docker-compose.yml

version: '3.7'

services:

  #
  # Traefik server for reverse proxying, load balancing and fetching Let's encrypt certificates
  # Listens for changes on docker containers and adds them if matching labels are found
  # Runs in dashboard mode, secured by basic http auth
  #
  faf-traefik:
    image: traefik:v2.6.3
    environment:
      DOMAINNAME: ${DOMAINNAME}
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
      # Config folder contains 3 files:
      # traefik.yml  - Static configuration (change requires restart)
      # config.yml   - Dynamic configuration (Traefik listens for changes)
      # acme.json    - Make sure to set chmod to 600 (will be populated by Traefik)
      - ./config/faf-traefik:/etc/traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-traefik.entryPoints=web-secure"
      - "traefik.http.routers.faf-traefik.rule=Host(`traefik.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-traefik.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=${TRAEFIK_USERNAME}:${TRAEFIK_PASSWORD}"
      - "traefik.http.routers.faf-traefik.service=api@internal"
      - "traefik.http.services.faf-traefik.loadbalancer.server.port=8080" # Dummy port so Docker doesn't complain

  #
  # Coturn server for proxying between players
  # It uses net: "host" for performance reasons.
  #
  faf-coturn:
    container_name: faf-coturn
    image: faforever/coturn-lt-cred:v1.1
    env_file: ./config/faf-coturn/faf-coturn.env
    network_mode: host

  #
  # FAF MySQL database.
  #
  faf-db:
    container_name: faf-db
    image: mariadb:10.6
    networks:
      - faf
      - faf-extra
    restart: unless-stopped
    env_file: ./config/faf-db/faf-db.env
    ports:
        - "127.0.0.1:3306:3306"
    volumes:
      - ./config/faf-db/mysqld.cnf:/etc/mysql/mariadb.conf.d/mysqld-custom.cnf
      - ./config/faf-db/mysql.cnf:/root/.my.cnf
      - ./data/faf-db:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
      timeout: 20s
      retries: 10

  #
  # FAF MySQL database migrations creates & updates the database tables and some required data
  #
  faf-db-migrations:
    container_name: faf-db-migrations
    image: faforever/faf-db-migrations:v124.2
    user: ${FAF_DB_USER}
    networks:
      - faf
    restart: "no"
    env_file: ./config/faf-db-migrations/faf-db-migrations.env

  #
  # FAF game server for clients to connect to.
  #
  faf-python-server:
    container_name: faf-python-server
    image: faforever/faf-python-server:v1.12.2
    user: ${FAF_PYTHON_SERVER_USER}
    networks:
      faf:
        aliases:
          - "faf-python-server"
    restart: unless-stopped
    env_file: ./config/faf-python-server/faf-python-server.env
    volumes:
      - ./config/faf-python-server/dynamic:/code/config
    ulimits:
      nproc: 65535
      nofile:
        soft: 100000
        hard: 200000
    ports:
      - "8001:8001" # Server QDataStream
      - "8002:8002" # Server UTF8 Json
      - "127.0.0.1:4000:4000" # Control server
    logging:
      driver: "json-file"
      options:
        max-size: "100m"

  #
  # FAF JSON-API to provide data over HTTP.
  #
  faf-java-api:
    container_name: faf-java-api
    image: faforever/faf-java-api:v2.19.5
    user: ${FAF_JAVA_API_USER}
    networks:
      faf:
        aliases:
          - "faf-java-api"
    restart: unless-stopped
    env_file: ./config/faf-java-api/faf-java-api.env
    volumes:
      - ./config/faf-java-api/pki:/pki
      - ./config/faf-java-api/mail:/config/mail
      - ./data/content:/content
      - ./data/faf-java-api/logs:/logs
      - ./data/faf-java-api/repositories:/repositories
    expose:
      - "8010" # HTTP API
      - "8011" # HTTP Management API
    ports:
      - "127.0.0.1:8010:8010" # For internal testing only
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-java-api.rule=Host(`api.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-java-api.entryPoints=web-secure"
      - "traefik.http.routers.faf-java-api.middlewares=test-compress@file"
      - "traefik.http.services.faf-java-api.loadbalancer.server.port=8010"
    # TODO move to Dockerfile
    healthcheck:
      test: "wget -q -O /dev/null http://localhost:8011/actuator/health"
      interval: 30s
      timeout: 5s
      retries: 3
    logging:
      driver: "json-file"
      options:
        max-size: "100m"

  #
  # FAF website.
  #
  faf-website:
    container_name: faf-website
    image: faforever/faf-website:v1.14.2
    user: ${FAF_WEBSITE_USER}
    restart: unless-stopped
    env_file: ./config/faf-website/faf-website.env
    volumes:
      - ./config/faf-website/faf-website.env:/code/.env
    networks:
      - faf
    ports:
      - "127.0.0.1:8020:3000" # For internal testing only
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-website.rule=Host(`www.${DOMAINNAME}`) || Host(`${DOMAINNAME}`) || Host(`clans.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-website.entryPoints=web-secure"
      - "traefik.http.routers.faf-website.middlewares=test-compress@file"
      - "traefik.http.services.faf-website.loadbalancer.server.port=3000"
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
  #
  # IRC for FAF chat.
  #
  faf-ircd:
    container_name: faf-ircd
    image: faforever/faf-unrealircd:5.2.4
    restart: unless-stopped
    networks:
      - faf
    volumes:
      - ./config/faf-ircd/ssl/server.cert.pem:/data/unrealircd/conf/tls/server.cert.pem
      - ./config/faf-ircd/ssl/server.key.pem:/data/unrealircd/conf/tls/server.key.pem
      - ./config/faf-ircd/unrealircd.conf:/data/unrealircd/conf/unrealircd.conf
      - ./config/faf-ircd/motd.txt:/data/unrealircd/conf/ircd.motd
      - ./data/faf-ircd/:/data/unrealircd/data/
    ports:
      - "6667:6667" # plain text for QAI and Python client
      - "6697:6697" # ssl only
      - "8167:8167" # ssl only
    expose:
      # Anope
      - 7000

  #
  # IRC Services
  #
  faf-anope:
    container_name: faf-anope
    image: anope/anope:2.0.10
    restart: unless-stopped
    networks:
      - faf
    depends_on:
      - faf-ircd
    volumes:
      - ./config/faf-anope/services.conf:/anope/conf/services.conf

  #
  # QAI irc bot
  #
  faf-qai:
    container_name: faf-qai
    image: faforever/faf-qai:v1.1
    user: ${FAF_QAI_USER}
    restart: unless-stopped
    volumes:
      - ./config/faf-qai:/config
    networks:
      - faf

  #
  # The content management system which is still being used as a backend for the website. The website accesses
  # Wordpress over a JSON API plugin.
  #
  faf-wordpress:
    container_name: faf-wordpress
    image: wordpress
    user: ${FAF_WORDPRESS_USER}
    restart: unless-stopped
    volumes:
      - ./data/faf-wordpress/wp-content:/var/www/html/wp-content/:rw
    networks:
      faf:
        aliases:
          - "faf-wordpress"
    env_file: ./config/faf-wordpress/faf-wordpress.env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-wordpress.rule=Host(`direct.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-wordpress.entryPoints=web-secure"
      - "traefik.http.routers.faf-wordpress-http.rule=Host(`direct.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-wordpress-http.entryPoints=web"

  #
  # Serves static files such as maps, mods, game files etc.
  #
  faf-content:
    container_name: faf-content
    image: nginx:1.20
    restart: unless-stopped
    volumes:
      - ./data/content:/usr/share/nginx/html
      - ./config/faf-content/default.conf:/etc/nginx/conf.d/default.conf:ro
    networks:
      - faf
    env_file: ./config/faf-content/faf-content.env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-content.rule=Host(`content.${DOMAINNAME}`) || Host(`replay.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-content.entryPoints=web-secure"
      - "traefik.http.routers.faf-content.middlewares=redirect-replay-subdomain, test-compress@file, cors"
      - "traefik.http.middlewares.redirect-replay-subdomain.redirectregex.regex=^(http|https)://replay.${DOMAINNAME}/(.*)"
      - "traefik.http.middlewares.redirect-replay-subdomain.redirectregex.replacement=$${1}://api.${DOMAINNAME}/game/$${2}/replay"
      - "traefik.http.middlewares.cors.headers.accesscontrolallowmethods=GET"
      - "traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist=*"
      - "traefik.http.middlewares.cors.headers.accesscontrolmaxage=60"
      - "traefik.http.middlewares.cors.headers.addvaryheader=false"

  #
  # The second version of "live replay" server
  #
  faf-aio-replayserver:
    container_name: faf-aio-replayserver
    image: faforever/faf-aio-replayserver:1.1.4
    user: ${FAF_AIO_REPLAYSERVER_USER}
    restart: unless-stopped
    volumes:
      - ./data/content:/content
      - ./config/faf-aio-replayserver:/config
    networks:
      - faf
    env_file: ./config/faf-aio-replayserver/faf-aio-replayserver.env
    ports:
      - "15000:15000"

  # The third version of the "live replay" server, in Rust.
  faf-rust-replayserver:
    container_name: faf-rust-replayserver
    image: faforever/faf-rust-replayserver:0.3.2
    user: ${FAF_AIO_REPLAYSERVER_USER}
    restart: unless-stopped
    volumes:
      - ./data/content:/content
      - ./config/faf-rust-replayserver:/config
    networks:
      - faf
    env_file: ./config/faf-rust-replayserver/faf-rust-replayserver.env
    ports:
      - "15000:15000"
    logging:
      driver: "json-file"
      options:
        max-size: "100m"

  faf-policy-server:
    container_name: faf-policy-server
    image: faforever/faf-policy-server:v1.22
    env_file: ./config/faf-policy-server/faf-policy-server.env
    user: ${FAF_POLICY_SERVER_USER}
    restart: unless-stopped
    networks:
      faf:
        aliases:
          - "faf-policy-server"
    expose:
      - "8097"
    volumes:
      - ./data/faf-policy-server/faf-uid-verifier/verifier:/app/verifier

  #
  # Postal is a fully featured open source mail delivery platform for incoming & outgoing e-mail.
  #
  faf-postal:
    container_name: faf-postal
    image: faforever/faf-postal:1.1
    env_file: ./config/faf-postal/faf-postal.env
    user: ${FAF_POSTAL_USER}
    restart: unless-stopped
    networks:
      faf:
        aliases:
          - "faf-postal"
    expose:
      - "25"
    volumes:
      - ./data/faf-postal/assets:/opt/postal/public/assets
      - ./config/faf-postal/config:/opt/postal/config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-postal.rule=Host(`postal.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-postal.entryPoints=web-secure"
      - "traefik.http.services.faf-postal.loadbalancer.server.port=5000"

  #
  # RabbitMQ is open source message broker software (sometimes called message-oriented middleware) that implements the
  # Advanced Message Queuing Protocol (AMQP).
  #
  faf-rabbitmq:
    image: rabbitmq:3.9.16-management-alpine
    container_name: faf-rabbitmq
    hostname: rabbitmq.${DOMAINNAME}
    ports:
    - "15692:15692"
    env_file: ./config/faf-rabbitmq/faf-rabbitmq.env
    user: ${FAF_RABBITMQ_USER}
    restart: unless-stopped
    networks:
      faf:
        aliases:
          - "faf-rabbitmq"
    volumes:
      - ./config/faf-rabbitmq/enabled_plugins:/etc/rabbitmq/enabled_plugins
      - ./data/faf-rabbitmq:/var/lib/rabbitmq
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-rabbitmq.rule=Host(`rabbitmq.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-rabbitmq.entryPoints=web-secure"
      - "traefik.http.services.faf-rabbitmq.loadbalancer.server.port=15672"

  #
  # FAF League Service
  #
  faf-league-service:
    container_name: faf-league-service
    image: faforever/faf-league-service:1.2.0
    user: ${FAF_LEAGUE_SERVICE_USER}
    networks:
      faf:
        aliases:
          - "faf-league-service"
    restart: unless-stopped
    env_file: ./config/faf-league-service/faf-league-service.env

  #
  # OAuth2 service
  #
  faf-ory-hydra:
    container_name: faf-ory-hydra
    image: oryd/hydra:v1.11.7
    # We consider the Docker network safe since we are on a single host.
    # If someone gains access to network, he has root access and can turn off the security anyway.
    # This can be improved once the login stack was moved outside the main host.
    command: serve all -c /hydra.yaml --dangerous-force-http
    networks:
      faf:
        aliases:
          - "faf-ory-hydra"
    volumes:
      - ./config/faf-ory-hydra/hydra.yaml:/hydra.yaml
    restart: unless-stopped
    ports:
      - "127.0.0.1:4445:4445" # only for testing
      - "127.0.0.1:4444:4444" # only for testing
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-ory-hydra.rule=Host(`hydra.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-ory-hydra.entryPoints=web-secure"
      - "traefik.http.routers.faf-ory-hydra.tls.certresolver=default"
      - "traefik.http.services.faf-ory-hydra.loadbalancer.server.port=4444"

  #
  # FAF User Service
  #
  faf-user-service:
    container_name: faf-user-service
    image: faforever/faf-user-service:1.0.11
    networks:
      faf:
        aliases:
          - "faf-user-service"
    restart: unless-stopped
    env_file: ./config/faf-user-service/faf-user-service.env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.faf-user-service.rule=Host(`user.${DOMAINNAME}`)"
      - "traefik.http.routers.faf-user-service.entryPoints=web-secure"
      - "traefik.http.routers.faf-user-service.tls.certresolver=default"
      - "traefik.http.services.faf-user-service.loadbalancer.server.port=8080"

networks:
  faf:
    driver: bridge
  faf-extra:
    driver: bridge