version: '3'

services:

  database:
    image: mariadb:latest
    container_name: database
    restart: unless-stopped
    volumes:
      - $PWD/database:/var/lib/mysql
    environment:
      MARIADB_RANDOM_ROOT_PASSWORD: '1'
      MARIADB_USER: blog
      MARIADB_PASSWORD: AxTR59I
      MARIADB_DATABASE: blog
    networks:
      - wp

  wordpress:
    depends_on:
      - database
      - traefik
    image: wordpress
    container_name: wordpress
    restart: unless-stopped
    networks:
      - proxy
      - wp
    volumes:
      - $PWD/html:/var/www/html
    environment:
      WORDPRESS_DB_HOST: database
      WORDPRESS_DB_USER: blog
      WORDPRESS_DB_PASSWORD: AxTR59I
      WORDPRESS_DB_NAME: blog
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.blog.entrypoints=http"
      - "traefik.http.routers.blog.rule=Host(`blog.doma.in`)"
      - "traefik.http.middlewares.blog-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.blog.middlewares=blog-https-redirect"
      - "traefik.http.routers.blog-secure.entrypoints=https"
      - "traefik.http.routers.blog-secure.rule=Host(`blog.doma.in`)"
      - "traefik.http.routers.blog-secure.tls=true"
      - "traefik.http.routers.blog-secure.tls.certresolver=http"
      - "traefik.http.routers.blog-secure.service=blog"
      - "traefik.http.services.blog.loadbalancer.server.port=80"
      - "traefik.docker.network=proxy"

  traefik:
    image: traefik:v2.1
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - $PWD/traefik-proxy/traefik.yml:/traefik.yml:ro
      - $PWD/traefik-proxy/acme.json:/acme.json
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`traefik.doma.in`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$yvJi96A$$Q20oIPsstfBc8.ZFeW41"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.doma.in`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=http"
      - "traefik.http.routers.traefik-secure.service=api@internal"

networks:
  proxy:
  wp:

## -----------------------------------------

## cat traefik-proxy/traefik.yml
#debug: "true"
#logLevel: "DEBUG"

api:
  dashboard: true

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false

certificatesResolvers:
  http:
    acme:
      email: mail@doma.in
      storage: acme.json
      httpChallenge:
        entryPoint: http