stack.yml

# maev.si
# https://maev.si/
# maevsi
# https://github.com/maevsi/maevsi/
---
secrets:
  jobber_aliases:
    # The job scheduler's SMTP client mail alias.
    file: ./secrets/jobber/aliases.secret
  jobber_aws-bucket:
    # The job scheduler's AWS bucket name.
    file: ./secrets/jobber/aws-bucket.secret
  jobber_aws-credentials:
    # The job scheduler's AWS credentials.
    file: ./secrets/jobber/aws-credentials.secret
  jobber_msmtprc:
    # The job scheduler's SMTP client configuration.
    file: ./secrets/jobber/msmtprc.secret
  maevsi_api-notification-secret:
    # The notification endpoint's secret.
    file: ./secrets/maevsi/api-notification.secret
  maevsi_aws-credentials:
    # The cloud computing provider's user credentials.
    file: ./secrets/maevsi/aws-credentials.secret
  maevsi_openai-api-key:
    # The AI provider's API key.
    file: ../production/secrets/maevsi/openai-api-key.secret
  maevsi_turnstile-key:
    # The captcha provider's application key.
    file: ./secrets/maevsi/turnstile-key.secret
  portainer_admin-password:
    # The container manager's admin password.
    file: ./secrets/portainer/admin-password.secret
  postgraphile_connection:
    # The GraphQL API's database URI.
    file: ./secrets/postgraphile/connection.secret
  postgraphile_jwt-secret:
    # The GraphQL API's JWT secret.
    file: ./secrets/postgraphile/jwt-secret.secret
  postgraphile_owner-connection:
    # The GraphQL API's database owner URI.
    file: ./secrets/postgraphile/owner-connection.secret
  postgres_db:
    # The database's name.
    file: ./secrets/postgres/db.secret
  postgres_password:
    # The database's password.
    file: ./secrets/postgres/password.secret
  postgres_role_grafana_password:
    # The `maevsi_grafana` database role's password.
    file: ./secrets/postgres/role_grafana_password.secret
  postgres_role_grafana_username:
    # The `maevsi_grafana` database role's username.
    file: ./secrets/postgres/role_grafana_username.secret
  postgres_role_maevsi-postgraphile_password:
    # The `maevsi_postgraphile` database role's password.
    file: ./secrets/postgres/role_maevsi-postgraphile_password.secret
  postgres_role_maevsi-postgraphile_username:
    # The `maevsi_postgraphile` database role's username.
    file: ./secrets/postgres/role_maevsi-postgraphile_username.secret
  postgres_role_maevsi-tusd_password:
    # The `tusd` database role's password.
    file: ./secrets/postgres/role_maevsi-tusd_password.secret
  postgres_role_maevsi-tusd_username:
    # The `tusd` database role's password.
    file: ./secrets/postgres/role_maevsi-tusd_username.secret
  postgres_user:
    # The database's default user.
    file: ./secrets/postgres/user.secret
  sqitch_target:
    # The database change management application's database connection string.
    file: ./secrets/sqitch/target.secret
  tusd_aws:
    # The upload service's s3 credentials file.
    file: ./secrets/tusd/aws.secret
services:
  adminer:
    # You can access the database's frontend at [adminer.localhost](https://adminer.localhost/).
    # This information is required for login:
    #
    # |          |                     |
    # | -------- | ------------------- |
    # | System   | PostgreSQL          |
    # | Server   | postgres            |
    # | Username | [postgres_user]     |
    # | Password | [postgres_password] |
    # | Database | [postgres_db]       |
    #
    # Values in square brackets are [Docker secrets](https://docs.docker.com/engine/swarm/secrets/).
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.adminer.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.adminer.rule=Host(`adminer.${STACK_DOMAIN}`)
        - traefik.http.routers.adminer_secure.rule=Host(`adminer.${STACK_DOMAIN}`)
        - traefik.http.routers.adminer_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.services.adminer.loadbalancer.server.port=8080
    image: adminer:4.8.1-standalone
    volumes:
      - ../production/configurations/adminer/adminer.css:/var/www/html/adminer.css:ro
  debezium:
    # You can see how changes in the database end up in the event stream using `redpanda-console`.
    environment:
      BOOTSTRAP_SERVERS: redpanda:9092
      CONFIG_STORAGE_TOPIC: connect_configs
      GROUP_ID: 1
      OFFSET_STORAGE_TOPIC: connect_offsets
      STATUS_STORAGE_TOPIC: connect_statuses
    # healthcheck:
    #   test: ["CMD", "curl", "--fail", "--silent", "--show-error", "http://localhost:8083/connectors"]
    #   interval: 30s
    #   timeout: 10s
    #   retries: 3
    #   start_period: 20s
    image: quay.io/debezium/connect:3.1
  debezium-postgres-connector:
