docker-compose.yml

# Set DOCKER_MTU in .env if your network requires a non-standard MTU
# (e.g. Yandex.Cloud DDoS-protected IPs need 1450;
# see https://github.com/moby/moby/issues/22297#issuecomment-242934050)
networks:
  default:
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: "${DOCKER_MTU:-1500}"

services:
  certbot:
    image: adferrand/dnsrobocert
    hostname: certbot
    profiles:
      - certs
    volumes:
      - ./private/letsencrypt:/etc/letsencrypt
      # needed for nginx container autorestart, https://dnsrobocert.readthedocs.io/en/latest/configuration_reference.html#autorestart
      - /var/run/docker.sock:/var/run/docker.sock
      # should be in the following format:
      # https://dnsrobocert.readthedocs.io/en/latest/user_guide.html#configuration
      - ./config/dnsrobocert.yml:/etc/dnsrobocert/config.yml

    # For yandexcloud:
    # AUTH_KEY must be provided, short-lived and set by scripts/update-dns-token.sh
    # DNS_ZONE_ID from https://console.cloud.yandex.com/link/dns or
    # CLOUD_ID, FOLDER_ID from https://console.cloud.yandex.com/cloud can be provided
    env_file: private/environment/dnsrobocert.env
    # used in config/dnsrobocert.yml
    environment:
      - PROVIDER=${CERTBOT_PROVIDER:-yandexcloud}
      - EMAIL=${CERTBOT_EMAIL:-admin@example.com}
      - DOMAIN=${DOMAIN:-example.com}

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

    restart: unless-stopped

  nginx:
    build: ./config/nginx
    hostname: nginx
    image: ghcr.io/paskal/nginx:latest
    # only php: adminer/updater are profile-gated and modern compose errors on
    # depends_on referencing undefined services. Production overlays that ship
    # vhosts proxying to them re-add the ordering in docker-compose.override.yml
    depends_on:
      - php
    ports:
      - "${HTTP_PORT:-80}:80"
      - "${HTTPS_PORT:-443}:443/tcp"
      - "${HTTPS_PORT:-443}:443/udp"
    expose:
      - "8084"
    volumes:
      - ./web/prod:/web/prod
      - ./web/dev:/web/dev
      - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./config/nginx/bitrix.conf:/etc/nginx/bitrix.conf:ro
      - ./config/nginx/fastcgi.conf:/etc/nginx/fastcgi.conf:ro
      - ./config/nginx/bots.conf:/etc/nginx/bots.conf:ro
      - ./config/nginx/security_headers.conf:/etc/nginx/security_headers.conf:ro
      - ./config/nginx/static-cdn.conf:/etc/nginx/static-cdn.conf:ro
      - ./config/nginx/conf.d:/etc/nginx/conf.d:ro
      - ./private/nginx:/etc/nginx/private.conf.d:ro
      - ./private/letsencrypt:/etc/nginx/letsencrypt:ro
      # Logs
      - ./logs/nginx:/var/log/nginx
    environment:
      - TZ=${TZ:-Europe/Moscow}

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

    restart: unless-stopped

  php:
    build:
      context: ./config/php
      dockerfile: Dockerfile.8.4
    image: ghcr.io/paskal/bitrix-php:8.4
    hostname: php
    depends_on:
      - memcached
      - memcached-sessions
    expose:
      - "9000"
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
    volumes:
      - ./web/prod:/web/prod
      - ./web/dev:/web/dev
      - ./private/msmtprc:/etc/msmtprc
      # MySQL socket to prevent transferring data through TCP
      - ./private/mysqld:/var/run/mysqld
      # PHPStan neon configs (phpstan-scan.sh runs `php /phpstan/phpstan.phar`)
      - ./private/phpstan:/phpstan:ro
      # PHPStan output (JSON + count file consumed by Zabbix via zabbix-agent)
      - ./logs/phpstan:/var/log/phpstan
      # Logs
      - ./logs/php:/var/log/php
      # configuration
      - ./config/php/90-php.ini:/etc/php/8.4/fpm/conf.d/90-php.ini
      - ./config/php/91-disable-functions.ini:/etc/php/8.4/fpm/conf.d/91-disable-functions.ini:ro
      - ./config/php/zz-pm.conf:/etc/php/8.4/fpm/pool.d/zz-pm.conf
      - ./config/php/xdebug.ini:/etc/php/8.4/mods-available/xdebug.ini
      # for monitoring purposes
      - ./logs/nginx:/var/log/nginx
      # switch timezone from UTC to Moscow
      - ./config/php/moscow-timezone:/etc/timezone:ro
      - ./config/php/moscow-localtime:/etc/localtime:ro

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

    restart: unless-stopped

  php-cron:
    command: cron -f
    image: ghcr.io/paskal/bitrix-php:8.4
    hostname: php-cron
    depends_on:
      - memcached
      - memcached-sessions
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
    volumes:
      - ./web/prod:/web/prod
      - ./web/dev:/web/dev
      - ./private/msmtprc:/etc/msmtprc
      # MySQL socket to prevent transferring data through TCP
      - ./private/mysqld:/var/run/mysqld
      # PHPStan neon configs (phpstan-scan.sh runs `php /phpstan/phpstan.phar`)
      - ./private/phpstan:/phpstan:ro
      # PHPStan output (JSON + count file consumed by Zabbix via zabbix-agent)
      - ./logs/phpstan:/var/log/phpstan
      # Logs for email sending: msmtp expects to write logs there
      - ./logs/php:/var/log/php
      # configuration
      - ./config/php/90-php.ini:/etc/php/8.4/cli/conf.d/90-php.ini
      - ./config/php/91-disable-functions.ini:/etc/php/8.4/cli/conf.d/91-disable-functions.ini:ro
      # Cronjobs
      - ./config/cron/php-cron.cron:/etc/cron.d/tasks:ro
      # switch timezone from UTC to Moscow
      - ./config/php/moscow-timezone:/etc/timezone:ro
      - ./config/php/moscow-localtime:/etc/localtime:ro

