Raphaël Billet
107 lines
3.7 KiB
Plaintext
107 lines
3.7 KiB
Plaintext
{ config, pkgs, ... }:
|
|
|
|
let
|
|
container_name = "passbolt";
|
|
compose-dir = "docker-compose/passbolt";
|
|
in
|
|
|
|
{
|
|
config = {
|
|
environment.etc."${compose-dir}/compose.yaml".text =
|
|
/*
|
|
yaml
|
|
*/
|
|
''
|
|
services:
|
|
passbolt:
|
|
image: passbolt/passbolt:latest-ce-non-root
|
|
container_name: passbolt
|
|
networks:
|
|
passbolt_frontend:
|
|
passbolt_backend:
|
|
volumes:
|
|
- passbolt-gpg:/etc/passbolt/gpg
|
|
- passbolt-jwt:/etc/passbolt/jwt
|
|
environment:
|
|
APP_DEFAULT_TIMEZONE: $TZ
|
|
APP_FULL_BASE_URL: https://passbolt.$DOMAIN_NAME
|
|
DATASOURCES_DEFAULT_HOST: "passbolt-database"
|
|
DATASOURCES_DEFAULT_USERNAME: $PASSBOLT_MYSQL_USER
|
|
DATASOURCES_DEFAULT_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
|
|
DATASOURCES_DEFAULT_DATABASE: $PASSBOLT_MYSQL_DATABASE
|
|
EMAIL_DEFAULT_FROM_NAME: "Passbolt"
|
|
EMAIL_TRANSPORT_DEFAULT_HOST: $SENDER_EMAIL_DOMAIN
|
|
EMAIL_TRANSPORT_DEFAULT_PORT: $SENDER_EMAIL_PORT
|
|
EMAIL_TRANSPORT_DEFAULT_USERNAME: $SENDER_EMAIL_ADDRESS
|
|
EMAIL_TRANSPORT_DEFAULT_PASSWORD: $SENDER_EMAIL_ADDRESS_PASSWORD
|
|
EMAIL_TRANSPORT_DEFAULT_TLS: true
|
|
EMAIL_DEFAULT_FROM: $EMAIL_ADDRESS
|
|
PASSBOLT_SSL_FORCE: true
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.services.passbolt.loadbalancer.server.port=4433
|
|
- traefik.http.services.passbolt.loadbalancer.server.scheme=https
|
|
- traefik.http.routers.passbolt-https.entrypoints=websecure
|
|
- traefik.http.routers.passbolt-https.rule=Host(`passbolt.$DOMAIN_NAME`)
|
|
- traefik.http.routers.passbolt-https.tls=true
|
|
- traefik.http.routers.passbolt-https.tls.certresolver=cloudflare
|
|
command:
|
|
[
|
|
"/usr/bin/wait-for.sh",
|
|
"-t",
|
|
"0",
|
|
"passbolt-database:3306",
|
|
"--",
|
|
"/docker-entrypoint.sh",
|
|
]
|
|
depends_on:
|
|
- passbolt-database
|
|
restart: unless-stopped
|
|
|
|
passbolt-database:
|
|
image: mariadb:11.3
|
|
container_name: passbolt-database
|
|
networks:
|
|
passbolt_backend:
|
|
volumes:
|
|
- passbolt-database:/var/lib/mysql
|
|
environment:
|
|
MYSQL_RANDOM_ROOT_PASSWORD: "true"
|
|
MYSQL_DATABASE: $PASSBOLT_MYSQL_DATABASE
|
|
MYSQL_USER: $PASSBOLT_MYSQL_USER
|
|
MYSQL_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
passbolt_backend:
|
|
external: true
|
|
passbolt_frontend:
|
|
external: true
|
|
|
|
volumes:
|
|
passbolt-database:
|
|
passbolt-gpg:
|
|
passbolt-jwt:
|
|
'';
|
|
|
|
systemd.services.passbolt = {
|
|
description = "Docker container : ${container_name}";
|
|
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
|
requires = [ "docker.service" ];
|
|
wantedBy = ["multi-user.target"];
|
|
path = [ pkgs.docker ];
|
|
|
|
serviceConfig = {
|
|
Type = "exec";
|
|
# Pull the latest image before running
|
|
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
|
# Bring the service up
|
|
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
|
# Take it down gracefully
|
|
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
|
|
|
Restart = "on-failure";
|
|
};
|
|
};
|
|
};
|
|
} |