version: '2'
services:

  snipe-it:
    image: snipe/snipe-it:latest
    dns:
      - 1.1.1.1
      - 1.0.0.1
      - 2606:4700:4700::1111
      - 2606:4700:4700::1001
    environment:
      APP_ENV: ${ENVIRONMENT} # [ development | production ]
      APP_DEBUG: ${DEBUG}
      APP_URL: https://${TRAEFIK_HOST} # No port number needed
      APP_KEY: ${APP_KEY}
      MYSQL_HOST: mysql
      MYSQL_DATABASE: snipeit_db
      MYSQL_USER: snipeit_user
      MYSQL_PASSWORD: ${DB_USER_PASS}
    labels:
      io.rancher.container.pull_image: always
      {{- if .Values.HOST_LABEL}}
      io.rancher.scheduler.affinity:host_label: ${HOST_LABEL}
      {{- end}}
      ### Begin Traefik Configuration
      traefik.enable: true
      # Routers
      traefik.http.routers.{{.Stack.Name}}-router-http.entrypoints: http
      traefik.http.routers.{{.Stack.Name}}-router-http.rule: Host(`${TRAEFIK_HOST}`)
      traefik.http.routers.{{.Stack.Name}}-router-http.middlewares: {{.Stack.Name}}-redirectHttp
      traefik.http.routers.{{.Stack.Name}}-router-http.service: {{.Stack.Name}}-service-http
      traefik.http.routers.{{.Stack.Name}}-router-https.entrypoints: https
      traefik.http.routers.{{.Stack.Name}}-router-https.rule: Host(`${TRAEFIK_HOST}`)
      traefik.http.routers.{{.Stack.Name}}-router-https.tls: true
      traefik.http.routers.{{.Stack.Name}}-router-https.tls.certresolver: letsencrypt
      traefik.http.routers.{{.Stack.Name}}-router-https.middlewares: {{.Stack.Name}}-security
      traefik.http.routers.{{.Stack.Name}}-router-https.service: {{.Stack.Name}}-service-http
      # Middlewares
      traefik.http.middlewares.{{.Stack.Name}}-redirectHttp.redirectscheme.permanent: true
      traefik.http.middlewares.{{.Stack.Name}}-redirectHttp.redirectscheme.scheme: https
      traefik.http.middlewares.{{.Stack.Name}}-security.headers.forceSTSHeader: true
      traefik.http.middlewares.{{.Stack.Name}}-security.headers.referrerPolicy: no-referrer # Prevents leaking of referer information
      traefik.http.middlewares.{{.Stack.Name}}-security.headers.sslredirect: true # Maybe good for redundancy?
      traefik.http.middlewares.{{.Stack.Name}}-security.headers.stsIncludeSubdomains: true
      traefik.http.middlewares.{{.Stack.Name}}-security.headers.stsPreload: true
      traefik.http.middlewares.{{.Stack.Name}}-security.headers.stsSeconds: "15552000"
      # Services
      traefik.http.services.{{.Stack.Name}}-service-http.loadbalancer.passhostheader: true
      traefik.http.services.{{.Stack.Name}}-service-http.loadbalancer.server.port: "80"
      ### End Traefik Configuration
    links:
      - mysql
    restart: on-failure
    volumes:
      - /etc/localtime:/etc/localtime:ro # Syncronize time of container with the host system
      - /etc/timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
      - /Persistent/${DATA_DIR}/Application:/var/lib/snipeit
      - /Persistent/${DATA_DIR}/Backups:/var/www/html/storage/app/backups
  mysql:
    image: mysql:5
    dns:
      - 1.1.1.1
      - 1.0.0.1
      - 2606:4700:4700::1111
      - 2606:4700:4700::1001
    environment:
      MYSQL_DATABASE: snipeit_db
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASS}
      MYSQL_USER: snipeit_user
      MYSQL_PASSWORD: ${DB_USER_PASS}
    labels:
      io.rancher.container.pull_image: always
      {{- if (.Values.HOST_LABEL)}}
      io.rancher.scheduler.affinity:host_label: ${HOST_LABEL}
      {{- end}}
      traefik.enable: false
    restart: on-failure
    volumes:
      - /etc/localtime:/etc/localtime:ro # Syncronize time of container with the host system
      - /etc/timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
      - /Persistent/${DATA_DIR}/Database:/var/lib/mysql