docker-stack.yml

# Docker Swarm Stack – FestSchmiede Multi-Tenant (Phase 6)
# Nutzung: docker stack deploy -c docker-stack.yml festschmiede
#
# Secrets vorher anlegen:
#   echo "..." | docker secret create festschmiede_jwt_secret -
#   echo "..." | docker secret create festschmiede_db_password -

version: "3.8"

services:
  postgres:
    image: postgres:16.8-alpine3.21
    environment:
      POSTGRES_USER: festschmiede
      POSTGRES_DB: festschmiede
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - internal
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      restart_policy:
        condition: on-failure
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U festschmiede -d festschmiede"]
      interval: 10s
      timeout: 5s
      retries: 5

  backend:
    image: ${GHCR_IMAGE_PREFIX:-ghcr.io/timux/festschmiede}/backend:${IMAGE_TAG:-v2.5.6}
    environment:
      NODE_ENV: production
      PORT: 3001
      DATABASE_URL: postgresql://festschmiede@postgres:5432/festschmiede
      JWT_SECRET_FILE: /run/secrets/jwt_secret
      MULTI_TENANT_ENABLED: "true"
      PLATFORM_DOMAIN: ${PLATFORM_DOMAIN:-localhost}
      PLATFORM_BASE_DOMAIN: ${PLATFORM_DOMAIN:-${PLATFORM_BASE_DOMAIN:-localhost}}
      PLATFORM_WWW_DOMAIN: ${PLATFORM_WWW_DOMAIN:-}
      PLATFORM_APP_DOMAIN: ${PLATFORM_APP_DOMAIN:-}
      PLATFORM_API_DOMAIN: ${PLATFORM_API_DOMAIN:-}
      PLATFORM_ALLOWED_ORIGINS: ${PLATFORM_ALLOWED_ORIGINS:-}
      TRUSTED_PROXY_HOPS: "2"
      LOG_FORMAT: json
    secrets:
      - jwt_secret
      - db_password
    volumes:
      - uploads_data:/app/uploads
      - backups_data:/app/backups
    environment:
      FESTSCHMIEDE_BACKUP_DIR: /app/backups
    networks:
      - internal
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3001/api/health"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 40s

  frontend:
    image: ${GHCR_IMAGE_PREFIX:-ghcr.io/timux/festschmiede}/frontend:${IMAGE_TAG:-v2.5.6}
    environment:
      BACKEND_HOST: ${BACKEND_HOST:-backend}
      BACKEND_PORT: ${BACKEND_PORT:-3001}
    networks:
      - internal
      - public
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
      labels:
        - traefik.enable=true
        - traefik.http.routers.festschmiede.rule=${TRAEFIK_ROUTER_RULE}
        - traefik.http.routers.festschmiede.entrypoints=websecure
        - traefik.http.routers.festschmiede.tls=true
        - traefik.http.routers.festschmiede.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-le}
        - traefik.http.services.festschmiede.loadbalancer.server.port=80
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:80"]
      interval: 15s
      timeout: 5s
      retries: 5

  traefik:
    image: traefik:v3.3.4
    command:
      - --providers.swarm=true
      - --providers.swarm.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.le.acme.httpchallenge=true
      - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.le.acme.email=${ACME_EMAIL}
      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
    ports:
      - target: 80
        published: 80
        mode: host
      - target: 443
        published: 443
        mode: host
    volumes:
      - letsencrypt_data:/letsencrypt
    networks:
      - public
    deploy:
      placement:
        constraints:
          - node.role == manager

networks:
  public:
    driver: overlay
  internal:
    driver: overlay
    internal: true

volumes:
  postgres_data:
  uploads_data:
  backups_data:
  letsencrypt_data:

secrets:
  jwt_secret:
    external: true
    name: festschmiede_jwt_secret
  db_password:
    external: true
    name: festschmiede_db_password