docker-compose.yml

x-logging: &logging
  logging:
    driver: syslog
    options:
      syslog-address: tcp://10.5.5.1:514
      syslog-format: rfc3164
      tag: '{{.Name}}'

x-app-env: &app-env
  TZ: UTC
  DOMAIN_NAME: ${DOMAIN_NAME?}
  DATA_DIR_ROOT: /data
  NODE_ENV: ${NODE_ENV?} #See https://github.com/nodejs/docker-node/blob/main/docs/BestPractices.md
  # Unset means rate limiting is ON. Set by `make start-api` (and `start-website`,
  # which depends on it) for api-test. The api logs which state it started in.
  RATE_LIMITING_DISABLED: ${RATE_LIMITING_DISABLED:-}
  # DEBUG: '*' # Useful for debuggind Express.js routing
  SMTP_CONNECTION_STRING: ${SMTP_CONNECTION_STRING?}
  PADDLE_ENVIRONMENT: ${PADDLE_ENVIRONMENT?}
  PADDLE_CLIENT_TOKEN: ${PADDLE_CLIENT_TOKEN?}
  PADDLE_API_KEY: ${PADDLE_API_KEY?}
  PADDLE_WEBHOOK_SECRET: ${PADDLE_WEBHOOK_SECRET?}

x-disable-ipv6: &x-disable-ipv6
  sysctls:
    net.ipv6.conf.all.disable_ipv6: 1
    net.ipv6.conf.default.disable_ipv6: 1
    net.ipv6.conf.lo.disable_ipv6: 1

x-dns: &x-dns
  dns: 10.5.5.2

services:
  smtp-out:
    depends_on:
      logger:
        condition: service_healthy
      resolver:
        condition: service_healthy
    container_name: smtp-out
    hostname: smtp-out
    image: smtp-out
    restart: always
    ports: ['127.0.0.1:1587:587']
    volumes:
      - ./.tmp/opendkim-keys:/mnt/opendkim-keys:ro
      - ./.tmp/postfix-queue:/var/spool/postfix
    environment:
      TZ: UTC
    <<: [*logging, *x-disable-ipv6, *x-dns]
    healthcheck:
      disable: true
    networks:
      net:
        ipv4_address: 10.5.5.9

  smtp-in:
    depends_on:
      logger:
        condition: service_healthy
      resolver:
        condition: service_healthy
    container_name: smtp-in
    hostname: smtp-in
    image: smtp-in
    ports: ['25:25']
    restart: always
    volumes:
      - ./.tmp/certbot/conf/live/feedsubscription.com/fullchain.pem:/etc/postfix/cert/smtp.cert:ro
      - ./.tmp/certbot/conf/live/feedsubscription.com/privkey.pem:/etc/postfix/cert/smtp.key:ro
    environment:
      SMTP_IN_SASL_PASSWORD: ${SMTP_IN_SASL_PASSWORD?}
    <<: [*logging, *x-disable-ipv6, *x-dns]
    networks:
      net:
        ipv4_address: 10.5.5.8

  postilion:
    depends_on:
      logger:
        condition: service_healthy
      resolver:
        condition: service_healthy
    container_name: postilion
    hostname: postilion
    image: postilion
    restart: always
    ports: ['587:587']
    volumes:
      - ./.tmp/opendkim-keys:/mnt/opendkim-keys:ro
      - ./.tmp/postilion-queue:/var/spool/postfix
      - ./.tmp/certbot/conf/live/feedsubscription.com/fullchain.pem:/etc/postfix/cert/smtp.cert:ro
      - ./.tmp/certbot/conf/live/feedsubscription.com/privkey.pem:/etc/postfix/cert/smtp.key:ro
    environment:
      TZ: UTC
      POSTILION_SASL_PASSWORD_GURDIGA_COM: ${POSTILION_SASL_PASSWORD_GURDIGA_COM?}
      POSTILION_SASL_PASSWORD_SANDRADODD_COM: ${POSTILION_SASL_PASSWORD_SANDRADODD_COM?}
    <<: [*logging, *x-disable-ipv6, *x-dns]
    networks:
      net:
        ipv4_address: 10.5.5.10

  app:
    depends_on:
      logger:
        condition: service_healthy
      resolver:
        condition: service_healthy
    container_name: app
    hostname: app
    image: app
    init: true # This is to tell Node process to stop when the container is asked to stop.
    restart: always
    volumes:
      - ${DATA_DIR_ROOT?}:/data
    # NOTE: This doesn’t work, and I’m not fixing it now because I don’t
    # know how, and it’s not worth the effort of further investigation.
    # extra_hosts:
    #   - 'feedsubscription.com:207.154.253.211'
    environment:
      <<: *app-env
    command: node dist/app/cron.js
    <<: [*logging, *x-disable-ipv6, *x-dns]
    networks:
      net:
        ipv4_address: 10.5.5.7

  delmon:
    depends_on:
      logger:
        condition: service_healthy
      resolver:
        condition: service_healthy
    container_name: delmon
    hostname: delmon
    image: app
    init: true # This is to tell Node process to stop when the container is asked to stop.
    restart: always
    # Doubled $$ so Compose passes the guard into the container instead of
    # resolving it against the host environment at parse time.
    command: sh -c 'tail -n 0 -F "$${SMTP_OUT_LOG:?SMTP_OUT_LOG is not set}" | node dist/app/delivery-monitoring'
    volumes:
      - .tmp/logs/feedsubscription:/logs:ro
      - ${DATA_DIR_ROOT?}:/data
    environment:
      <<: *app-env
      SMTP_OUT_LOG: /logs/smtp-out.log
    <<: [*logging, *x-disable-ipv6, *x-dns]
    networks:
      net:
        ipv4_address: 10.5.5.6

  api:
    depends_on:
      logger:
        condition: service_healthy
      resolver:
        condition: service_healthy
    container_name: api
    hostname: api
    image: app
    init: true # This is to tell Node process to stop when the container is asked to stop.
    restart: always
    command: node dist/api/server.js
    volumes:
      - ${DATA_DIR_ROOT?}:/data
    environment:
      # DEBUG: 'express:*'
      # TS_NODE_DEBUG: 'true'
      <<: *app-env
    <<: [*logging, *x-disable-ipv6, *x-dns]
    networks:
      net:
        ipv4_address: 10.5.5.5

  # Thanks to https://github.com/wmnnd/nginx-certbot
  website:
    depends_on: [api]
    container_name: website
    hostname: website
    image: website
    restart: always
    ports: ['80:80', '443:443']
    volumes:
      - ./website/html:/usr/share/nginx/html:ro
      - ./website/nginx/conf.d:/etc/nginx/conf.d:ro
      - ./.tmp/nginx-blocklists:/etc/nginx/blocklists:ro
      - ./.tmp/certbot/conf:/etc/letsencrypt
      - ./.tmp/certbot/www:/var/www/certbot
    environment:
      NGINX_HOST: feedsubscription.com
    <<: [*logging, *x-disable-ipv6, *x-dns]
    networks:
      net:
        ipv4_address: 10.5.5.4

  # Thanks to https://github.com/wmnnd/nginx-certbot
  certbot:
    depends_on:
      logger:
        condition: service_healthy
      resolver:
        condition: service_healthy
    container_name: certbot
    hostname: certbot
    image: certbot
    restart: always
    volumes:
      - ./.tmp/certbot/conf:/etc/letsencrypt
      - ./website/html:/var/www/certbot
    entrypoint: >-
      /bin/sh -c '
        certbot --version;
        exec crond -f -d 8;
      '
    <<: [*logging, *x-disable-ipv6, *x-dns]
    networks:
      net:
        ipv4_address: 10.5.5.3

  logger:
    container_name: logger
    hostname: logger
    image: logger
    restart: always
    volumes:
      - ./.tmp/logs:/var/log/syslog-ng
    <<: [*x-dns]
    healthcheck:
      test: ['CMD-SHELL', 'nc -z -w1 10.5.5.1 514']
      interval: 5s
      timeout: 3s
      retries: 2
    networks:
      net:
        ipv4_address: 10.5.5.1

  resolver:
    depends_on:
      logger:
        condition: service_healthy
    hostname: resolver
    image: resolver
    container_name: resolver
    restart: always
    volumes:
      - ./.tmp/resolver/etc/hosts:/etc/hosts:ro
    networks:
      net:
        ipv4_address: 10.5.5.2
    <<: [*logging, *x-disable-ipv6]
    healthcheck:
      test: ['CMD-SHELL', 'pidof dnsmasq >/dev/null']
      interval: 5s
      timeout: 3s
      retries: 2

networks:
  net:
    enable_ipv6: false # Trying to simplify the DNS issue context
    driver: bridge
    ipam:
      config:
        - subnet: 10.5.5.0/24
          gateway: 10.5.5.100