gitea.middlewares=security@file"
      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
    healthcheck:
      test: curl --fail http://localhost:3000/api/healthz || exit 1
      interval: 120s
      retries: 5
      start_period: 30s
      timeout: 10s

  # Outline (Notion)
  # See https://docs.getoutline.com/s/hosting/doc/docker-7pfeLP5a8t
  outline:
    # https://hub.docker.com/r/outlinewiki/outline/tags
    image: outlinewiki/outline:1.5.0
    container_name: outline
    environment:
      - NODE_ENV=production
      - PGSSLMODE=disable
      - SECRET_KEY=${OUTLINE_SECRET_KEY}
      - UTILS_SECRET=${OUTLINE_UTILS_SECRET}
      - DATABASE_URL=postgres://${OUTLINE_DB_USERNAME}:${OUTLINE_DB_PASSWORD}@postgres:5432/${OUTLINE_DATABASE}
      - REDIS_URL=redis://redis:6379
      - URL=https://${NOTES_DOMAIN}
      - FORCE_HTTPS=false
      - FILE_STORAGE=local
      - FILE_STORAGE_LOCAL_ROOT_DIR=/var/lib/outline/data
      - FILE_STORAGE_UPLOAD_MAX_SIZE=26214400
      - ENABLE_UPDATES=false
      - SMTP_HOST=${MAIL_HOST}
      - SMTP_PORT=${MAIL_PORT}
      - SMTP_USERNAME=no-reply@${TOP_DOMAIN}
      - SMTP_PASSWORD=${MAIL_NO_REPLY_PASSWORD}
      - SMTP_FROM_EMAIL=no-reply@${TOP_DOMAIN}
      - SMTP_REPLY_EMAIL=no-reply@${TOP_DOMAIN}
      - SMTP_SECURE=true
      - OIDC_CLIENT_ID=outline
      - OIDC_CLIENT_SECRET=${OUTLINE_OIDC_CLIENT_SECRET}
      - OIDC_AUTH_URI=https://${AUTH_DOMAIN}/api/oidc/authorization
      - OIDC_TOKEN_URI=https://${AUTH_DOMAIN}/api/oidc/token
      - OIDC_USERINFO_URI=https://${AUTH_DOMAIN}/api/oidc/userinfo
      - OIDC_USERNAME_CLAIM=preferred_username
      - OIDC_DISPLAY_NAME=🔑 ${AUTH_DOMAIN}
      - OIDC_SCOPES=openid offline_access profile email
    depends_on:
      - postgres
      - redis
      - authelia
    volumes:
      - files_outline_volume:/var/lib/outline/data  # https://docs.getoutline.com/s/hosting/doc/file-storage-N4M0T6Ypu7
    networks:
      - notes_network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.outline.entrypoints=websecure"
      - "traefik.http.routers.outline.rule=Host(`${NOTES_DOMAIN}`)"
      - "traefik.http.routers.outline.tls=true"
      - "traefik.http.routers.outline.tls.certresolver=default"
      - "traefik.http.routers.outline.middlewares=security@file"

networks:
  auth_network: ~
  passwords_network: ~
  cloud_network: ~
  dav_network: ~
  bookmarks_network: ~
  # We force the subnet here, so we can use it in
  # the iptables routing command afterwards to make
  # the outgoing packets go through a specific IP.
  # See https://stackoverflow.com/a/46493740/1741150
  mail_network:
    ipam:
      config:
        - subnet: "172.100.0.0/16"
  maps_network: ~
  git_network: ~
  notes_network: ~

volumes:
  certificates:
    name: certificates
  # These volumes are named but we don't need them to be persistent
  redis_data: ~
  authelia_config: ~
  snappymail_data: ~
  # These volumes are actually attached OpenStack Block storage
  passbolt_gpg_volume:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/passbolt/gpg
  passbolt_jwt_volume:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/passbolt/jwt
  database_mysql_volume:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/databases/mysql
  database_pgsql_volume:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/databases/pgsql
  database_filebrowser_volume:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/databases/filebrowser
  files_filebrowser_volume: # It stores the filebrowser files
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/filebrowser
  mails_data_volume: # It stores the mail data
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/mails/data
  mails_state_volume: # It stores the mail "state" (redis db, etc)
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/mails/state
  files_webdav_volume: # It stores the webdav data
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/webdav
  files_gitea_volume: # It stores the gitea data
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/gitea
  files_linkding_volume:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/linkding
  files_outline_volume:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: /mnt/files/outline