compose.yml

services:
  db:
    image: docker.io/library/mysql:8.0
    command: --default-authentication-plugin=mysql_native_password --log-bin=binlog --expire_logs_days=3 --secure-file-priv=""
    cap_add:
      - SYS_NICE  # CAP_SYS_NICE, fix error mbind: Operation not permitted
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
      - MYSQL_ROOT_HOST=%
      - MYSQL_DATABASE=mediawiki
    secrets:
      - db_root_password
    volumes:
      - ./_initdb:/docker-entrypoint-initdb.d
      - db_data:/var/lib/mysql

  web:
    image: ghcr.io/canastawiki/canasta:wikiteq-ee9690c9 # 1.39.11
    restart: always
    extra_hosts:
      - "gateway.docker.internal:host-gateway"
    depends_on:
      - db
      - elasticsearch
    environment:
      # Sourced from .env
      - MW_SITE_SERVER=${MW_SITE_SERVER?Variable MW_SITE_SERVER not set}
      - PHP_UPLOAD_MAX_FILESIZE=${PHP_UPLOAD_MAX_FILESIZE:-10M}
      - PHP_POST_MAX_SIZE=${PHP_UPLOAD_MAX_FILESIZE:-10M}
      - PHP_MAX_INPUT_VARS=${PHP_MAX_INPUT_VARS:-1000}
      - MW_ENABLE_SITEMAP_GENERATOR # Enable it on the PROD wiki only! See WIK-1420
      - PASSWORD_SENDER=eyewiki@aao.org
      - MW_SITE_FQDN
      - APACHE_REMOTE_IP_HEADER=X-Real-Ip # Use IP passed by Traefik, see MEYE-401
      - PHP_ERROR_REPORTING=${PHP_ERROR_REPORTING:-E_ALL & ~E_USER_DEPRECATED & ~E_DEPRECATED & ~E_STRICT & ~E_NOTICE}
    secrets:
      - db_root_password
      - google_key
      - smtp_password
    volumes:
      - web_data:/mediawiki
      - images:/mediawiki/images
      - ./extensions:/var/www/mediawiki/w/user-extensions
      - ./skins:/var/www/mediawiki/w/user-skins
      - ./config:/mediawiki/config

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
    restart: always
    environment:
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms${ES_MEMORY:-512m} -Xmx${ES_MEMORY:-512m}"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data

  varnish:
    image: pastakhov/varnish:7.0
    restart: always
    networks:
      - traefik-public
      - default
    depends_on:
      - web
    environment:
      - VARNISH_SIZE=${VARNISH_SIZE:-1g}
      - VARNISH_STORAGE_KIND=file
    volumes:
       - ./config/varnish:/etc/varnish:ro
       - varnish_data:/data
    tmpfs:
      - /var/lib/varnish:exec
    labels:
      # Enable Traefik for this service
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.constraint-label=traefik-public
      # Set the domain name for the service
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-varnish.rule=Host(`${MW_SITE_FQDN?Variable MW_SITE_FQDN not set}`)
      # Set http and https entrypoints for the service
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-varnish.entrypoints=websecure
      # Connect the service to LE certs resolver
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-varnish.tls.certresolver=le
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-varnish.middlewares=crowdsec@file${TRAEFIK_EXTRA_MIDDLEWARES:-}
      # ipDenyList middleware
#      - traefik.http.middlewares.${COMPOSE_PROJECT_NAME}-ipDenyList.plugin.denyip.ipDenyList=${IP_DENY_LIST:-127.0.0.254}
      # Redirect www subdomain to base
      # HTTPS
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-www-websecure.rule=Host(`www.$MW_SITE_FQDN`)
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-www-websecure.entrypoints=websecure
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-www-websecure.tls.certresolver=le
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-www-websecure.middlewares=${COMPOSE_PROJECT_NAME}_www_redirect
      # HTTP
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-www-web.rule=Host(`www.$MW_SITE_FQDN`)
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-www-web.entrypoints=web
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-www-web.middlewares=${COMPOSE_PROJECT_NAME}_www_redirect
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-www-web.priority=100
      # the redirect middleware
      - traefik.http.middlewares.${COMPOSE_PROJECT_NAME}_www_redirect.redirectregex.regex=^https?://www\.(.*)
      - traefik.http.middlewares.${COMPOSE_PROJECT_NAME}_www_redirect.redirectregex.replacement=https://$${1}

  # https://hub.docker.com/_/composer
  massmessage:
    image: composer:2.2
    restart: always
    depends_on:
      - web
    volumes:
      - ./eyewiki-massmessage-apiscripts:/app
    command: "sleep infinity"
    environment:
      # Sourced from .env
      - MASSMESSAGE_LIVE_MODE # Set true on production
      - MASSMESSAGE_SITE_URL=http://web/w
      - MASSMESSAGE_BOT_USER
      - MASSMESSAGE_BOT_PASSWORD_FILE=/run/secrets/massmessage_bot_password
      - MASSMESSAGE_SPAMLIST_CATEGORY
    secrets:
      - massmessage_bot_password
    labels:
      cron.enabled: true
      # At 11:00 every first Friday
      cron.massmessage.schedule: "0 11 * * FRI#1"
      cron.massmessage.command: "bash run.sh MassMessageAPI.php"
      # At 11:00 every day
      cron.stalepages.schedule: "0 11 * * *"
      cron.stalepages.command: "bash run.sh stalepages.php"

  # it uses "Golang Cron expression parser", see https://github.com/aptible/supercronic/tree/master/cronexpr
  cron:
    image: ghcr.io/wikiteq/cron:20250110-ddded6a
    restart: always
    environment:
      - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME}
      - DEBUG=${CRON_DEBUG:-0}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./logs/cron:/var/log/cron

  restic:
    image: ghcr.io/wikiteq/restic-backup-docker:stream
    restart: always
    profiles:
        - production
    depends_on:
        - db
    environment:
        - MW_DB_USER=root
        - MW_DB_PASS_FILE=/run/secrets/db_root_password
        - MW_DB_NAME=${MW_DB_NAME:-mediawiki}
        - RESTIC_TAG=backup_full
        - BACKUP_CRON=0 1 * * 6
        - CHECK_CRON=0 23 * * 5
        # pre-backup script
        - RESTIC_FORGET_ARGS=${MW_RESTIC_FORGET_ARGS:---prune --keep-weekly 4 --keep-monthly 12 --keep-yearly 1 --group-by tags}
        - RESTIC_PRE_BACKUP=if [ ! -d "/data" ]; then mkdir /data; fi && tar -C /data_mediawiki/ -zcvf /data/images.tar.gz images && mysqldump -hdb -u$$MW_DB_USER -p$(cat /run/secrets/db_root_password) $$MW_DB_NAME | gzip -c > /data/database.sql.gz
        # post-backup script
        - RESTIC_POST_BACKUP=rm /data/images.tar.gz && rm /data/database.sql.gz
        - RESTIC_REPOSITORY=${MW_RESTIC_REPOSITORY?Variable MW_RESTIC_REPOSITORY not set}
        - RESTIC_PASSWORD_FILE=/run/secrets/restic_password
        - AWS_SHARED_CREDENTIALS_FILE=/run/secrets/aws_credentials
    secrets:
        - aws_credentials
        - db_root_password
        - restic_password
    volumes:
        - images:/data_mediawiki/images:ro
        - restic_data:/mnt/restic
        - ./logs/restic:/var/log

secrets:
  aws_credentials:
    file: ./secrets/aws_credentials.txt
  db_root_password:
    file: ./secrets/db_root_password.txt
  google_key:
    file: ./secrets/google-key.json
  massmessage_bot_password:
    file: ./secrets/massmessage_bot_password.txt
  restic_password:
    file: ./secrets/restic_password.txt
  smtp_password:
    file: ./secrets/smtp_password.txt

volumes:
  elasticsearch_data:
  db_data:
  web_data:
  images:
  varnish_data:
  restic_data:

networks:
  traefik-public:
    external: true