docker-compose.swarm.yml

version: "3.8"

services:
  traefik:
    image: osi4iot/traefik:${TRAEFIK_TAG:-latest}
    command:
      - --api.insecure=true
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --ping
      - --providers.file.directory=/etc/traefik/dynamic
      - --providers.docker=true
      - --providers.docker.swarmMode=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=traefik-public
      - --api
      - --accesslog
      - --log
    deploy:
      mode: replicated
      replicas: 3
      # placement:
      #   constraints: [node.role == master]
        # preferences:
        #   - spread: node.labels.primary
        #   - spread: node.labels.secondary
        #   - spread: node.labels.tertiary
    #   labels:
    #     - traefik.enable=true
    #     - traefik.http.routers.traefik.rule=Host(`${DOMAIN_NAME}`)
    #     - traefik.http.routers.traefik.entrypoints=websecure
    #     - traefik.http.routers.traefik.tls=true
    #     - traefik.http.routers.traefik.service=api@internal
    #     - traefik.http.services.traefik.loadbalancer.server.port=8080
    #     - traefik.http.routers.traefik.middlewares=admin-auth
    #     - traefik.http.middlewares.admin-auth.basicauth.users=dicapua:$$apr1$$UVPioB1u$$52vwqCRCI2T1MTimMtZhc0
    secrets:
      - source: iot_platform_cert
        target: iot_platform_cert.cer
        mode: 0400
      - source: iot_platform_key
        target: iot_platform.key
        mode: 0400
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    networks:
      - traefik-public
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro

  mosquitto:
    image: osi4iot/mosquitto:${MOSQUITTO_TAG:-latest}
    networks:
      - internal_net
    ports:
      - "1883:1883"
      - "8883:8883"
      - "9001:9001"
    volumes:
      - mosquitto_data:/mosquitto/data/
      - mosquitto_log:/mosquitto/log/
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    secrets:
      - source: iot_platform_ca
        target: /mosquitto/wss_certs/iot_platform_ca.pem
        mode: 0444
      - source: iot_platform_cert
        target: /mosquitto/wss_certs/iot_platform_cert.cer
        mode: 0444
      - source: iot_platform_key
        target: /mosquitto/wss_certs/iot_platform.key
        mode: 0444
      - source: mqtt_server_ca_cert
        target: /mosquitto/mqtt_certs/ca.crt
        mode: 0444
      - source: mqtt_server_cert
        target: /mosquitto/mqtt_certs/server.crt
        mode: 0444
      - source: mqtt_server_key
        target: /mosquitto/mqtt_certs/server.key
        mode: 0444        
    configs:
      - source: mosquitto_conf
        target: /mosquitto/config/mosquitto.conf
        mode: 0440  
    deploy:
      replicas: 1
      placement:
        constraints: [ node.id == $NODE_ID ]
      restart_policy:
        condition: on-failure

  agent:
    image: osi4iot/portainer_agent:${PORTAINER_AGENT_TAG:-latest}
    environment:
      # REQUIRED: Should be equal to the service name prefixed by "tasks." when
      # deployed inside an overlay network
      AGENT_CLUSTER_ADDR: tasks.agent
      # AGENT_PORT: 9001
      # LOG_LEVEL: debug
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro       
    networks:
      - agent_network
    deploy:
      mode: global
      placement:
        constraints: [node.platform.os == linux]

  portainer:
    image: osi4iot/portainer:${PORTAINER_TAG:-latest}
    command: -H tcp://tasks.agent:9001 --tlsskipverify
    volumes:
      - portainer_data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "8000:8000"
      - "9000:9000"
    networks:
      - traefik-public
      - agent_network
    deploy:
      mode: replicated
      replicas: 1      
      placement:
        constraints: [ node.role == manager ]  
      labels:
        - traefik.enable=true
        - traefik.http.routers.portainer.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/portainer/`)
        - traefik.http.middlewares.portainerpathstrip.stripprefix.prefixes=/portainer
        - traefik.http.routers.portainer.middlewares=portainerpathstrip@docker
        - traefik.http.routers.portainer.entrypoints=websecure
        - traefik.http.routers.portainer.tls=true
        - traefik.http.routers.portainer.service=portainer
        - traefik.http.services.portainer.loadbalancer.server.port=9000
        # Edge
        - traefik.http.routers.edge.rule=Host(`edge.${DOMAIN_NAME}`)
        - traefik.http.routers.edge.entrypoints=websecure
        - traefik.http.routers.edge.tls=true
        - traefik.http.routers.edge.service=edge
        - traefik.http.services.edge.loadbalancer.server.port=8000

