docker-compose.prod.yml

services:
  traefik:
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
    networks:
      - web-public
    deploy:
      update_config:
        parallelism: 1
        delay: 5s
        order: stop-first
      placement:
        constraints:
          - node.role==manager
    volumes:
      # Mount the Docker socket as read-only so Traefik can listen to events
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - certificates:/certificates
    configs:
      - source: traefik
        target: /etc/traefik/traefik.yml
  php:
    image: ${SPIN_IMAGE_DOCKERFILE_PHP}
    environment:
      AUTORUN_ENABLED: "true" # 👈 Remove this line if you don't want Laravel Automations
      APP_ENV: "${SPIN_DEPLOYMENT_ENVIRONMENT}"
      PHP_OPCACHE_ENABLE: "1"
      HEALTHCHECK_PATH: "/up"
    networks:
      - web-public
    volumes:
      - "storage_private:/var/www/html/storage/app/private/"
      - "storage_public:/var/www/html/storage/app/public/"
      - "storage_sessions:/var/www/html/storage/framework/sessions"
      - "storage_logs:/var/www/html/storage/logs"
    deploy:
      replicas: 1
      update_config:
        failure_action: rollback
        parallelism: 1
        delay: 5s
        order: start-first
      rollback_config:
        parallelism: 0
        order: stop-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 3
        window: 120s
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.laravel-web.rule=Host(`${SPIN_APP_DOMAIN}`)"
        - "traefik.http.routers.laravel-web.entrypoints=websecure"
        - "traefik.http.routers.laravel-web.tls=true"
        - "traefik.http.routers.laravel-web.tls.certresolver=letsencryptresolver"
        - "traefik.http.services.laravel-web.loadbalancer.server.port=8443"
        - "traefik.http.services.laravel-web.loadbalancer.server.scheme=https"
        # Health check
        - "traefik.http.services.laravel-web.loadbalancer.healthcheck.path=/up"
        - "traefik.http.services.laravel-web.loadbalancer.healthcheck.interval=30s"
        - "traefik.http.services.laravel-web.loadbalancer.healthcheck.timeout=5s"
        - "traefik.http.services.laravel-web.loadbalancer.healthcheck.scheme=https"
  schedule:
    image: ${SPIN_IMAGE_DOCKERFILE_PHP}
    environment:
      APP_ENV: "${SPIN_DEPLOYMENT_ENVIRONMENT}"
    networks:
      - web-public
    volumes:
      - "storage_private:/var/www/html/storage/app/private/"
      - "storage_public:/var/www/html/storage/app/public/"
      - "storage_sessions:/var/www/html/storage/framework/sessions"
      - "storage_logs:/var/www/html/storage/logs"
    deploy:
      replicas: 1
      update_config:
        failure_action: rollback
        parallelism: 1
        delay: 5s
        order: start-first
      rollback_config:
        parallelism: 0
        order: stop-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 3
        window: 120s
  mariadb:
    networks:
      - web-public
    environment:
      MARIADB_RANDOM_ROOT_PASSWORD: "1"
      MARIADB_DATABASE: "${DB_DATABASE}"
      MARIADB_USER: "${DB_USERNAME}"
      MARIADB_PASSWORD: "${DB_PASSWORD}"
    deploy:
      placement:
        constraints:
          - node.role==manager
    volumes:
      - mariadb_data:/var/lib/mysql
      - mariadb_custom_conf:/etc/mysql/conf.d
      - mariadb_shared:/shared
  ssh:
    # We use an SSH image so we can securely tunnel into the Docker network with 
    # tools like Sequel Pro, TablePlus, Sequel Ace, etc.
    # Learn more how to secure your tunnel here: https://github.com/serversideup/docker-ssh
    image: serversideup/docker-ssh:v3
    ports:
      - target: 2222
        published: 2222
        mode: host
    environment:
      # Be sure to set the authorized keys in the .env file or GitHub Actions secrets
      AUTHORIZED_KEYS: "${AUTHORIZED_KEYS}"
      # You can lock to a specific IP too (AllowUsers tunnel@1.2.3.4)
      ALLOWED_IPS: "AllowUsers tunnel"
    volumes:
      - tunnel_ssh_host_keys:/etc/ssh/ssh_host_keys
    networks:
      - web-public
  meilisearch:
    volumes:
      - meilisearch_data:/meili_data
    networks:
      - web-public
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 5s
        order: start-first
  queue:
    image: ${SPIN_IMAGE_DOCKERFILE_PHP}
    environment:
      APP_ENV: "${SPIN_DEPLOYMENT_ENVIRONMENT}"
    networks:
      - web-public
    volumes:
      - "storage_private:/var/www/html/storage/app/private/"
      - "storage_public:/var/www/html/storage/app/public/"
      - "storage_sessions:/var/www/html/storage/framework/sessions"
      - "storage_logs:/var/www/html/storage/logs"
    deploy:
      replicas: 1
      update_config:
        failure_action: rollback
        parallelism: 1
        delay: 5s
        order: start-first
      rollback_config:
        parallelism: 0
        order: stop-first
      restart_policy:
        condition: any
        delay: 10s
        max_attempts: 3
        window: 120s
configs:
  traefik:
    name: "traefik-${SPIN_MD5_HASH_TRAEFIK_YML}.yml"
    file: ./.infrastructure/conf/traefik/prod/traefik.yml
volumes:
  certificates:
  storage_private:
  storage_public:
  storage_sessions:
  storage_logs:
  mariadb_data:
  mariadb_custom_conf:
  mariadb_shared:
  tunnel_ssh_host_keys:
  meilisearch_data:
networks:
  web-public: