docker-compose.prod.yml

version: "3.8"

services:
  reverse-proxy:
    image: traefik:v3.2
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedByDefault=false"
      - "--providers.docker.network=thesis-track-network"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@tum.de"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./letsencrypt:/letsencrypt
    networks:
      - thesis-track-network

  server:
    image: "ghcr.io/ls1intum/thesis-track/thesis-track-server:${SERVER_IMAGE_TAG}"
    container_name: thesis-track-server
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.server.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/api`)"
      - "traefik.http.services.server.loadbalancer.server.port=8080"
      - "traefik.http.routers.server.entrypoints=websecure"
      - "traefik.http.routers.server.tls.certresolver=letsencrypt"
      - "traefik.http.middlewares.api-ratelimit.ratelimit.average=300"
      - "traefik.http.middlewares.api-ratelimit.ratelimit.burst=100"
      - "traefik.http.routers.server.middlewares=api-ratelimit"
      - "traefik.http.routers.server.priority=10"
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - ./thesis_uploads:/uploads
    expose:
      - "8080"
    environment:
      - TZ=Europe/Berlin
      - SPRING_JPA_HIBERNATE_DDL_AUTO=validate
      - SPRING_DATASOURCE_URL=jdbc:postgresql://db:5432/${SPRING_DATASOURCE_DATABASE}
      - MAIL_ENABLED=true
      - POSTFIX_HOST=postfix
      - POSTFIX_PORT=25
      - UPLOAD_FOLDER=/uploads
      - DEBUG_MODE=false
      # take from docker environment
      - SPRING_DATASOURCE_USERNAME
      - SPRING_DATASOURCE_PASSWORD
      - POSTFIX_USERNAME
      - POSTFIX_PASSWORD
      - CLIENT_HOST
      - KEYCLOAK_HOST
      - KEYCLOAK_REALM_NAME
      - KEYCLOAK_CLIENT_ID
      - KEYCLOAK_SERVICE_CLIENT_ID
      - KEYCLOAK_SERVICE_CLIENT_SECRET
      - KEYCLOAK_SERVICE_STUDENT_GROUP_NAME
      - MAIL_WORKSPACE_URL
      - MAIL_SENDER
      - MAIL_SIGNATURE
      - MAIL_BCC_RECIPIENTS
      - CALDAV_ENABLED
      - CALDAV_URL
      - CALDAV_USERNAME
      - CALDAV_PASSWORD
      - SCIENTIFIC_WRITING_GUIDE
      - GIT_COMMIT
      - GIT_BRANCH
    networks:
      - thesis-track-network

  client:
    image: "ghcr.io/ls1intum/thesis-track/thesis-track-client:${CLIENT_IMAGE_TAG}"
    container_name: thesis-track-client
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.client.rule=Host(`${APP_HOSTNAME}`)"
      - "traefik.http.routers.client.entrypoints=websecure"
      - "traefik.http.routers.client.tls.certresolver=letsencrypt"
      - "traefik.http.middlewares.client-compress.compress=true"
      - "traefik.http.routers.client.middlewares=client-compress"
      - "traefik.http.routers.client.priority=1"
    expose:
      - "80"
    environment:
      - SERVER_HOST
      - KEYCLOAK_HOST
      - KEYCLOAK_REALM_NAME
      - KEYCLOAK_CLIENT_ID
      - ALLOW_SUGGESTED_TOPICS
      - DEFAULT_SUPERVISOR_UUID
      - THESIS_TYPES
      - STUDY_PROGRAMS
      - STUDY_DEGREES
      - GENDERS
      - LANGUAGES
      - CUSTOM_DATA
      - THESIS_FILES
      - APPLICATION_TITLE
      - CHAIR_NAME
      - CHAIR_URL
    depends_on:
      - server
    networks:
      - thesis-track-network

  db:
    image: "postgres:17.1-alpine"
    container_name: thesis-track-db
    environment:
      - POSTGRES_USER=${SPRING_DATASOURCE_USERNAME}
      - POSTGRES_PASSWORD=${SPRING_DATASOURCE_PASSWORD}
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${SPRING_DATASOURCE_USERNAME}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - thesis-track-network

  postfix:
    image: ghcr.io/ls1admin/postfix:latest
    container_name: thesis-track-postfix
    restart: unless-stopped
    volumes:
      - ./postfix-config:/config
    hostname: ${APP_HOSTNAME}
    networks:
      - thesis-track-network

networks:
  # Create network manually in advance: docker network create thesis-track-network
  thesis-track-network:
    name: thesis-track-network
    external: true