docker-stack.yml

---
version: "3.6"

services:

  shepherd:
    image: 'mazzolino/shepherd'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # /root/.docker/config.json:/root/.docker/config.json:ro
    environment:
      SLEEP_TIME: "5m"
      BLACKLIST_SERVICES: "shepherd autoscale traefik agent"
      WITH_REGISTRY_AUTH: "true"
      DOCKER_HOST: "unix:///var/run/docker.sock"
    deploy:
      restart_policy:
        condition: on-failure
      mode: global
      placement:
        constraints: [node.role == manager]
      labels:
        traefik.enable: "false"
        orbiter: "false"

  autoscale:
    image: gianarb/orbiter:latest
    #command: ["daemon", "--debug"]
    environment:
      DOCKER_HOST: "unix:///var/run/docker.sock"
    ports:
      - 8000
    networks:
      - public
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    deploy:
      restart_policy:
        condition: on-failure
      mode: replicated
      replicas: 1
      labels:
        com.centurylinklabs.watchtower.enable: "true"
        orbiter: "false"
        traefik.enable: "true"
        traefik.port: "8000"
        traefik.docker.network: "public"
        traefik.frontend.rule: "Host:scaler.${DOMAIN}"
        traefik.frontend.priority: "10"
        traefik.frontend.entryPoints: "http, https"
      placement:
        constraints: [node.role == manager]

  agent:
    image: portainer/agent:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - target: 9001
        published: 9001
        protocol: tcp
        mode: host
    environment:
      AGENT_CLUSTER_ADDR: tasks.agent
    networks:
      - internal
    deploy:
      mode: global
      restart_policy:
        condition: on-failure
      placement:
        constraints: [node.role == manager]
      labels:
        com.centurylinklabs.watchtower.enable: "true"
        orbiter: "false"
        traefik.enable: "false"

  traefik:
    image: traefik:latest
    command:
      - "--logLevel=DEBUG"
      - "--accesslog"
      - "--api=true"
      - "--api.entryPoint=traefik"
      - "--api.dashboard=true"
      - "--entryPoints=Name:http Address::80 Redirect.EntryPoint:https"
      #- "--entryPoints=Name:http Address::80"
      - "--entryPoints=Name:https Address::443 TLS"
      - "--defaultentrypoints=http,https"
      - "--docker"
      - "--docker.exposedbydefault=true"
      - "--docker.swarmmode"
      - "--docker.domain=${DOMAIN}"
      - "--docker.watch=true"
      - "--acme"
      - "--acme.acmelogging=true"
      - "--acme.domains=*.${DOMAIN}"
      - "--acme.email=dspencer@computekindustries.com"
      - "--acme.storage=/acme.json"
      - "--acme.entryPoint=https"
      - "--acme.onHostRule=true"
      - "--acme.onDemand=false"
      - "--acme.httpChallenge.entryPoint=http"
      - "--acme.dnschallenge=true"
      - "--acme.dnschallenge.provider=cloudflare"
      - "--acme.tlsconfig=true"
    environment:
      CF_EMAIL: "dspencer@computekindustries.com"
      CF_API_KEY: "865a09eaf3a2819c36755fffa91b4b0129b63"
    deploy:
      placement:
        constraints: [node.role==manager]
      restart_policy:
        condition: on-failure
      labels:
        traefik.enabled: "true"
        traefik.port: "8080"
        traefik.docker.network: "public"
        traefik.frontend.rule: "Host:traefik.${DOMAIN}"
        traefik.frontend.priority: "10"
        traefik.frontend.entryPoints: "http, https"
        traefik.frontend.headers.STSSeconds: "315360000"
        traefik.frontend.headers.STSIncludeSubdomains: "true"
        traefik.frontend.headers.STSPreload: "true"
        traefik.frontend.headers.SSLRedirect: "false"
        traefik.frontend.headers.SSLHost: "traefik.${DOMAIN}"
        traefik.frontend.headers.frameDeny: "true"
        traefik.frontend.headers.browseXSSFilter:  "true"
        traefik.frontend.passHostHeader: "true"
        orbiter: "false"
    ports:
      - "80:80"
      - "443:443"
      - "8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /dev/null:/traefik.toml
    networks:
      - public

networks:

  public:
    external:
      name: public

  internal:
    external:
      name: internal

...
# vim: set sts=2 sw=2 ts=2 et ai: