huly-selfhost/traefik/template-compose.yaml

x-common-env: &common-env
  SERVER_SECRET: ${HULY_SECRET}
  SECRET: ${HULY_SECRET}
  STORAGE_CONFIG: minio|minio?accessKey=minioadmin&secretKey=minioadmin
  MONGO_URL: mongodb://mongodb:27017
  DB_URL: mongodb://mongodb:27017
  ACCOUNTS_URL: http://account:3000
  STATS_URL: http://stats:4900

services:
  traefik:
    restart: unless-stopped
    image: "traefik:v2.10"
    container_name: "traefik"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - ./letsencrypt:/letsencrypt
    networks:
      - traefik-public
    command:
      - "--log.level=DEBUG" # set to INFO for production
      - "--api.insecure=false"
      - "--api.dashboard=true"
      - "--global.sendAnonymousUsage=false"
      - "--global.checkNewVersion=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik-public"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--certificatesresolvers.myresolver.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.caserver=http://acme-staging-v02.api.letsencrypt.org/directory" # For testing, comment out for production
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`${SERVER_ADDRESS}`) && (PathPrefix(`/api`) || PathPrefix(`/traefik`))"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      # strip prefix for traefik dashboard
      - "traefik.http.routers.traefik.middlewares=strip-prefix-traefik"
      - "traefik.http.middlewares.strip-prefix-traefik.stripprefix.prefixes=/traefik"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=myresolver"

  mongodb:
    image: mongo:7-jammy
    container_name: mongodb
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - db:/data/db
    networks:
      - internal-services

  minio:
    image: minio/minio
    restart: unless-stopped
    command: server /data --address ":9000" --console-address ":9001"
    volumes:
      - files:/data
    networks:
      - internal-services

  elastic:
    image: elasticsearch:7.14.2
    restart: unless-stopped
    command: |
      /bin/sh -c "./bin/elasticsearch-plugin list | grep -q ingest-attachment || yes | ./bin/elasticsearch-plugin install --silent ingest-attachment;
      /usr/local/bin/docker-entrypoint.sh eswrapper"
    volumes:
      - elastic:/usr/share/elasticsearch/data
    environment:
      - ELASTICSEARCH_PORT_NUMBER=9200
      - BITNAMI_DEBUG=true
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms1024m -Xmx1024m
      - http.cors.enabled=true
      - http.cors.allow-origin=http://localhost:8082
    healthcheck:
      interval: 20s
      retries: 10
      test: curl -s http://localhost:9200/_cluster/health | grep -vq '"status":"red"'
    networks:
      - internal-services

  rekoni:
    image: hardcoreeng/rekoni-service:${HULY_VERSION}
    restart: unless-stopped
    environment:
      <<: *common-env
    deploy:
      resources:
        limits:
          memory: 500M
    networks:
      - internal-services
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rekoni.entrypoints=websecure"
      - "traefik.http.services.rekoni.loadbalancer.server.port=4004"
      - "traefik.http.routers.rekoni.rule=Host(`${SERVER_ADDRESS}`) && PathPrefix(`/rekoni`)"
      - "traefik.http.routers.rekoni.middlewares=rekoni-stripprefix"
      - "traefik.http.middlewares.rekoni-stripprefix.stripprefix.prefixes=/rekoni"
      - "traefik.http.routers.rekoni.tls=true"
      - "traefik.http.routers.rekoni.tls.certresolver=myresolver"

  transactor:
    image: hardcoreeng/transactor:${HULY_VERSION}
    restart: unless-stopped
    environment:
      <<: *common-env
      SERVER_PORT: 3333
      SERVER_CURSOR_MAXTIMEMS: 30000
      FRONT_URL: http://localhost:8087
      FULLTEXT_URL: http://fulltext:4700
      LAST_NAME_FIRST: true
    networks:
      - internal-services
      - traefik-public
    labels:
      - "traefik.enable=true"
      # WebSocket route
      - "traefik.http.routers.transactor-ws.entrypoints=websecure"
      - "traefik.http.routers.transactor-ws.rule=Host(`${SERVER_ADDRESS}`) && PathPrefix(`/ws/transactor`)"
      - "traefik.http.routers.transactor-ws.tls=true"
      - "traefik.http.routers.transactor-ws.tls.certresolver=myresolver"
      - "traefik.http.services.transactor-ws.loadbalancer.server.port=3333"
      - "traefik.http.routers.transactor-ws.service=transactor-ws"

      # Strip WebSocket prefix
      - "traefik.http.routers.transactor-ws.middlewares=strip-transactor-ws-prefix"
      - "traefik.http.middlewares.strip-transactor-ws-prefix.stripprefix.prefixes=/ws/transactor"

      # HTTP route for non-WebSocket traffic
      - "traefik.http.routers.transactor.entrypoints=websecure"
      - "traefik.http.routers.transactor.rule=Host(`${SERVER_ADDRESS}`) && PathPrefix(`/transactor`)"
      - "traefik.http.routers.transactor.tls=true"
      - "traefik.http.routers.transactor.tls.certresolver=myresolver"
      - "traefik.http.services.transactor.loadbalancer.server.port=3333"
      - "traefik.http.routers.transactor.service=transactor"
      # Strip HTTP prefix
      - "traefik.http.routers.transactor.middlewares=strip-transactor-prefix"
      - "traefik.http.middlewares.strip-transactor-prefix.stripprefix.prefixes=/transactor"

  collaborator:
    image: hardcoreeng/collaborator:${HULY_VERSION}
    restart: unless-stopped
    environment:
      <<: *common-env
      COLLABORATOR_PORT: 3078
    networks:
      - internal-services
      - traefik-public
    labels:
      - "traefik.enable=true"
      # WebSocket route
      - "traefik.http.routers.collaborator-ws.entrypoints=websecure"
      - "traefik.http.routers.collaborator-ws.rule=Host(`${SERVER_ADDRESS}`) && PathPrefix(`/ws/collaborator`)"
      - "traefik.http.routers.collaborator-ws.tls=true"
      - "traefik.http.routers.collaborator-ws.tls.certresolver=myresolver"
      - "traefik.http.services.collaborator-ws.loadbalancer.server.port=3078"
      - "traefik.http.routers.collaborator-ws.service=collaborator-ws"