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

    restart: unless-stopped

  mysql:
    image: percona/percona-server:8.4
    hostname: mysql
    # MYSQL_ROOT_PASSWORD, MYSQL_USER, MYSQL_PASSWORD
    env_file: private/environment/mysql.env
    volumes:
      # Configuration
      - ./config/mysql/my.cnf:/etc/my.cnf.d/my.cnf
      # Data persistence
      - ./private/mysql-data:/var/lib/mysql
      # MySQL socket to prevent transferring data through TCP
      # do chown 1001:1001 ./private/mysqld
      - ./private/mysqld:/var/mysql-socket
      # Logs
      - ./logs/mysql:/var/log/mysql
    environment:
      MYSQL_DATABASE: ${MYSQL_DATABASE:-bitrix}
      TZ: ${TZ:-Europe/Moscow}
    cap_add:
      - SYS_NICE  # CAP_SYS_NICE

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

    restart: unless-stopped

  memcached:
    image: memcached:1-alpine
    hostname: memcached
    restart: unless-stopped
    command: ["-m", "2048", "-c", "32768"]
    expose:
      - "11211"
    healthcheck:
      test: ["CMD", "sh", "-c", "echo stats | nc localhost 11211"]
      interval: 30s
      timeout: 10s
      retries: 3

  memcached-sessions:
    image: memcached:1-alpine
    hostname: memcached-sessions
    restart: unless-stopped
    command: ["-m", "128"]
    expose:
      - "11211"
    healthcheck:
      test: ["CMD", "sh", "-c", "echo stats | nc localhost 11211"]
      interval: 30s
      timeout: 10s
      retries: 3

  adminer:
    image: adminer
    hostname: adminer
    profiles:
      - dbadmin
    expose:
      - "8080"
    environment:
      ADMINER_DEFAULT_SERVER: localhost
    volumes:
      - ./config/adminer/mysql-socket.ini:/usr/local/etc/php/conf.d/mysql-socket.ini
      # MySQL socket to prevent transferring data through TCP
      - ./private/mysqld:/var/run/mysqld
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080"]
      interval: 30s
      timeout: 10s
      retries: 5

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

    restart: unless-stopped

  # Monitoring

  ## Zabbix Agent 2
  zabbix-agent:
    build: ./config/zabbix
    image: ghcr.io/paskal/zabbix-agent2:latest
    profiles:
      - monitoring
    privileged: true
    # MYSQL_USER, MYSQL_PASSWORD
    # ZBX_HOSTNAME, ZBX_SERVER_HOST
    env_file:
      - private/environment/mysql.env
      - private/environment/zabbix.env
      # for monitoring purposes, as AUTH_TOKEN is supposed to be set by scripts/update-dns-token.sh
      - private/environment/dnsrobocert.env
    depends_on:
      - nginx
      - memcached
    volumes:
      # for monitoring purposes
      - ./logs/nginx:/var/log/nginx
      # for monitoring purposes
      - ./web/prod/upload:/web/prod/upload
      # this is needed in order to monitor docker
      # to make it work you need to create user "zabbix" with id 1997 on the host system,
      # and make sure it has enough permissions to read /var/run/docker.sock
      - /var/run/docker.sock:/var/run/docker.sock
      # MySQL socket to prevent transferring data through TCP
      - ./private/mysqld:/var/run/mysqld
      # PHPStan output (read-only): system.run["cat /var/log/phpstan/owned_errors_count.txt"]
      - ./logs/phpstan:/var/log/phpstan:ro
      # backup status files (read-only): mysql-last-size.txt / files-last.txt, written by
      # scripts/mysql-dump.sh + file-backup.sh on success — feeds the "Backup monitoring" template
      - ./logs/backup:/var/log/backup:ro

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    restart: unless-stopped

  # webhooks server
  updater:
    image: ghcr.io/umputun/updater:master
    hostname: updater
    profiles:
      - hooks
    restart: always
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    # KEY variable
    env_file: private/environment/updater.env
    environment:
      - LISTEN=0.0.0.0:8080
      - CONF=/etc/updater.yml
      - APP_UID=1000
    ports:
      - "8080"
    volumes:
      - ./config/updater.yaml:/etc/updater.yml
      - ./private/updater_ssh_key:/home/app/.ssh/id_rsa

  # FTP access

  ftp:
    image: stilliard/pure-ftpd
    # FTP_USER_NAME, FTP_USER_PASS
    env_file: private/environment/ftp.env
    ports:
      - "21:21"
      - "30000-30009:30000-30009"
    volumes:
      - ./web/dev:/home/web
    environment:
      PUBLICHOST: ${DOMAIN:-localhost}
      FTP_USER_HOME: /home/web
      FTP_PASSIVE_PORTS: 30000:30009
    profiles:
      - ftp
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

    restart: unless-stopped