  pgadmin4:
    image: osi4iot/pgadmin4:${PGADMIN4_TAG:-latest}
    user: "${UID}:${GID}"
    secrets:
      - source: pgadmin4
        target: pgadmin4.txt
        mode: 0400
    volumes:
      - pgadmin4_data:/var/lib/pgadmin
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro 
    networks:
      - internal_net
      - traefik-public
    deploy:
      placement:
        constraints: [node.role == manager]   
      labels:
        - traefik.enable=true
        - traefik.http.routers.pgadmin4.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/pgadmin4/`)
        - traefik.http.middlewares.pgadmin4-prefix.stripprefix.prefixes=/pgadmin4
        - traefik.http.routers.pgadmin4.middlewares=pgadmin4-prefix,pgadmin4-header,pgadmin4-redirectregex
        - traefik.http.middlewares.pgadmin4-prefix.stripprefix.forceslash=false
        - traefik.http.middlewares.pgadmin4-header.headers.customrequestheaders.X-Script-Name=/pgadmin4/
        - traefik.http.middlewares.pgadmin4-redirectregex.redirectregex.regex=https://${DOMAIN_NAME}/(pgadmin4*)
        - traefik.http.middlewares.pgadmin4-redirectregex.redirectregex.replacement=https://${DOMAIN_NAME}/$${1}"
        - traefik.http.routers.pgadmin4.entrypoints=websecure
        - traefik.http.routers.pgadmin4.tls=true
        - traefik.http.routers.pgadmin4.service=pgadmin4
        - traefik.http.services.pgadmin4.loadbalancer.server.port=80

  postgres:
    image: osi4iot/timescaledb:${TIMESCALEDB_TAG:-latest}
    networks:
      - internal_net
    secrets:
      - source: postgres
        target: postgres.txt
        mode: 0400
    volumes:
      - pgdata:/var/lib/postgresql/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro 
    deploy:
      # placement:
      #   constraints: [node.role == worker]
      mode: replicated
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
        window: 120s

  nodered:
    image: osi4iot/nodered:${NODERED_TAG:-latest}
    user: "${UID}:${GID}"
    networks:
      - internal_net
      - traefik-public
    volumes:
      - nodered_data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      - ALWAYS_USE_DEFAULT_FLOWS=true
    secrets:
      - source: mqtt_nodered_ca
        target: /data/certs/ca.crt
        mode: 0444
      - source: mqtt_nodered_client_cert
        target: /data/certs/client.crt
        mode: 0444
      - source: mqtt_nodered_client_key
        target: /data/certs/client.key
        mode: 0444
      - source: nodered
        target: nodered.txt
        mode: 0400
    configs:
      - source: nodered_conf
        target: /run/configs/nodered.conf
        mode: 0440         
    deploy:
      placement:
        constraints: [node.platform.arch==x86_64]      
      restart_policy:
        condition: on-failure
        delay: 5s
        # max_attempts: 20
        window: 120s
      labels:
        - traefik.enable=true
        - traefik.http.routers.nodered.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/nodered/`)
        - traefik.http.middlewares.nodered-prefix.stripprefix.prefixes=/nodered
        - traefik.http.routers.nodered.middlewares=nodered-prefix,nodered-header,nodered-redirectregex
        - traefik.http.middlewares.nodered-prefix.stripprefix.forceslash=false
        - traefik.http.middlewares.nodered-header.headers.customrequestheaders.X-Script-Name=/nodered/
        - traefik.http.middlewares.nodered-redirectregex.redirectregex.regex=https://${DOMAIN_NAME}/(nodered*)
        - traefik.http.middlewares.nodered-redirectregex.redirectregex.replacement=https://${DOMAIN_NAME}/$${1}"        
        - traefik.http.routers.nodered.entrypoints=websecure
        - traefik.http.routers.nodered.tls=true
        - traefik.http.routers.nodered.service=nodered
        - traefik.http.services.nodered.loadbalancer.server.port=1880

  nodered_arm64:
    image: osi4iot/nodered_arm64:${NODERED_ARM64_TAG:-latest}
    user: "${UID}:${GID}"
    networks:
      - internal_net
      - traefik-public
    volumes:
      - nodered_data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      - ALWAYS_USE_DEFAULT_FLOWS=true
    secrets:
      - source: mqtt_nodered_ca
        target: /data/certs/ca.crt
        mode: 0444
      - source: mqtt_nodered_client_cert
        target: /data/certs/client.crt
        mode: 0444
      - source: mqtt_nodered_client_key
        target: /data/certs/client.key
        mode: 0444
      - source: nodered
        target: nodered.txt
        mode: 0400
    configs:
      - source: nodered_conf
        target: /run/configs/nodered.conf
        mode: 0440
    deploy:
      placement:
        constraints: [node.platform.arch==aarch64]
      restart_policy:
        condition: on-failure
        delay: 5s
        # max_attempts: 20
        window: 120s
      labels:
        - traefik.enable=true
        - traefik.http.routers.nodered.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/nodered/`)
        - traefik.http.middlewares.nodered-prefix.stripprefix.prefixes=/nodered
        - traefik.http.routers.nodered.middlewares=nodered-prefix,nodered-header,nodered-redirectregex
        - traefik.http.middlewares.nodered-prefix.stripprefix.forceslash=false
        - traefik.http.middlewares.nodered-header.headers.customrequestheaders.X-Script-Name=/nodered/
        - traefik.http.middlewares.nodered-redirectregex.redirectregex.regex=https://${DOMAIN_NAME}/(nodered*)
        - traefik.http.middlewares.nodered-redirectregex.redirectregex.replacement=https://${DOMAIN_NAME}/$${1}"        
        - traefik.http.routers.nodered.entrypoints=websecure
        - traefik.http.routers.nodered.tls=true
        - traefik.http.routers.nodered.service=nodered
        - traefik.http.services.nodered.loadbalancer.server.port=1880

  grafana:
    image: osi4iot/grafana:${GRAFANA_TAG:-latest}
    user: "${UID}:${GID}"
    networks:
      - internal_net
      - traefik-public
    volumes:
      - grafana_data:/var/lib/grafana
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    secrets:
      - source: grafana
        target: grafana.txt
        mode: 0400
    configs:
      - source: grafana_conf
        target: /run/configs/grafana.conf
        mode: 0444
    deploy:
      mode: replicated
      replicas: 3
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
        window: 120s
      # placement:
      #   constraints: [node.role == worker]
      labels:
        - traefik.enable=true
        - traefik.http.routers.grafana.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/grafana/`)
        - traefik.http.middlewares.grafana-prefix.stripprefix.prefixes=/grafana
        - traefik.http.routers.grafana.middlewares=grafana-prefix,grafana-header,grafana-redirectregex
        - traefik.http.middlewares.grafana-prefix.stripprefix.forceslash=false
        - traefik.http.middlewares.grafana-header.headers.customrequestheaders.X-Script-Name=/grafana/
        - traefik.http.middlewares.grafana-redirectregex.redirectregex.regex=https://${DOMAIN_NAME}/(grafana*)
        - traefik.http.middlewares.grafana-redirectregex.redirectregex.replacement=https://${DOMAIN_NAME}/$${1}"        
        - traefik.http.routers.grafana.entrypoints=websecure
        - traefik.http.routers.grafana.tls=true
        - traefik.http.routers.grafana.service=grafana
        - traefik.http.services.grafana.loadbalancer.server.port=5000
        - traefik.http.services.grafana.loadbalancer.healthCheck.path=/api/health
        - traefik.http.services.grafana.loadbalancer.healthCheck.interval=5s
        - traefik.http.services.grafana.loadbalancer.healthCheck.timeout=3s      
  
  grafana_renderer:
    image: osi4iot/grafana_renderer:${GRAFANA_TAG:-latest}
    networks:
      - internal_net
    ports:
      - 8081
    environment:
      ENABLE_METRICS: 'true'
    deploy:
      placement:
        constraints: [node.platform.arch==x86_64]      


  admin_api:
    image: osi4iot/admin_api:${ADMIN_API_TAG:-latest}
    networks:
      - internal_net
      - traefik-public
    volumes:
      - admin_api_log:/app/logs
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro   
    working_dir: /app
    secrets:
      - source: mqtt_server_ca_cert
        target: ca.crt
        mode: 0444
      - source: mqtt_server_ca_key
        target: ca.key
        mode: 0444
      - source: admin_api
        target: admin_api.txt
        mode: 0444
    configs:
      - source: admin_api_conf
        target: /run/configs/admin_api.conf
        mode: 0444   
    ports:
      - "3200:3200"
    deploy:
      mode: replicated
      replicas: 0
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
        window: 120s
      # placement:
      #   constraints: [node.role == worker]
      labels:
        - traefik.enable=true
        - traefik.http.routers.admin_api.rule=Host(`${DOMAIN_NAME}`) && PathPrefix(`/admin_api/`)
        - traefik.http.middlewares.admin_api-prefix.stripprefix.prefixes=/admin_api
        - traefik.http.routers.admin_api.middlewares=admin_api-prefix,admin_api-header,admin_api-redirectregex
        - traefik.http.routers.admin_api.middlewares=admin_api-prefix
        - traefik.http.middlewares.admin_api-prefix.stripprefix.forceslash=false
        - traefik.http.middlewares.admin_api-header.headers.customrequestheaders.X-Script-Name=/admin_api/
        - traefik.http.middlewares.admin_api-redirectregex.redirectregex.regex=https://${DOMAIN_NAME}/(admin_api*)
        - traefik.http.middlewares.admin_api-redirectregex.redirectregex.replacement=https://${admin_api}/$${1}"         
        - traefik.http.routers.admin_api.entrypoints=websecure
        - traefik.http.routers.admin_api.tls=true        
        - traefik.http.routers.admin_api.service=admin_api
        - traefik.http.services.admin_api.loadbalancer.server.port=3200
        - traefik.http.services.admin_api.loadbalancer.healthCheck.path=/health
        - traefik.http.services.admin_api.loadbalancer.healthCheck.interval=5s
        - traefik.http.services.admin_api.loadbalancer.healthCheck.timeout=3s        

  frontend:
    image: osi4iot/frontend:${FRONTEND_TAG:-latest}
    configs:
      - source: frontend_conf
        target: /run/configs/frontend.conf
        mode: 0444
    networks:
      - traefik-public
    command: nginx -g "daemon off";
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro       
    deploy:
      mode: replicated
      replicas: 3
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
        window: 120s
      placement:
        constraints: [node.platform.arch==x86_64]
      labels:
        - traefik.enable=true
        - traefik.http.routers.frontend.rule=Host(`${DOMAIN_NAME}`)
        - traefik.http.routers.frontend.entrypoints=websecure
        - traefik.http.routers.frontend.tls=true        
        - traefik.http.routers.frontend.service=frontend
        - traefik.http.services.frontend.loadbalancer.server.port=80
        - traefik.http.services.frontend.loadbalancer.healthCheck.path=/health
        - traefik.http.services.frontend.loadbalancer.healthCheck.interval=5s
        - traefik.http.services.frontend.loadbalancer.healthCheck.timeout=3s

  frontend_arm64:
    image: osi4iot/frontend_arm64:${FRONTEND_ARM64_TAG:-latest}
    configs:
      - source: frontend_conf
        target: /run/configs/frontend.conf
        mode: 0444
    networks:
      - traefik-public
    command: nginx -g "daemon off";
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro       
    deploy:
      mode: replicated
      replicas: 3
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
        window: 120s
      placement:
        constraints: [node.platform.arch==aarch64]
      labels:
        - traefik.enable=true
        - traefik.http.routers.frontend.rule=Host(`${DOMAIN_NAME}`)
        - traefik.http.routers.frontend.entrypoints=websecure
        - traefik.http.routers.frontend.tls=true        
        - traefik.http.routers.frontend.service=frontend
        - traefik.http.services.frontend.loadbalancer.server.port=80
        - traefik.http.services.frontend.loadbalancer.healthCheck.path=/health
        - traefik.http.services.frontend.loadbalancer.healthCheck.interval=5s
        - traefik.http.services.frontend.loadbalancer.healthCheck.timeout=3s

networks:
  agent_network:
    external: true
  traefik-public:
    external: true
  internal_net:
    external: true

volumes:
  mosquitto_data:
  mosquitto_log:
  nodered_data:
  pgdata:
  pgadmin4_data:
  portainer_data:
  grafana_data:
  admin_api_log:

secrets:
  iot_platform_ca:
    file: ./certs/domain_certs/iot_platform_ca.pem
  iot_platform_cert:
    file: ./certs/domain_certs/iot_platform_cert.cer
  iot_platform_key:
    file: ./certs/domain_certs/iot_platform.key
  mqtt_server_ca_cert:
    file: ./certs/mqtt_server_certs/ca.crt
  mqtt_server_ca_key:
    file: ./certs/mqtt_server_certs/ca.crt
  mqtt_server_cert:
    file: ./certs/mqtt_server_certs/server.crt
  mqtt_server_key:
    file: ./certs/mqtt_server_certs/server.key
  mqtt_nodered_ca:
    file: ./certs/mqtt_nodered_certs/ca.crt
  mqtt_nodered_client_cert:
    file: ./certs/mqtt_nodered_certs/client.crt
  mqtt_nodered_client_key:
    file: ./certs/mqtt_nodered_certs/client.key
  pgadmin4:
    file: ./secrets/pgadmin4.txt
  postgres:
    file: ./secrets/postgres.txt
  nodered:
    file: ./secrets/nodered.txt
  grafana:
    file: ./secrets/grafana.txt
  admin_api:
    file: ./secrets/admin_api.txt

configs:
  mosquitto_conf:
    file: ./config/mosquitto/mosquitto.conf
  nodered_conf:
    file: ./config/nodered/nodered.conf
  grafana_conf:
    file: ./config/grafana/grafana.conf
  admin_api_conf:
    file: ./config/admin_api/admin_api.conf
  frontend_conf:
    file: ./config/frontend/frontend.conf