      # Strip WebSocket prefix
      - "traefik.http.routers.collaborator-ws.middlewares=strip-collaborator-ws-prefix"
      - "traefik.http.middlewares.strip-collaborator-ws-prefix.stripprefix.prefixes=/ws/collaborator"
      # HTTP route for non-WebSocket traffic
      - "traefik.http.routers.collaborator.entrypoints=websecure"
      - "traefik.http.routers.collaborator.rule=Host(`${SERVER_ADDRESS}`) && PathPrefix(`/collaborator`)"
      - "traefik.http.routers.collaborator.tls=true"
      - "traefik.http.routers.collaborator.tls.certresolver=myresolver"
      - "traefik.http.services.collaborator.loadbalancer.server.port=3078"

      # Strip HTTP prefix
      - "traefik.http.routers.collaborator.middlewares=strip-collaborator-prefix"
      - "traefik.http.middlewares.strip-collaborator-prefix.stripprefix.prefixes=/collaborator"

  account:
    image: hardcoreeng/account:${HULY_VERSION}
    restart: unless-stopped
    environment:
      <<: *common-env
      SERVER_PORT: 3000
      TRANSACTOR_URL: ws://transactor:3333;wss://${SERVER_ADDRESS}/ws/transactor
      FRONT_URL: http://front:8080
      MODEL_ENABLED: "*"
      ACCOUNT_PORT: 3000
    networks:
      - internal-services
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.account.entrypoints=websecure"
      - "traefik.http.services.account.loadbalancer.server.port=3000"
      - "traefik.http.routers.account.rule=Host(`${SERVER_ADDRESS}`) && PathPrefix(`/accounts`)"
      - "traefik.http.routers.account.middlewares=account-stripprefix"
      - "traefik.http.middlewares.account-stripprefix.stripprefix.prefixes=/accounts"
      - "traefik.http.routers.account.tls=true"
      - "traefik.http.routers.account.tls.certresolver=myresolver"

  workspace:
    image: hardcoreeng/workspace:${HULY_VERSION}
    restart: unless-stopped
    environment:
      <<: *common-env
      TRANSACTOR_URL: ws://transactor:3333;wss://${SERVER_ADDRESS}/ws/transactor
      MODEL_ENABLED: "*"
    networks:
      - internal-services

  front:
    image: hardcoreeng/front:${HULY_VERSION}
    restart: unless-stopped
    environment:
      <<: *common-env
      SERVER_PORT: 8080
      ACCOUNTS_URL: https://${SERVER_ADDRESS}/accounts
      REKONI_URL: https://${SERVER_ADDRESS}/rekoni
      CALENDAR_URL: https://${SERVER_ADDRESS}:8095
      GMAIL_URL: https://${SERVER_ADDRESS}:8088
      TELEGRAM_URL: https://${SERVER_ADDRESS}:8086
      STATS_URL: https://${SERVER_ADDRESS}/stats
      UPLOAD_URL: /files
      ELASTIC_URL: http://elastic:9200
      COLLABORATOR_URL: wss://${SERVER_ADDRESS}/ws/collaborator
      TITLE: Huly Self Host
      DEFAULT_LANGUAGE: en
      LAST_NAME_FIRST: true
      DESKTOP_UPDATES_CHANNEL: selfhost
    networks:
      - internal-services
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.front.entrypoints=websecure"
      - "traefik.http.services.front.loadbalancer.server.port=8080"
      - "traefik.http.routers.front.rule=Host(`${SERVER_ADDRESS}`)"
      - "traefik.http.routers.front.tls=true"
      - "traefik.http.routers.front.tls.certresolver=myresolver"

  fulltext:
    image: hardcoreeng/fulltext:${HULY_VERSION}
    restart: unless-stopped
    environment:
      <<: *common-env
      FULLTEXT_DB_URL: http://elastic:9200
      ELASTIC_INDEX_NAME: huly_storage_index
      REKONI_URL: http://rekoni:4004
    networks:
      - internal-services

  stats:
    image: hardcoreeng/stats:${HULY_VERSION}
    restart: unless-stopped
    environment:
      <<: *common-env
      PORT: 4900
    networks:
      - internal-services
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.stats.entrypoints=websecure"
      - "traefik.http.services.stats.loadbalancer.server.port=4900"
      - "traefik.http.routers.stats.rule=Host(`${SERVER_ADDRESS}`) && PathPrefix(`/stats`)"
      - "traefik.http.routers.stats.middlewares=stats-stripprefix"
      - "traefik.http.middlewares.stats-stripprefix.stripprefix.prefixes=/stats"
      - "traefik.http.routers.stats.tls=true"
      - "traefik.http.routers.stats.tls.certresolver=myresolver"

networks:
  traefik-public:
    name: traefik-public
  internal-services:
    name: internal-services

volumes:
  db:
  elastic:
  files:
  letsencrypt: