docker-compose.yml

version: '3.3'
services:
  traefik:
    # The official v2 Traefik docker image
    image: traefik:v2.2
    # Enables the web UI and tells Traefik to listen to docker
    container_name: "traefik"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.teamspeakvoice.address=:9987/udp"
      - "--entrypoints.teamspeakquery.address=:10011"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=info@suchtundordnung.de"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      # These here are both debug settings, remove them for production use
      # - "--api.insecure=true"
      - "--log.level=${TRAEFIK_LOG_LEVEL}"
      #- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
      - "9987:9987/udp"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.https-redirect.entrypoints=http"
      - "traefik.http.routers.https-redirect.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.https-redirect.middlewares=https-redirect"
      - "traefik.http.middlewares.https-redirect.redirectscheme.scheme=https"
  traefikforward:
    image: thomseddon/traefik-forward-auth
    container_name: traefikforward
    environment:
      - PROVIDERS_GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - PROVIDERS_GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      - SECRET=${SECRET}
      - INSECURE_COOKIE=${INSECURE_COOKIE} # Example assumes no https, do not use in production
      - WHITELIST=${WHITELIST}
      - DOMAIN=${DOMAIN}
      - AUTH_HOST=${AUTH_HOST}
      - LOG_LEVEL=${TRAEFIKFORWARD_LOG_LEVEL}
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.traefikforward.loadbalancer.server.port=4181"
      - "traefik.http.middlewares.traefikforward.redirectscheme.scheme=https"
      - "traefik.http.middlewares.traefikforward.redirectscheme.permanent=true"
      - "traefik.http.routers.traefikforward.entrypoints=websecure"
      - "traefik.http.routers.traefikforward.tls.certresolver=myresolver"
      - "traefik.http.routers.traefikforward.rule=Host(`${AUTH_HOST}`)"
  metricbeat:
    container_name: "metricbeat"
    image: docker.elastic.co/beats/metricbeat:${ELASTIC_VERSION}
    command: --strict.perms=false -e
    user: root
    depends_on: 
      - kibana
    volumes:
      - "./metricbeat.yml:/usr/share/metricbeat/metricbeat.yml:ro"
      - /proc:/hostfs/proc:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /:/hostfs:ro
      - /var/run/docker.sock:/var/run/docker.sock
  filebeat:
    container_name: "filebeat"
    image: docker.elastic.co/beats/filebeat:${ELASTIC_VERSION}
    command: --strict.perms=false -e
    user: root
    depends_on: 
      - kibana
    volumes:
      - "./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
      - "/var/run/docker.sock:/var/run/docker.sock"
      # This is needed for filebeat to load container log path as specified in filebeat.yml
      - "/var/lib/docker/containers/:/var/lib/docker/containers/:ro"
      # This is needed for filebeat to load logs for system and auth modules
      - "/var/log/:/var/log/:ro"
  kibana:
    image: docker.elastic.co/kibana/kibana:${ELASTIC_VERSION}
    container_name: "kibana"
    labels:
      - "traefik.enable=true"
    #     Route which handles HTTPS Traffic
      - "traefik.http.routers.kibana.rule=Host(`${KIBANA_DOMAIN}`)"
      - "traefik.http.routers.kibana.entrypoints=websecure"
      - "traefik.http.routers.kibana.tls.certresolver=myresolver"
    #     Apply Forward Auth to the Service 
      - "traefik.http.routers.kibana.middlewares=kibana"
      - "traefik.http.middlewares.kibana.forwardauth.address=http://traefikforward:4181"
      - "traefik.http.middlewares.kibana.forwardauth.authResponseHeaders=X-Forwarded-User"
      - "traefik.http.middlewares.kibana.forwardauth.authResponseHeaders=X-Auth-User, X-Secret"
      - "traefik.http.middlewares.kibana.forwardauth.trustForwardHeader=true"
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION}
    container_name: elasticsearch
    environment:
      - "discovery.type=single-node"
    volumes:
      - esdata:/usr/share/elasticsearch/data 

  owncloud:
    image: owncloud/server:10.4.0
    restart: always
    depends_on:
      - ownclouddb
      - redis
    environment:
      - OWNCLOUD_DOMAIN=${OWNCLOUD_DOMAIN}
      - OWNCLOUD_DB_TYPE=mysql
      - OWNCLOUD_DB_NAME=${OWNCLOUD_DB_NAME}
      - OWNCLOUD_DB_USERNAME=${OWNCLOUD_DB_USERNAME}
      - OWNCLOUD_DB_PASSWORD=${OWNCLOUD_DB_PASSWORD}
      - OWNCLOUD_DB_HOST=${OWNCLOUD_DB_HOST}
      - OWNCLOUD_ADMIN_USERNAME=${OWNCLOUD_ADMIN_USERNAME}
      - OWNCLOUD_ADMIN_PASSWORD=${OWNCLOUD_ADMIN_PASSWORD}
      - OWNCLOUD_MYSQL_UTF8MB4=true
      - OWNCLOUD_REDIS_ENABLED=true
      - OWNCLOUD_REDIS_HOST=redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.owncloud.rule=Host(`${OWNCLOUD_DOMAIN}`)"
      - "traefik.http.routers.owncloud.entrypoints=websecure"
      - "traefik.http.routers.owncloud.tls.certresolver=myresolver"
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - files:/mnt/data
  ownclouddb:
    image: webhippie/mariadb:latest
    restart: always
    environment:
      - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD}
      - MARIADB_USERNAME=${MARIADB_USERNAME}
      - MARIADB_PASSWORD=${MARIADB_PASSWORD}
      - MARIADB_DATABASE=${MARIADB_DATABASE}
      - MARIADB_MAX_ALLOWED_PACKET=128M
      - MARIADB_INNODB_LOG_FILE_SIZE=64M
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - mysql:/var/lib/mysql
      - backup:/var/lib/backup
  redis:
    image: webhippie/redis:latest
    restart: always
    environment:
      - REDIS_DATABASES=1
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - redis:/var/lib/redis

  whoamisecure:
    image: containous/whoami
    labels:
      - "traefik.enable=true"
      #  Router to forward Port 80 tto 443
      #- "traefik.http.routers.whoamisecure80.rule=Host(`api.farsity.de`)"
      #- "traefik.http.routers.whoamisecure80.entrypoints=web"
      #- "traefik.http.routers.whoamisecure80.middlewares=httpsredirect"
      #- "traefik.http.middlewares.httpsredirect.redirectscheme.scheme=https"
      #- "traefik.http.middlewares.httpsredirect.redirectscheme.permanent=true"
      #  Route which handles HTTPS Traffic
      - "traefik.http.routers.whoamisecure.rule=Host(`api.farsity.de`)"
      - "traefik.http.routers.whoamisecure.entrypoints=websecure"
      - "traefik.http.routers.whoamisecure.tls.certresolver=myresolver"
      #  Apply Forward Auth to the Service 
      - "traefik.http.routers.whoamisecure.middlewares=whoamisecure"
      - "traefik.http.middlewares.whoamisecure.forwardauth.address=http://traefikforward:4181"
      - "traefik.http.middlewares.whoamisecure.forwardauth.authResponseHeaders=X-Forwarded-User"
      - "traefik.http.middlewares.whoamisecure.forwardauth.authResponseHeaders=X-Auth-User, X-Secret"
      - "traefik.http.middlewares.whoamisecure.forwardauth.trustForwardHeader=true"
  teamspeak:
    image: teamspeak
    labels:
      - "traefik.enable=true"
      - "traefik.udp.routers.teamspeak.entrypoints=teamspeakvoice"
      - "traefik.tcp.routers.teamspeak.entrypoints=teamspeakquery"
    restart: always
    environment:
      TS3SERVER_DB_PLUGIN: ts3db_mariadb
      TS3SERVER_DB_SQLCREATEPATH: create_mariadb
      TS3SERVER_DB_HOST: teamspeakdb
      TS3SERVER_DB_USER: root
      TS3SERVER_DB_PASSWORD: example
      TS3SERVER_DB_NAME: teamspeak
      TS3SERVER_DB_WAITUNTILREADY: 30
      TS3SERVER_LICENSE: accept
  teamspeakdb:
    image: mariadb
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: example
      MYSQL_DATABASE: teamspeak
volumes:
  esdata:
  redis:
  files:
  mysql:
  backup:
  redis: