patchmon/qa-stack.yml at master · UoGSoE/patchmon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
version: "3.7"

x-logging:
  &default-logging
  options:
    max-size: '12m'
    max-file: '5'
  driver: json-file
x-deploy:
  &default-deploy
  replicas: 1
  labels:
    - "traefik.enable=false"
  update_config:
    parallelism: 1
    failure_action: rollback
    order: start-first


services:
  app:
    image: ${IMAGE_NAME}
    logging: *default-logging
    environment:
      CONTAINER_ROLE: app
    build:
      context: .
    secrets:
      - source: dotenv
        target: .env
    depends_on:
      - redis
      - mysql
      - mailhog
    networks:
      - proxy
      - private
    expose:
      - "80"
    deploy:
      update_config:
        parallelism: 1
        failure_action: rollback
        order: start-first
      replicas: 1
      labels:
        # note: this assumes traefik v2
        - "traefik.enable=true"
        - "traefik.http.routers.${TRAEFIK_BACKEND}.rule=Host(`${TRAEFIK_HOSTNAME}`)"
        - "traefik.http.routers.${TRAEFIK_BACKEND}.entrypoints=web"
        - "traefik.http.services.${TRAEFIK_BACKEND}.loadbalancer.server.port=80" # it seems you always need to give traefik a port so it 'notices' the service
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.rule=Host(`${TRAEFIK_HOSTNAME}`)"
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.entrypoints=web-secured"
        - "traefik.http.routers.${TRAEFIK_BACKEND}-secured.tls.certresolver=mytlschallenge"

  scheduler:
    image: ${IMAGE_NAME}
    logging: *default-logging
    deploy: *default-deploy
    environment:
      CONTAINER_ROLE: scheduler
    depends_on:
      - app
    networks:
      - private
    secrets:
      - source: dotenv
        target: .env

  queue:
    image: ${IMAGE_NAME}
    logging: *default-logging
    deploy: *default-deploy
    stop_grace_period: 30s
    environment:
      CONTAINER_ROLE: queue
    depends_on:
      - app
    networks:
      - private
    secrets:
      - source: dotenv
        target: .env

  migrations:
    image: ${IMAGE_NAME}
    logging: *default-logging
    deploy: *default-deploy
    networks:
      - private
    environment:
      CONTAINER_ROLE: migrations
    depends_on:
      - app
    secrets:
      - source: dotenv
        target: .env

  redis:
    # redis:8.2.2 — pinned 2026-06-10
    # refresh: docker pull redis:8.2.2 && docker images --digests | grep '^redis'
    image: redis:8.2.2@sha256:4521b581dbddea6e7d81f8fe95ede93f5648aaa66a9dacd581611bf6fe7527bd
    deploy: *default-deploy
    networks:
      - private
    volumes:
      - redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]

  mysql:
    image: mysql:5.7
    deploy: *default-deploy
    networks:
      - private
    volumes:
      - mysql:/var/lib/mysql
    environment:
      MYSQL_DATABASE: homestead
      MYSQL_ROOT_PASSWORD: root
      MYSQL_USER: homestead
      MYSQL_PASSWORD: secret

  mailhog:
    # axllent/mailpit:v1.30.1 — pinned 2026-06-10 (was untagged → :latest)
    # refresh: docker pull axllent/mailpit:v1.30.1 && docker images --digests | grep mailpit
    image: axllent/mailpit:v1.30.1@sha256:3bd7c2f2696deb35a4780d152b404dceec99cb041b942c0877b3b22384714f85
    deploy:
      labels:
        # note: this assumes traefik v2
        - "traefik.enable=true"
        - "traefik.http.routers.mailhog-${TRAEFIK_BACKEND}.rule=Host(`mail-${TRAEFIK_HOSTNAME}`)"
        - "traefik.http.routers.mailhog-${TRAEFIK_BACKEND}.entrypoints=web"
        - "traefik.http.services.mailhog-${TRAEFIK_BACKEND}.loadbalancer.server.port=8025" # it seems you always need to give traefik a port so it 'notices' the service
        - "traefik.http.routers.mailhog-${TRAEFIK_BACKEND}-secured.rule=Host(`mail-${TRAEFIK_HOSTNAME}`)"
        - "traefik.http.routers.mailhog-${TRAEFIK_BACKEND}-secured.entrypoints=web-secured"
        - "traefik.http.routers.mailhog-${TRAEFIK_BACKEND}-secured.tls.certresolver=mytlschallenge"
    expose:
      - "8025"
    networks:
      - proxy
      - private

volumes:
  redis:
    driver: "local"
  mysql:
    driver: "local"

networks:
  private:
  proxy:
    external: true

secrets:
  dotenv:
    external: true
    name: ${DOTENV_NAME}