sudarnet-concourse.yml

version: '3'

services:
  concourse-db:
    container_name: concourse-db
    image: postgres
    deploy:
          placement:
              constraints: [node.labels.sudarnet.allow.concourse == true]
    environment:
      POSTGRES_DB: concourse
      POSTGRES_USER: concourse_user
      POSTGRES_PASSWORD: concourse_pass
    volumes:
      - /mnt/sudarnet/sudarnet-concourse/pg_data:/var/lib/postgresql/data
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    networks:
      - traefik-public
  web:
    # image: asudarsanan/concourse:7.9.1-suda
    image: concourse/dev
    # ports: [2222:2222]
    deploy:
          mode: replicated
          replicas: 1
          placement:
              constraints: [node.labels.sudarnet.allow.concourse == true]
          labels:
          # Traefik configuration, Hostname needs to be changed
          # - traefik.enable=true
          # - traefik.http.services.ci-https.loadbalancer.server.port=8080
          # - traefik.http.routers.ci-https.rule=Host(`ci.sudarnet.in`)
          # - traefik.http.routers.ci-https.entrypoints=https
          # - traefik.http.routers.ci-https.tls=true
          # - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
          # - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
          # - traefik.http.routers.ci-https.tls.certresolver=le

          - "traefik.enable=true"
          - "traefik.http.routers.concourse-web.rule=Host(`ci-worker.sudarnet.in`)"
          - "traefik.http.routers.concourse-web.entrypoints=http"
          - "traefik.http.routers.concourse-web.service=concourse-web"
          - "traefik.http.routers.concourse-web.entrypoints=https"
          - "traefik.http.services.concourse-web.loadbalancer.server.port=8080"
          - "traefik.tcp.routers.concourse-ssh.rule=HostSNI(`watch.sudarnet.in`)"
          - "traefik.tcp.routers.concourse-ssh.entrypoints=http"
          - "traefik.tcp.services.concourse-ssh.loadbalancer.server.port=2222"
          - "traefik.tcp.routers.concourse-ssh.service=concourse-ssh"
          - "traefik.tcp.routers.concourse-ssh.tls.passthrough=true"
          - "traefik.http.routers.concourse-web.tls=true" 
          - "traefik.tcp.routers.concourse-ssh.tls=true"
          - "traefik.tcp.routers.concourse-web.tls.certresolver=le"
          - "traefik.tcp.routers.concourse-ssh.entrypoints=https"
          # - traefik.enable=true
          # - traefik.http.services.ci-worker-https.loadbalancer.server.port=8080
          # - traefik.http.routers.ci-worker-https.service=ci-worker-https
          # - traefik.http.routers.ci-worker-https.rule=Host(`ci-worker.sudarnet.in`)
          # - traefik.http.services.web2.loadbalancer.server.port=2222
          # - traefik.http.routers.web2.service=web2
          # - traefik.http.routers.web2.rule=Host(`watch.sudarnet.in`)
          # - traefik.http.routers.web2.tls=true
          # - traefik.http.routers.web2.tls.certresolver=le
          # - traefik.http.routers.web2.entrypoints=https
          # - traefik.http.routers.ci-worker-https.entrypoints=https
          # - traefik.http.routers.ci-worker-https.tls=true
          # - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
          # - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
          # - traefik.http.routers.ci-worker-https.tls.certresolver=le

    command: web
    cap_add:
      - SYS_ADMIN
    depends_on: [concourse-db]
    volumes: ["./keys/web:/concourse-keys"]
    environment:
      CONCOURSE_POSTGRES_HOST: concourse-db
      CONCOURSE_POSTGRES_USER: concourse_user
      CONCOURSE_POSTGRES_PASSWORD: concourse_pass
      CONCOURSE_POSTGRES_DATABASE: concourse
      CONCOURSE_SESSION_SIGNING_KEY: /concourse-keys/session_signing_key
      CONCOURSE_TSA_AUTHORIZED_KEYS: /concourse-keys/authorized_worker_keys
      CONCOURSE_TSA_HOST_KEY: /concourse-keys/tsa_host_key
      CONCOURSE_LOG_LEVEL: debug
      CONCOURSE_EXTERNAL_URL: https://ci-worker.sudarnet.in
      CONCOURSE_ADD_LOCAL_USER: asuda:vasuda
      CONCOURSE_MAIN_TEAM_LOCAL_USER: asuda
      CONCOURSE_CLUSTER_NAME: sudarnet
      CONCOURSE_VAULT_URL: https://secure.sudarnet.in
      CONCOURSE_VAULT_AUTH_BACKEND_MAX_TTL: 1h
      CONCOURSE_VAULT_AUTH_BACKEND: "approle"
      CONCOURSE_VAULT_AUTH_PARAM: "role_id:0b88c92a-5d71-39a1-a643-23368c92ce07,secret_id:45815736-e66d-3fe8-178d-91f436f0f3b9"
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    networks:
      - traefik-public

  # worker:
  #   #image: asudarsanan/concourse:7.9.1-suda
  #   image: concourse/dev
  #   container_name: concourse
  #   deploy:
  #         mode: replicated
  #         replicas: 1
  #         placement:
  #             constraints: [node.labels.sudarnet.allow.concourse == true]
  #   command: worker
  #   cap_add:
  #     - SYS_ADMIN
  #     - FOWNER
  #     - NET_ADMIN
  #   depends_on: [web]
  #   environment:
  #     CONCOURSE_TSA_HOST: sudarnet-concourse_web:2222
  #     CONCOURSE_LOG_LEVEL: debug
  #     # enable DNS proxy to support Docker's 127.x.x.x DNS server
  #     # CONCOURSE_GARDEN_DNS_PROXY_ENABLE: "true"
  #     CONCOURSE_CONTAINERD_DNS_PROXY_ENABLE: "true"
  #     CONCOURSE_CONTAINERD_ALLOW_HOST_ACCESS: "true"
  #     CONCOURSE_RUNTIME: containerd
  #     CONCOURSE_BAGGAGECLAIM_DRIVER: overlay
  #     CONCOURSE_TSA_PUBLIC_KEY: /concourse-keys/tsa_host_key.pub
  #     CONCOURSE_TSA_WORKER_PRIVATE_KEY: /concourse-keys/worker_key
  #     CONCOURSE_WORK_DIR: /opt/concourse/worker
  #   volumes: 
  #   - ./keys/worker:/concourse-keys
  #   - /var/run/docker.sock:/var/run/docker.sock

    # logging:
    #   driver: "json-file"
    #   options:
    #     max-file: "5"
    #     max-size: "10m"
    # networks:
    #   - traefik-public

networks:
  traefik-public:
    external: true