prod-stack.yml

version: '3.7'
services:
  rd:
    image: redis:3.2
    networks: 
      - hta_network
    ports:
      - "6379:6379"
    deploy:
      mode: replicated
      replicas: 1
  db:
    image: postgres:9.6
    networks: 
      - hta_network
    deploy:
      mode: replicated
      replicas: 1
  webconsole:
    image: paullj1/webconsole:latest
    networks: 
      - webconsole
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    ports:
      - "8888:8888"
    secrets:
      - CLIENT_CRT
      - CLIENT_KEY
      - SERVER_CRT
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /docker.sock
  webconsole_proxy:
    image: paullj1/socat_static:latest
    networks: 
      - webconsole
    ports:
      - target: 2376
        published: 2376
        mode: host
    secrets:
      - CLIENT_CRT
      - SERVER_PEM
    deploy:
      mode: global
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /docker.sock
    command: ["-d", "-d",
      "openssl-listen:2376,fork,reuseaddr,cert=/run/secrets/SERVER_PEM,cafile=/run/secrets/CLIENT_CRT",
      "unix-connect:/docker.sock"]
  web:
    image: paullj1/hackthearch:latest
    environment:
      - RAILS_ENV=production
      - RACK_ENV=production
      - RAILS_SERVE_STATIC_FILES=enabled
      - LANG=en_US.UTF-8
      - PORT=3000
      - DATABASE_URL=postgresql://postgres@db/postgres
      - REDIS_URL=redis://rd:6379/
      # CHANGE THESE
      - SECRET_KEY_BASE=NOTASECRET
      - CONSOLE_HOST=http://ubuntu.local:8888
      - HOST=localhost
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
    ports:
      - "3000:3000"
    networks: 
      - hta_network
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager

secrets:
  REGISTRY_AUTH:
    external: true
  CLIENT_CRT:
    external: true
  CLIENT_KEY:
    external: true
  SERVER_PEM:
    external: true
  SERVER_CRT:
    external: true

networks:
  hta_network:
  webconsole: