docker-compose.yml

version: "3"
##### services #####
services:
  ### traefik ###
  traefik:
    image: traefik:v2.10.7
    domainname: ${DOMAINNAME}
    hostname: traefik
    command:
      - "--certificatesresolvers.certbot.acme.email=${ADMIN_EMAIL}"
    environment:
      - ADMIN_EMAIL=${ADMIN_EMAIL}
      - CF_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
      - TRAEFIK_CREDENTIALS=${TRAEFIK_CREDENTIALS}
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - "${DATA_PATH}/traefik/config/:/etc/traefik/"
      - "${DATA_PATH}/traefik/logs/:/logs/"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/etc/localtime:/etc/localtime:ro"

  whoami:
    image: "traefik/whoami"
    container_name: "whoami"
    domainname: ${DOMAINNAME}
    hostname: whoami
    environment:
      - "DOMAINNAME=${DOMAINNAME}"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.${DOMAINNAME}`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls=true"
      - "traefik.http.routers.whoami.tls.certresolver=certbot"

  ### ldap ###
  openldap:
    build:
      context: ./openldap
    domainname: ${DOMAINNAME}
    hostname: openldap
    environment:
      - LDAP_LOG_LEVEL=256
      - LDAP_ORGANISATION=${LDAP_ORGANISATION}
      - LDAP_DOMAIN=${LDAP_DOMAIN}
      - LDAP_BASE_DN=${LDAP_BASE_DN}
      - LDAP_ADMIN_PASSWORD=${LDAP_ADMIN_PASSWORD}
      - LDAP_CONFIG_PASSWORD=${LDAP_CONFIG_PASSWORD}
      - LDAP_READONLY_USER=true
      - LDAP_READONLY_USER_USERNAME=readonly
      - LDAP_READONLY_USER_PASSWORD=${LDAP_READONLY_PASSWORD}
      - LDAP_BACKEND=hdb
      - LDAP_TLS=true
      - LDAP_TLS_CRT_FILENAME=ldap.crt
      - LDAP_TLS_KEY_FILENAME=ldap.key
      - LDAP_TLS_CA_CRT_FILENAME=ca.crt
      - LDAP_TLS_ENFORCE=false
      - LDAP_TLS_CIPHER_SUITE=SECURE256:-VERS-SSL3.0
      - LDAP_TLS_PROTOCOL_MIN=3.1
      - LDAP_TLS_VERIFY_CLIENT=demand
      - LDAP_REPLICATION=false
      #- LDAP_REPLICATION_CONFIG_SYNCPROV=binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1 starttls=critical
      #- LDAP_REPLICATION_DB_SYNCPROV=binddn="cn=admin,$LDAP_BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$LDAP_BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="60 +" timeout=1 starttls=critical
      #- LDAP_REPLICATION_HOSTS=#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']
      - LDAP_REMOVE_CONFIG_AFTER_SETUP=true
      - LDAP_SSL_HELPER_PREFIX=ldap
    tty: true
    stdin_open: true
    volumes:
      - "${DATA_PATH}/var/lib/ldap:/var/lib/ldap"
      - "${DATA_PATH}/etc/ldap/slapd.d:/etc/ldap/slapd.d"
      #- '${DATA_PATH}/container/service/slapd/assets/certs/:/container/service/slapd/assets/certs/'
    ports:
      #- "389:389"
      - "636:636"

  ldapaccountmanager:
    image: ghcr.io/ldapaccountmanager/lam:8.5
    domainname: ${DOMAINNAME}
    hostname: ldapaccountmanager
    volumes:
      - "${DATA_PATH}/lam/config:/var/lib/ldap-account-manager/config:rw"
    depends_on:
      - openldap

  ### kanidm ###
  kanidm:
    container_name: kanidm
    image: kanidm/server:1.1.0-rc.15
    volumes:
      - ${DATA_PATH}/kanidm:/data
    labels:
      - traefik.enable=true
      - traefik.http.routers.kanidm.entrypoints=websecure
      - traefik.http.routers.kanidm.rule=Host(`idm.${DOMAINNAME}`)
      - traefik.http.routers.kanidm.service=kanidm
      - traefik.http.serversTransports.kanidm.insecureSkipVerify=true
      - traefik.http.services.kanidm.loadbalancer.server.port=8443
      - traefik.http.services.kanidm.loadbalancer.server.scheme=https
      - "traefik.http.routers.kanidm.tls=true"
      - "traefik.http.routers.kanidm.tls.certresolver=certbot"

  ### gitlab ###
  gitlab:
    build:
      context: ./gitlab
    domainname: ${DOMAINNAME}
    hostname: gitlab
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://gitlab.${DOMAINNAME}'
        registry_external_url 'https://gitlab.${DOMAINNAME}:4567'
        mattermost_external_url 'https://mattermost.${DOMAINNAME}'
        gitlab_rails['gitlab_shell_ssh_port'] = 2224
        gitlab_rails['gitlab_email_from'] = 'gitlab@${DOMAINNAME}'
        gitlab_rails['gitlab_email_reply_to'] = 'noreply@${DOMAINNAME}'
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = "smtp.gmail.com"
        gitlab_rails['smtp_port'] = 587
        gitlab_rails['smtp_user_name'] = "${SMTP_USER_NAME}"
        gitlab_rails['smtp_password'] = "${SMTP_USER_PASSWORD}"
        gitlab_rails['smtp_domain'] = "smtp.gmail.com"
        gitlab_rails['smtp_authentication'] = "login"
        gitlab_rails['smtp_enable_starttls_auto'] = true
        gitlab_rails['smtp_tls'] = false
        gitlab_rails['smtp_openssl_verify_mode'] = 'peer' # Can be: 'none', 'peer', 'client_once', 'fail_if_no_peer_cert', see http://api.rubyonrails.org/classes/ActionMailer/Base.html
        gitlab_rails['ldap_enabled'] = true
        gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
            main:
              label: 'LDAP'
              host: 'openldap'
              port: 389
              uid: 'uid'
              method: 'plain' # "tls" or "ssl" or "plain"
              bind_dn: 'cn=readonly,${LDAP_BASE_DN}'
              password: '${LDAP_READONLY_PASSWORD}'
              active_directory: false
              allow_username_or_email_login: true
              base: '${LDAP_BASE_DN}'
              user_filter: ''
              attributes:
                username: ['uid', 'userid', 'sAMAccountName']
                email: ['mail', 'email', 'userPrincipalName']
                name: 'cn'
                first_name: 'givenName'
                last_name: 'sn'
              lowercase_usernames: false
        EOS
    ulimits:
      sigpending: 62793
      nproc: 131072
      nofile:
        soft: 20000
        hard: 40000
      core: 0

    ports:
      #  - '80:80'
      - "2224:22"
    volumes:
      - "${DATA_PATH}/gitlab/config:/etc/gitlab"
      - "${DATA_PATH}/gitlab/logs:/var/log/gitlab"
      - "${DATA_PATH}/gitlab/data:/var/opt/gitlab"
      - "${DATA_PATH}/nginx/certs/live/${DOMAINNAME}/privkey.pem:/etc/gitlab/ssl/gitlab.${DOMAINNAME}.key"
      - "${DATA_PATH}/nginx/certs/live/${DOMAINNAME}/privkey.pem:/etc/gitlab/ssl/mattermost.${DOMAINNAME}.key"
      - "${DATA_PATH}/nginx/certs/live/${DOMAINNAME}/fullchain.pem:/etc/gitlab/ssl/gitlab.${DOMAINNAME}.crt"
      - "${DATA_PATH}/nginx/certs/live/${DOMAINNAME}/fullchain.pem:/etc/gitlab/ssl/mattermost.${DOMAINNAME}.crt"
      - "/etc/localtime:/etc/localtime:ro"
    depends_on:
      - openldap
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.gitlab.entrypoints=websecure"
      - "traefik.http.routers.gitlab.rule=Host(`gitlab.${DOMAINNAME}`)"
      - "traefik.http.routers.gitlab.tls=true"
      - "traefik.http.routers.gitlab.tls.certresolver=certbot"
      - "traefik.http.routers.gitlab.service=gitlab"
      - "traefik.http.services.gitlab.loadbalancer.server.port=80"

  plantuml:
    image: plantuml/plantuml-server:tomcat

  ### nextcloud ###
  nextcloud-db:
    image: mariadb:11.2.2
    domainname: ${DOMAINNAME}
    volumes:
      - "${DATA_PATH}/nextcloud/db-data:/var/lib/mysql"
    environment:
      - MYSQL_ROOT_PASSWORD=${NEXTCLOUD_DB_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=${NEXTCLOUD_DB_PASSWORD}

  nextcloud-redis:
    image: redis:alpine
    domainname: ${DOMAINNAME}
    volumes:
      - "${DATA_PATH}/nextcloud/redis-data:/data"

  nextcloud:
    build: nextcloud
    domainname: ${DOMAINNAME}
    hostname: nextcloud
    environment:
      - UID=1000
      - GID=1000
      - UPLOAD_MAX_SIZE=10G
      - APC_SHM_SIZE=128M
      - OPCACHE_MEM_SIZE=128
      - REDIS_MAX_MEMORY=64mb
      - CRON_PERIOD=15m
      - TZ=CET
      - ADMIN_USER=root
      - ADMIN_PASSWORD=${NEXTCLOUD_PASSWORD}
      - DB_TYPE=mysql
      - DB_NAME=nextcloud
      - DB_USER=nextcloud
      - DB_PASSWORD=${NEXTCLOUD_DB_PASSWORD}
      - DB_HOST=nextcloud-db
    depends_on:
      - nextcloud-db
      - nextcloud-redis
      - openldap
    volumes:
      - "${DATA_PATH}/nextcloud/data:/data"
      - "${DATA_PATH}/nextcloud/config:/nextcloud/config"
      - "${DATA_PATH}/nextcloud/apps:/nextcloud/apps2"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nextcloud.entrypoints=websecure"
      - "traefik.http.routers.nextcloud.rule=Host(`nextcloud.${DOMAINNAME}`)"
      - "traefik.http.routers.nextcloud.tls=true"
      - "traefik.http.routers.nextcloud.tls.certresolver=certbot"
      - "traefik.http.routers.nextcloud.service=nextcloud"
      - "traefik.http.services.nextcloud.loadbalancer.server.port=8888"

  ### vaultwarden ###

  vaultwarden:
    image: "vaultwarden/server:1.30.1-alpine"
    domainname: ${DOMAINNAME}
    hostname: vaultwarden
    volumes:
      - "${DATA_PATH}/vaultwarden:/data"
    environment:
      - DOMAIN=https://vault.${DOMAINNAME}
      - ADMIN_TOKEN=${VAULTWARDEN_ADMIN_TOKEN}
      - WEB_VAULT_ENABLED=true
      - SIGNUPS_ALLOWED=true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vault.rule=Host(`vault.${DOMAINNAME}`)"
      - "traefik.http.routers.vault.entrypoints=websecure"
      - "traefik.http.routers.vault.tls=true"
      - "traefik.http.routers.vault.tls.certresolver=certbot"

  ### vpn ###

  vpn:
    build:
      context: ./wireguard
    domainname: ${DOMAINNAME}
    hostname: vpn
    volumes:
      - "${DATA_PATH}/etc/wireguard:/etc/wireguard"
    ports:
      - 5555:5555/udp
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - "net.ipv4.ip_forward=1"
      - "net.ipv6.conf.all.disable_ipv6=0"
      - "net.ipv6.conf.all.forwarding=1"
      - "net.ipv6.conf.default.forwarding=1"

  ### portainer ###

  portainer:
    image: portainer/portainer-ce:2.19.3
    profiles:
      - portainer
    ports:
      - 9443:9443
    volumes:
      - ${DATA_PATH}/portainer:/data
      - /var/run/docker.sock:/var/run/docker.sock