docker-compose.yml

networks:
  frontend:
      name: frontend
      external: false
  backend:
      name: backend
      external: false

# Base configuration for services that use the SMR web image
x-smr-base: &smr-base
    image: smrealms/smr:web
    restart: unless-stopped
    volumes:
        - ./config:/smr/config:ro
        - ./player-upload:/smr/src/htdocs/upload:rw
    environment:
        MYSQL_HOST:
        MYSQL_USER:
        MYSQL_DATABASE:
        MYSQL_PASSWORD_FILE: /run/secrets/mysql-password
    secrets:
        - source: mysql-password
          mode: 0444

# Base configuration for the SMR command line tools
x-smr-cli: &smr-cli
    <<: *smr-base
    networks:
        - backend
    depends_on:
        - mysql
        - smtp

services:

    smr:
        <<: *smr-base
        container_name: smr-game
        networks:
            - frontend
            - backend
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.smr-game.rule=(Host(`www.smrealms.de`) || Host(`smrealms.de`)) && PathPrefix(`/`)"
            - "traefik.http.routers.smr-game.middlewares=nonwww-to-www@file"
        depends_on:
            - smtp
            - mysql
            - traefik

    smtp:
        image: mwader/postfix-relay
        restart: unless-stopped
        container_name: smr-smtp
        networks:
            - backend
        environment:
            - POSTFIX_myhostname=einstein.fem.tu-ilmenau.de
            - OPENDKIM_DOMAINS=smrealms.de=key1
        volumes:
            - ./opendkim:/etc/opendkim/keys/smrealms.de:rw

    mysql:
        image: mysql:8.1
        restart: unless-stopped
        container_name: ${MYSQL_HOST}
        networks:
            - backend
        # By using the default image, we must expose the secrets in
        # the runtime environment (because we can't specify build args).
        environment:
            - MYSQL_USER
            - MYSQL_DATABASE
            - MYSQL_PASSWORD=/run/secrets/mysql-password
            - MYSQL_ROOT_PASSWORD=/run/secrets/mysql-root-password
        secrets:
            - mysql-password
            - mysql-root-password
        volumes:
            - ./data/db:/var/lib/mysql
            - ./.my.cnf:/root/.my.cnf:ro
        command: ["mysqld",
                  "--character-set-server=utf8",
                  "--collation-server=utf8_general_ci"]

    flyway:
        image: smrealms/smr:flyway
        # Allow retries in case the mysql service is still spinning up
        command: ["-connectRetries=20", "-url=jdbc:mysql://${MYSQL_HOST}/${MYSQL_DATABASE}?useSSL=false", "-user=${MYSQL_USER}", "-password=${MYSQL_PASSWORD}", "migrate"]
        networks:
            - backend
        depends_on:
            - mysql

    discord:
        command: php src/tools/discord/bot.php
        <<: *smr-cli

    irc:
        command: php src/tools/irc/irc.php
        <<: *smr-cli

    npc:
        command: php src/tools/npc/npc.php
        restart: "no"
        <<: *smr-cli

    pma:
        image: phpmyadmin/phpmyadmin
        restart: unless-stopped
        container_name: smr-phpmyadmin
        networks:
            - frontend
            - backend
        environment:
            PMA_HOST: ${MYSQL_HOST}
            PMA_ABSOLUTE_URI: /pma/
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.smr-pma.rule=(Host(`www.smrealms.de`) || Host(`smrealms.de`)) && PathPrefix(`/pma`)"
            - "traefik.http.routers.smr-pma.middlewares=slash-then-strip@file"
        depends_on:
            - mysql
            - traefik

    traefik:
        image: traefik:3.0
        restart: unless-stopped
        container_name: smr-traefik
        networks:
            - frontend
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - ./traefik:/etc/traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.traefik.rule=Host(`traefik.smrealms.de`)"
            - "traefik.http.routers.traefik.service=api@internal"
            - "traefik.http.routers.traefik.middlewares=traefik-auth"
            - "traefik.http.middlewares.traefik-auth.basicauth.users=traefik:$$apr1$$N1XTczE5$$5GvS93f.oSRstkxmjw9JD0"
        ports:
            - "80:80"
            - "443:443"
        logging:
            driver: "json-file"
            options:
                max-size: "100m"
                max-file: "7"
                compress: "true"

    backup-s3:
        image: amazon/aws-cli:2.2.24
        networks:
            - backend
        environment:
            AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
            AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
        volumes:
            - ./backup/daily:/aws/daily
            - ./backup/archive:/aws/archive
            - ./player-upload:/aws/player-upload

secrets:
    mysql-password:
        environment: "MYSQL_PASSWORD"
    mysql-root-password:
        environment: "MYSQL_ROOT_PASSWORD"