docker-compose.prod.yml

version: '3.7'

volumes:
  db: {}
  redis: {}

services:
  reverse_proxy:
    image: traefik
    restart: always
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web80.address=:80
      - --entrypoints.web443.address=:443
      - --certificatesresolvers.letsencrypt=true
      - --certificatesresolvers.letsencrypt.acme.email=$LETSENCRYPT_EMAIL
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --entrypoints.web443.http.tls=true
      - --entrypoints.web443.http.tls.certresolver=letsencrypt
      - --entrypoints.web80.http.redirections.entrypoint.to=web443
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
  app:
    image: ghcr.io/stw-on/sheriff
    env_file: .env
    restart: always
    expose:
      - 80
    labels:
      - traefik.enable=true
      - traefik.http.routers.sheriff.rule=Host(`$SHERIFF_HOST`)
      - traefik.http.middlewares.sheriff-middlewares.headers.framedeny=true
      - traefik.http.middlewares.sheriff-middlewares.headers.sslredirect=true
      - traefik.http.middlewares.sheriff-middlewares.headers.stsSeconds=31536000
  worker:
    image: ghcr.io/stw-on/sheriff
    env_file: .env
    command: worker
    restart: always
  scheduler:
    image: ghcr.io/stw-on/sheriff
    env_file: .env
    command: scheduler
    restart: always
  db:
    image: postgres:14-alpine
    restart: always
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - db:/var/lib/postgresql/data
  redis:
    image: redis:alpine
    volumes:
      - redis:/data
    restart: always
  pdfrenderer:
    image: timoschwarzer/headless-pdf-renderer
    restart: on-failure
    cap_add:
      - SYS_ADMIN