docker-compose.yml

version: "3.4"

services:
  netmaker:
    container_name: netmaker
    image: gravitl/netmaker:v0.14.0
    volumes:
      - ${PATHTO}/dnsconfig:/root/config/dnsconfig
      - ${PATHTO}/sqldata:/root/data
      - ${PATHTO}/certs:/etc/netmaker
    cap_add: 
      - NET_ADMIN
      - NET_RAW
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
    restart: always
    environment:
      SERVER_NAME: "broker.${NM_BASE_DOMAIN}"
      SERVER_HOST: "${NM_PUBLIC_IP}"
      SERVER_API_CONN_STRING: "api.${NM_BASE_DOMAIN}:443"
      DNS_MODE: "on"
      SERVER_HTTP_HOST: "api.${NM_BASE_DOMAIN}"
      #SERVER_GRPC_HOST: "grpc.${NM_BASE_DOMAIN}"
      API_PORT: "8081"
      CLIENT_MODE: "on"
      MASTER_KEY: "${NM_MASTER_KEY}"
      CORS_ALLOWED_ORIGIN: "*"
      DISPLAY_KEYS: "on"
      DATABASE: "sqlite"
      NODE_ID: "netmaker-server-1"
      MQ_HOST: "mq"
      HOST_NETWORK: "off"
      VERBOSITY: "1"
      MANAGE_IPTABLES: "on"
    ports:
      - "51821-51830:51821-51830/udp"
#      - "8081:8081"   # api endpoint exposed via traefik so not needed in ports
    labels:
      - traefik.enable=true
      - traefik.http.routers.netmaker-api.entrypoints=websecure
      - traefik.http.routers.netmaker-api.rule=Host(`api.${NM_BASE_DOMAIN}`)
      - traefik.http.routers.netmaker-api.service=netmaker-api
      - traefik.http.services.netmaker-api.loadbalancer.server.port=8081
  netmaker-ui:
    container_name: netmaker-ui
    depends_on:
      - netmaker
    image: gravitl/netmaker-ui:v0.14.0
    links:
      - "netmaker:api"
#    ports:
#      - "8082:80" # UI endpoint exposed via traefik so not needed in ports
    environment:
      BACKEND_URL: "https://api.${NM_BASE_DOMAIN}"
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.netmaker-ui-http.entrypoints=web
      - traefik.http.routers.netmaker-ui-http.rule=Host(`dashboard.${NM_BASE_DOMAIN}`)
      - traefik.http.middlewares.nmui-security.headers.accessControlAllowOriginList=*.$${NM_BASE_DOMAIN}
      - traefik.http.middlewares.nmui-security.headers.stsSeconds=31536000
      - traefik.http.middlewares.nmui-security.headers.browserXssFilter=true
      - traefik.http.middlewares.nmui-security.headers.customFrameOptionsValue=SAMEORIGIN
      - traefik.http.middlewares.nmui-security.headers.customResponseHeaders.X-Robots-Tag=none
      - traefik.http.middlewares.nmui-security.headers.customResponseHeaders.Server= # Remove the server name
      - traefik.http.routers.netmaker-ui.middlewares=nmui-security@docker
      - traefik.http.routers.netmaker-ui.entrypoints=websecure
      - traefik.http.routers.netmaker-ui.rule=Host(`dashboard.${NM_BASE_DOMAIN}`)
      - traefik.http.routers.netmaker-ui.service=netmaker-ui
      - traefik.http.services.netmaker-ui.loadbalancer.server.port=80
  coredns:
    depends_on:
      - netmaker
    image: coredns/coredns
    command: -conf root/dnsconfig/Corefile
    container_name: coredns
    restart: always
    volumes:
      - ${PATHTO}/dnsconfig:/root/dnsconfig
  traefik:
    image: traefik:v2.6
    container_name: traefik
    command:
      - "--log.level=INFO"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http.tls=true"
      - "--entrypoints.websecure.http.tls.certResolver=dns"
      - "--certificatesresolvers.dns.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.dns.acme.storage=acme.json"
      - "--certificatesresolvers.dns.acme.dnsChallenge.provider=cloudflare"
      - "--providers.docker=true"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedByDefault=false"
      - "--serverstransport.insecureskipverify=true"
      # WARNING- exposes Traefik dashboard with no security
      - "--api.insecure=true"
      - "--api.dashboard=true"
    environment:
      - CF_DNS_API_TOKEN=${CF_API_TOKEN}
    restart: always
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${PATHTO}/traefik_acme.json:/acme.json
    ports:
      - "80:80"
      - "443:443"
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik-http.entrypoints=web
      - traefik.http.routers.traefik-http.rule=Host(`${TRAEFIK_DOMAIN}`)
      - traefik.http.routers.traefik=api@internal
      - traefik.http.middlewares.secure-ips.ipwhitelist.sourcerange=192.168.129.0/16,172.16.0.0/12,10.0.0.0/8
      - traefik.http.routers.traefik.middlewares=secure-ips@docker
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.services.traefik-containers.loadbalancer.server.port=8080
  mq:
    image: eclipse-mosquitto:2.0.14-openssl # updated image as per v0.13 upgrade instructions (they specify 2.0.11)
    container_name: mq
    restart: unless-stopped
    ports:
      - "127.0.0.1:1883:1883"
      - "8883:8883"
    volumes:
      - ${PATHTO}/mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf
      - $PATHTO/certs/:/mosquitto/certs/
      - ${PATHTO}/mosquitto/data:/mosquitto/data
      - ${PATHTO}/mosquitto/logs:/mosquitto/log   

# removed volumes spec below as they are defined above
# I've made an entry in .env "PATHTO=/root/netmaker"
# remember kids, each path you see here "actual_path:docker_required_path"