zammad-traefik-letsencrypt-docker-compose.yml

networks:
  zammad-network:
    external: true
  traefik-network:
    external: true

volumes:
  zammad-postgres:
  redis-data:
  zammad-backup:
  zammad-storage:
  elasticsearch-data:
  traefik-certificates:

services:
  postgres:
    image: ${ZAMMAD_POSTGRES_IMAGE_TAG}
    command: postgres -c 'max_connections=50'
    volumes:
      - zammad-postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: ${ZAMMAD_DB_NAME}
      POSTGRES_USER: ${ZAMMAD_DB_USER}
      POSTGRES_PASSWORD: ${ZAMMAD_DB_PASSWORD}
    networks:
      - zammad-network
    healthcheck:
      test: [ "CMD", "pg_isready", "-q", "-d", "${ZAMMAD_DB_NAME}", "-U", "${ZAMMAD_DB_USER}" ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  redis:
    image: ${ZAMMAD_REDIS_IMAGE_TAG}
    volumes:
      - redis-data:/data
    networks:
      - zammad-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  elasticsearch:
    image: ${ZAMMAD_ELASTICSEARCH_IMAGE_TAG}
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    networks:
      - zammad-network
    restart: unless-stopped

  memcached:
    command: memcached -m 256M
    image: ${ZAMMAD_MEMCACHE_IMAGE_TAG}
    networks:
      - zammad-network
    restart: unless-stopped

  init:
    image: ${ZAMMAD_IMAGE_TAG}
    command: ["zammad-init"]
    user: 0:0
    volumes:
      - zammad-storage:/opt/zammad/storage
    environment:
      POSTGRESQL_DB: ${ZAMMAD_DB_NAME}
      POSTGRESQL_HOST: ${ZAMMAD_POSTGRES_HOST}
      POSTGRESQL_USER: ${ZAMMAD_DB_USER}
      POSTGRESQL_PASS: ${ZAMMAD_DB_PASSWORD}
      POSTGRESQL_PORT: ${ZAMMAD_DB_PORT}
      POSTGRESQL_OPTIONS: ?pool=50
      MEMCACHE_SERVERS: ${ZAMMAD_MEMCACHE_SERVERS}
      REDIS_URL: ${ZAMMAD_REDIS_URL}
    networks:
      - zammad-network
    restart: on-failure
    depends_on:
      - postgres

  zammad:
    image: ${ZAMMAD_IMAGE_TAG}
    command: ["zammad-nginx"]
    environment:
      NGINX_PORT: 8080
      ZAMMAD_RAILSSERVER_HOST: railsserver
      ZAMMAD_RAILSSERVER_PORT: 3000
      ZAMMAD_WEBSOCKET_HOST: websocket
      ZAMMAD_WEBSOCKET_PORT: 6042
      RAILS_TRUSTED_PROXIES: '127.0.0.1, ::1, traefik'
      NGINX_SERVER_SCHEME: https
      POSTGRESQL_DB: ${ZAMMAD_DB_NAME}
      POSTGRESQL_HOST: ${ZAMMAD_POSTGRES_HOST}
      POSTGRESQL_USER: ${ZAMMAD_DB_USER}
      POSTGRESQL_PASS: ${ZAMMAD_DB_PASSWORD}
      POSTGRESQL_PORT: ${ZAMMAD_DB_PORT}
      MEMCACHE_SERVERS: ${ZAMMAD_MEMCACHE_SERVERS}
      REDIS_URL: ${ZAMMAD_REDIS_URL}
      ELASTICSEARCH_ENABLED: ${ZAMMAD_ELASTICSEARCH_ENABLED}
      ELASTICSEARCH_HOST: ${ZAMMAD_ELASTICSEARCH_HOST}
      ELASTICSEARCH_PORT: ${ZAMMAD_ELASTICSEARCH_PORT}
      ELASTICSEARCH_SSL_VERIFY: ${ZAMMAD_ELASTICSEARCH_SSL_VERIFY}
    networks:
      - zammad-network
      - traefik-network
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # Match incoming requests on a specific hostname
      - "traefik.http.routers.zammad.rule=Host(`${ZAMMAD_HOSTNAME}`)"
      # Assign the router to a named Traefik service
      - "traefik.http.routers.zammad.service=zammad"
      # Use the 'websecure' (HTTPS) entry point
      - "traefik.http.routers.zammad.entrypoints=websecure"
      # Define the internal container port for routing
      - "traefik.http.services.zammad.loadbalancer.server.port=8080"
      # Enable TLS on this router
      - "traefik.http.routers.zammad.tls=true"
      # Use Let's Encrypt for certificate management
      - "traefik.http.routers.zammad.tls.certresolver=letsencrypt"
      # Pass the original Host header to the container
      - "traefik.http.services.zammad.loadbalancer.passhostheader=true"
      # Apply a compression middleware
      - "traefik.http.routers.zammad.middlewares=compresstraefik"
      # Define settings for the compression middleware
      - "traefik.http.middlewares.compresstraefik.compress=true"
      # Define allowed methods for CORS on Zammad routes
      - "traefik.http.middlewares.zammad-cors.headers.accessControlAllowMethods=GET,OPTIONS,PUT"
      # Allow all origins for CORS on Zammad routes
      - "traefik.http.middlewares.zammad-cors.headers.accessControlAllowOriginList=*"
      # Allow all headers for CORS on Zammad routes
      - "traefik.http.middlewares.zammad-cors.headers.accessControlAllowHeaders=*"
      # Add 'Vary' header to responses for proper caching with CORS
      - "traefik.http.middlewares.zammad-cors.headers.addVaryHeader=true"
      # Attach the CORS middleware to the Zammad router
      - "traefik.http.routers.zammad.middlewares=zammad-cors"
      # Specify which Docker network Traefik should use for routing
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped
    depends_on:
      - railsserver

