passbolt.yml

# DOMAIN=example.com docker stack deploy -c passbolt.yml passbolt
# su -m -c "/usr/share/php/passbolt/bin/cake passbolt register_user -u your@email.com -f firstname -l lastname -r admin" -s /bin/sh www-data
# UPDATE users SET role_id = 'xyz' WHERE id = 'xyz'; # Set admin role

services:
  passbolt:
    image: passbolt/passbolt:${VERSION:-4.9.1-1-ce}
    command: "/usr/bin/wait-for.sh -t 0 mariadb:3306 -- /docker-entrypoint.sh"
    environment:
      - APP_FULL_BASE_URL=${SCHEME:-https}://${DOMAIN:-passbolt.localhost}
      - DATASOURCES_DEFAULT_HOST=mariadb
      - DATASOURCES_DEFAULT_USERNAME=passbolt
      - DATASOURCES_DEFAULT_PASSWORD=myp@ssw0rd
      - DATASOURCES_DEFAULT_DATABASE=passbolt
      - DATASOURCES_DEFAULT_PORT=3306
      - PASSBOLT_REGISTRATION_PUBLIC=${PASSBOLT_REGISTRATION_PUBLIC:-false}
      - EMAIL_DEFAULT_FROM=${SMTP_FROM:-noreply@example.com}
      - EMAIL_TRANSPORT_DEFAULT_HOST=${SMTP_HOST}
      - EMAIL_TRANSPORT_DEFAULT_PORT=${SMTP_PORT:-587}
      - EMAIL_TRANSPORT_DEFAULT_USERNAME=${SMTP_USER}
      - EMAIL_TRANSPORT_DEFAULT_PASSWORD=${SMTP_PASSWORD}
      - EMAIL_TRANSPORT_DEFAULT_TLS=${SMTP_TLS:-true}
    volumes:
      - ${VOLUME_PATH}gpg:/etc/passbolt/gpg
      - ${VOLUME_PATH}jwt:/etc/passbolt/jwt
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.passbolt-${NUMBER:-1}.rule=Host(`${DOMAIN:-passbolt.localhost}`)
        - traefik.http.routers.passbolt-${NUMBER:-1}.entrypoints=${SCHEME:-https}
        - traefik.http.routers.passbolt-${NUMBER:-1}.service=passbolt-${NUMBER:-1}
        - traefik.http.routers.passbolt-${NUMBER:-1}.tls.certresolver=letsencrypt
        - traefik.http.services.passbolt-${NUMBER:-1}.loadbalancer.server.port=80
    networks:
      - internal
      - traefik

  mariadb:
    image: mariadb:${MARIADB_VERSION:-10.5.9}
    volumes:
      - ${VOLUME_PATH}mariadb:/var/lib/mysql:cached
    environment:
      - MYSQL_ROOT_PASSWORD=myp@ssw0rd
      - MYSQL_DATABASE=passbolt
      - MYSQL_USER=passbolt
      - MYSQL_PASSWORD=myp@ssw0rd
    networks:
      - internal

volumes:
  mariadb:
  gpg:
  jwt:

networks:
  internal:
    driver: overlay
    attachable: true
  traefik:
    external: true
    name: traefik-net