numbus-server/config-files/docker/passbolt.nix

{ config, pkgs, ... }:

let
  container_name = "passbolt";
  compose_file = "podman/passbolt/compose.yaml";
in

{
  config = {
    environment.etc."${compose_file}".text =
      /*
      yaml
      */
      ''
        services:
          passbolt:
            image: passbolt/passbolt:latest-ce-non-root
            container_name: passbolt
            networks:
              passbolt_frontend:
              passbolt_backend:
            volumes:
              - passbolt-gpg:/etc/passbolt/gpg
              - passbolt-jwt:/etc/passbolt/jwt
            environment:
              APP_DEFAULT_TIMEZONE: $TZ
              APP_FULL_BASE_URL: https://passbolt.$DOMAIN_NAME
              DATASOURCES_DEFAULT_HOST: "passbolt-database"
              DATASOURCES_DEFAULT_USERNAME: $PASSBOLT_MYSQL_USER
              DATASOURCES_DEFAULT_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
              DATASOURCES_DEFAULT_DATABASE: $PASSBOLT_MYSQL_DATABASE
              EMAIL_DEFAULT_FROM_NAME: "Passbolt"
              EMAIL_TRANSPORT_DEFAULT_HOST: $SENDER_EMAIL_DOMAIN
              EMAIL_TRANSPORT_DEFAULT_PORT: $SENDER_EMAIL_PORT
              EMAIL_TRANSPORT_DEFAULT_USERNAME: $SENDER_EMAIL_ADDRESS
              EMAIL_TRANSPORT_DEFAULT_PASSWORD: $SENDER_EMAIL_ADDRESS_PASSWORD
              EMAIL_TRANSPORT_DEFAULT_TLS: true
              EMAIL_DEFAULT_FROM: $EMAIL_ADDRESS
              PASSBOLT_SSL_FORCE: true
            labels:
              - traefik.enable=true
              - traefik.http.services.passbolt.loadbalancer.server.port=4433
              - traefik.http.services.passbolt.loadbalancer.server.scheme=https
              - traefik.http.routers.passbolt-https.entrypoints=websecure
              - traefik.http.routers.passbolt-https.rule=Host(`passbolt.$DOMAIN_NAME`)
              - traefik.http.routers.passbolt-https.tls=true
              - traefik.http.routers.passbolt-https.tls.certresolver=cloudflare
            command:
              [
                "/usr/bin/wait-for.sh",
                "-t",
                "0",
                "passbolt-database:3306",
                "--",
                "/docker-entrypoint.sh",
              ]
            depends_on:
              - passbolt-database
            restart: unless-stopped

          passbolt-database:
            image: mariadb:11.3
            container_name: passbolt-database
            networks:
              passbolt_backend:
            volumes:
              - passbolt-database:/var/lib/mysql
            environment:
              MYSQL_RANDOM_ROOT_PASSWORD: "true"
              MYSQL_DATABASE: $PASSBOLT_MYSQL_DATABASE
              MYSQL_USER: $PASSBOLT_MYSQL_USER
              MYSQL_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
            restart: unless-stopped

        networks:
          passbolt_backend:
            external: true
          passbolt_frontend:
            external: true

        volumes:
          passbolt-database:
          passbolt-gpg:
          passbolt-jwt:
      '';

    systemd.services.${container_name} = {
      description = "Podman container : ${container_name}";
      after = [ "network.target" ];
      requires = [ "traefik.service" ];
      wantedBy = [ "multi-user.target" ];
      path = [ pkgs.podman ];

      serviceConfig = {
        User = "numbus-admin";
        Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
        Type = "exec";
        # Pull the latest image before running
        ExecStartPre = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull";
        # Bring the service up
        ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
        # Take it down gracefully
        ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
        Restart = "on-failure";
        RestartSec = "5m";
        StartLimitBurst = "3";
      };
    };
  };
}