  railsserver:
    image: ${ZAMMAD_IMAGE_TAG}
    command: ["zammad-railsserver"]
    environment:
      POSTGRESQL_DB: ${ZAMMAD_DB_NAME}
      POSTGRESQL_HOST: ${ZAMMAD_POSTGRES_HOST}
      POSTGRESQL_USER: ${ZAMMAD_DB_USER}
      POSTGRESQL_PASS: ${ZAMMAD_DB_PASSWORD}
      POSTGRESQL_PORT: ${ZAMMAD_DB_PORT}
      POSTGRESQL_OPTIONS: ?pool=50
      MEMCACHE_SERVERS: ${ZAMMAD_MEMCACHE_SERVERS}
      REDIS_URL: ${ZAMMAD_REDIS_URL}
    networks:
      - zammad-network
    restart: unless-stopped
    depends_on:
      - memcached
      - postgres
      - redis

  scheduler:
    image: ${ZAMMAD_IMAGE_TAG}
    command: ["zammad-scheduler"]
    environment:
      POSTGRESQL_DB: ${ZAMMAD_DB_NAME}
      POSTGRESQL_HOST: ${ZAMMAD_POSTGRES_HOST}
      POSTGRESQL_USER: ${ZAMMAD_DB_USER}
      POSTGRESQL_PASS: ${ZAMMAD_DB_PASSWORD}
      POSTGRESQL_PORT: ${ZAMMAD_DB_PORT}
      POSTGRESQL_OPTIONS: ?pool=50
      MEMCACHE_SERVERS: ${ZAMMAD_MEMCACHE_SERVERS}
      REDIS_URL: ${ZAMMAD_REDIS_URL}
    networks:
      - zammad-network
    restart: unless-stopped
    depends_on:
      - memcached
      - railsserver
      - redis

  websocket:
    image: ${ZAMMAD_IMAGE_TAG}
    command: ["zammad-websocket"]
    environment:
      POSTGRESQL_DB: ${ZAMMAD_DB_NAME}
      POSTGRESQL_HOST: ${ZAMMAD_POSTGRES_HOST}
      POSTGRESQL_USER: ${ZAMMAD_DB_USER}
      POSTGRESQL_PASS: ${ZAMMAD_DB_PASSWORD}
      POSTGRESQL_PORT: ${ZAMMAD_DB_PORT}
      POSTGRESQL_OPTIONS: ?pool=50
      MEMCACHE_SERVERS: ${ZAMMAD_MEMCACHE_SERVERS}
      REDIS_URL: ${ZAMMAD_REDIS_URL}
    networks:
      - zammad-network
      - traefik-network
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # Match incoming requests on a specific hostname
      - "traefik.http.routers.zammad-websocket.rule=Host(`${ZAMMAD_WEBSOCKET_HOSTNAME}`)"
      # Assign the router to a named Traefik service
      - "traefik.http.routers.zammad-websocket.service=zammad-websocket"
      # Use the 'websecure' (HTTPS) entry point
      - "traefik.http.routers.zammad-websocket.entrypoints=websecure"
      # Define the internal container port for routing
      - "traefik.http.services.zammad-websocket.loadbalancer.server.port=6042"
      # Enable TLS on this router
      - "traefik.http.routers.zammad-websocket.tls=true"
      # Use Let's Encrypt for certificate management
      - "traefik.http.routers.zammad-websocket.tls.certresolver=letsencrypt"
      # Pass the original Host header to the container
      - "traefik.http.services.zammad-websocket.loadbalancer.passhostheader=true"
      # Apply a compression middleware
      - "traefik.http.routers.zammad-websocket.middlewares=compresstraefik"
      # Define settings for the compression middleware
      - "traefik.http.middlewares.compresstraefik.compress=true"
      # Specify which Docker network Traefik should use for routing
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped
    depends_on:
      - memcached
      - railsserver
      - redis

  traefik:
    image: ${TRAEFIK_IMAGE_TAG}
    command:
      # Set the log level (DEBUG, INFO, WARN, ERROR)
      - "--log.level=${TRAEFIK_LOG_LEVEL}"
      # Enable the built-in API and web-based dashboard
      - "--api.dashboard=true"
      # Enable the /ping endpoint so we can health-check Traefik
      - "--ping=true"
      # Assign the /ping endpoint to a dedicated entry point on port 8082
      - "--ping.entrypoint=ping"
      - "--entrypoints.ping.address=:8082"
      # Define the primary HTTP entry point on port 80
      - "--entrypoints.web.address=:80"
      # Define the secure (HTTPS) entry point on port 443
      - "--entrypoints.websecure.address=:443"
      # HTTP -> HTTPS redirect at entrypoint level
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      # Enable the Docker provider to detect containers and their labels
      - "--providers.docker=true"
      # Point Traefik to the Docker socket
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      # Prevent automatic exposure of all containers; only expose containers
      # with "traefik.enable=true"
      - "--providers.docker.exposedbydefault=false"
      # Use ACME (Let's Encrypt) to generate/renew certificates via TLS challenge
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      # The email address used by Let's Encrypt for renewal notices
      - "--certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL}"
      # The file where ACME certificates are stored inside the container
      - "--certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme/acme.json"
      # Enable Prometheus metrics
      - "--metrics.prometheus=true"
      # Configure Prometheus histogram buckets
      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
      # Check for newer Traefik versions and optionally log that info
      - "--global.checknewversion=true"
      # Disable sending anonymous usage data to the Traefik maintainers
      - "--global.sendanonymoususage=false"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certificates:/etc/traefik/acme
    networks:
      - traefik-network
    ports:
      - "80:80"
      - "443:443"
    healthcheck:
      test: ["CMD", "wget", "http://localhost:8082/ping","--spider"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # A router to expose the Traefik dashboard
      - "traefik.http.routers.dashboard.rule=Host(`${TRAEFIK_HOSTNAME}`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      # Basic Authentication for the Traefik dashboard
      - "traefik.http.routers.dashboard.middlewares=authtraefik"
      - "traefik.http.middlewares.authtraefik.basicauth.users=${TRAEFIK_BASIC_AUTH}"
      # Specify the internal server port to the dashboard service
      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
      # Pass the original Host header to the backend
      - "traefik.http.services.dashboard.loadbalancer.passhostheader=true"
    restart: unless-stopped

  backup:
    image: ${ZAMMAD_POSTGRES_IMAGE_TAG}
    entrypoint: /usr/local/bin/backup.sh
    command: ["zammad-backup"]
    volumes:
      - zammad-backup:/var/tmp/zammad
      - zammad-storage:/opt/zammad/storage:ro
      - ./scripts/backup.sh:/usr/local/bin/backup.sh:ro
    environment:
      POSTGRESQL_DB: ${ZAMMAD_DB_NAME}
      POSTGRESQL_HOST: ${ZAMMAD_POSTGRES_HOST}
      POSTGRESQL_USER: ${ZAMMAD_DB_USER}
      POSTGRESQL_PASS: ${ZAMMAD_DB_PASSWORD}
      POSTGRESQL_PORT: ${ZAMMAD_DB_PORT}
      POSTGRESQL_OPTIONS: ?pool=50
      MEMCACHE_SERVERS: ${ZAMMAD_MEMCACHE_SERVERS}
      REDIS_URL: ${ZAMMAD_REDIS_URL}
      BACKUP_TIME: ${BACKUP_TIME}
      HOLD_DAYS: ${HOLD_DAYS}
      TZ: ${ZAMMAD_TIMEZONE}
    restart: unless-stopped
    depends_on:
      - railsserver
      - postgres