143 lines
4.6 KiB
YAML
143 lines
4.6 KiB
YAML
version: "3.9"
|
|
|
|
networks:
|
|
appNet: { external: true }
|
|
privNet:
|
|
driver: overlay
|
|
internal: true
|
|
attachable: false
|
|
driver_opts: { encrypted: "true" }
|
|
|
|
secrets:
|
|
mysql_root_password___DOMAIN__: { external: true }
|
|
mysql_wp_password___DOMAIN__: { external: true }
|
|
|
|
x-common-env: &common_env
|
|
WORDPRESS_DB_HOST: db:3306
|
|
WORDPRESS_DB_USER: wordpress
|
|
WORDPRESS_DB_PASSWORD_FILE: /run/secrets/mysql_wp_password___DOMAIN__
|
|
WORDPRESS_DB_NAME: wordpress
|
|
WORDPRESS_CONFIG_EXTRA: |
|
|
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
|
|
$_SERVER['HTTPS'] = 'on';
|
|
}
|
|
define('FORCE_SSL_ADMIN', true);
|
|
define('WP_CACHE_KEY_SALT', '__DOMAIN__');
|
|
define('WP_REDIS_HOST', 'redis');
|
|
|
|
services:
|
|
db:
|
|
image: mysql:8.4
|
|
command: ["--innodb-buffer-pool-size=192M","--max-connections=100","--skip-log-bin"]
|
|
environment:
|
|
MYSQL_DATABASE: wordpress
|
|
MYSQL_USER: wordpress
|
|
MYSQL_ROOT_PASSWORD_FILE: /run/secrets/mysql_root_password___DOMAIN__
|
|
MYSQL_PASSWORD_FILE: /run/secrets/mysql_wp_password___DOMAIN__
|
|
secrets: [mysql_root_password___DOMAIN__, mysql_wp_password___DOMAIN__]
|
|
networks: [privNet]
|
|
volumes:
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/db
|
|
target: /var/lib/mysql
|
|
deploy:
|
|
placement: { constraints: ["node.labels.pool == mysql","node.role == worker"] }
|
|
resources:
|
|
limits: { cpus: "0.50", memory: 512M }
|
|
reservations: { cpus: "0.10", memory: 256M }
|
|
healthcheck:
|
|
test: ["CMD-SHELL","MYSQL_PWD=$$(cat /run/secrets/mysql_root_password___DOMAIN__) mysqladmin ping -h 127.0.0.1 -uroot"]
|
|
interval: 20s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
command: ["redis-server","--appendonly","yes","--maxmemory","96mb","--maxmemory-policy","allkeys-lru"]
|
|
networks: [privNet]
|
|
volumes:
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/redis
|
|
target: /data
|
|
deploy:
|
|
placement: { constraints: ["node.labels.pool == redis","node.role == worker"] }
|
|
resources:
|
|
limits: { cpus: "0.20", memory: 192M }
|
|
reservations: { cpus: "0.05", memory: 64M }
|
|
healthcheck:
|
|
test: ["CMD","redis-cli","ping"]
|
|
interval: 20s
|
|
timeout: 3s
|
|
retries: 5
|
|
|
|
php:
|
|
image: wordpress:php8.3-fpm
|
|
environment: *common_env
|
|
secrets: [mysql_wp_password___DOMAIN__]
|
|
networks: [appNet, privNet]
|
|
volumes:
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/code
|
|
target: /var/www/html
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/uploads
|
|
target: /var/www/html/wp-content/uploads
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/plugins
|
|
target: /var/www/html/wp-content/plugins
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/themes
|
|
target: /var/www/html/wp-content/themes
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/mu-plugins
|
|
target: /var/www/html/wp-content/mu-plugins
|
|
tmpfs: ["/tmp"]
|
|
security_opt: ["no-new-privileges:true"]
|
|
cap_drop: ["ALL"]
|
|
ulimits: { nofile: 65536, nproc: 4096 }
|
|
deploy:
|
|
placement: { constraints: ["node.labels.pool == php","node.role == worker"] }
|
|
resources:
|
|
limits: { cpus: "0.50", memory: 512M }
|
|
reservations: { cpus: "0.10", memory: 128M }
|
|
|
|
nginx:
|
|
image: nginx:stable-alpine
|
|
networks: [appNet]
|
|
depends_on: [php]
|
|
volumes:
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/code
|
|
target: /var/www/html:ro
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/nginx/conf.d
|
|
target: /etc/nginx/conf.d
|
|
read_only: true
|
|
tmpfs: ["/var/cache/nginx","/var/run"]
|
|
security_opt: ["no-new-privileges:true"]
|
|
cap_drop: ["ALL"]
|
|
ulimits: { nofile: 65536 }
|
|
deploy:
|
|
placement: { constraints: ["node.labels.pool == nginx","node.role == worker"] }
|
|
resources:
|
|
limits: { cpus: "0.25", memory: 256M }
|
|
reservations: { cpus: "0.05", memory: 64M }
|
|
|
|
wp-cron:
|
|
image: wordpress:cli
|
|
environment: *common_env
|
|
secrets: [mysql_wp_password___DOMAIN__]
|
|
networks: [privNet]
|
|
working_dir: /var/www/html
|
|
volumes:
|
|
- type: bind
|
|
source: /mnt/data/sites/__DOMAIN__/code
|
|
target: /var/www/html
|
|
command: ["bash","-lc","while true; do wp cron event run --due-now || true; sleep 60; done"]
|
|
security_opt: ["no-new-privileges:true"]
|
|
deploy:
|
|
placement: { constraints: ["node.labels.pool == wp","node.role == worker"] }
|
|
resources:
|
|
limits: { cpus: "0.10", memory: 128M }
|
|
reservations: { cpus: "0.05", memory: 64M }
|