    # You can check the database connector's setup logs using `portainer`.
    command: /entrypoint.sh
    deploy:
      restart_policy:
        condition: on-failure
    entrypoint: sh
    image: curlimages/curl:8.12.1
    secrets:
      - postgres_db
      - postgres_password
      - postgres_user
    volumes:
      - ../production/configurations/debezium-postgres-connector/entrypoint.sh:/entrypoint.sh:ro
  geoip:
    # You cannot access the ip geolocator via a web interface.
    image: ghcr.io/observabilitystack/geoip-api:2024-41
  grafana:
    # You can access the observation dashboard at [grafana.localhost](https://grafana.localhost/).
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.grafana.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.grafana.rule=Host(`grafana.${STACK_DOMAIN}`)
        - traefik.http.routers.grafana_secure.rule=Host(`grafana.${STACK_DOMAIN}`)
        - traefik.http.routers.grafana_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.services.grafana.loadbalancer.server.port=3000
    image: grafana/grafana:11.5.2
    secrets:
      - postgres_role_grafana_password
      - postgres_role_grafana_username
    volumes:
      - ./configurations/grafana/grafana.ini:/etc/grafana/grafana.ini:ro
      - ../production/configurations/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - ../production/configurations/grafana/provisioning:/etc/grafana/provisioning:ro
      - grafana_data:/var/lib/grafana
  jobber:
    # You cannot access the jobber via a web interface.
    environment:
      AWS_SHARED_CREDENTIALS_FILE: /run/secrets/jobber_aws-credentials
    image: ghcr.io/dargmuesli/jobber-aws-msmtp:1.3.0
    secrets:
      - source: jobber_aliases
        target: /etc/aliases
      - jobber_aws-bucket
      - jobber_aws-credentials
      - source: jobber_msmtprc
        target: /etc/msmtprc
    volumes:
      - ../production/backups/postgres/:/backups/
      - ./configurations/jobber/.jobber:/home/jobberuser/.jobber:ro
      - ./configurations/jobber/aws-config:/home/jobberuser/.aws/config:ro
  maevsi:
    # You can access the main project's frontend at [localhost](https://localhost/).
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.middlewares.maevsi_cors.headers.accessControlAllowHeaders=authorization,hook-name
        - traefik.http.middlewares.maevsi_cors.headers.accessControlAllowMethods=GET,POST,PUT,DELETE
        - traefik.http.middlewares.maevsi_cors.headers.accessControlAllowOriginList=https://localhost:3000
        - traefik.http.middlewares.maevsi_redirectregex.redirectregex.regex=^https?:\/\/www\.${STACK_DOMAIN}\/(.*)
        - traefik.http.middlewares.maevsi_redirectregex.redirectregex.replacement=https://${STACK_DOMAIN}/$${2}
        - traefik.http.routers.maevsi.entryPoints=web
        - traefik.http.routers.maevsi.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.maevsi.rule=Host(`${STACK_DOMAIN}`) || Host(`www.${STACK_DOMAIN}`)
        - traefik.http.routers.maevsi.service=maevsi #DARGSTACK-REMOVE
        - traefik.http.routers.maevsi_secure.entryPoints=web-secure
        - traefik.http.routers.maevsi_secure.middlewares=maevsi_cors,maevsi_redirectregex
        - traefik.http.routers.maevsi_secure.rule=Host(`${STACK_DOMAIN}`) || Host(`www.${STACK_DOMAIN}`)
        - traefik.http.routers.maevsi_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.routers.maevsi_secure.service=maevsi #DARGSTACK-REMOVE
        - traefik.http.services.maevsi.loadbalancer.server.port=3000
    environment:
      AWS_REGION: ${MAEVSI_AWS_REGION}
      CONSOLA_LEVEL: 4 # debug #DARGSTACK-REMOVE
      FIREBASE_SERVICE_ACCOUNT_CREDENTIALS: ${MAEVSI_FIREBASE_SERVICE_ACCOUNT_CREDENTIALS}
      NUXT_PRIVATE_API_NOTIFICATION_SECRET: ${MAEVSI_NUXT_PRIVATE_API_NOTIFICATION_SECRET}
      NUXT_PUBLIC_GTAG_ID: ${MAEVSI_NUXT_PUBLIC_GTAG_ID}
      NUXT_PUBLIC_I18N_BASE_URL: https://${STACK_DOMAIN}
      NUXT_PUBLIC_MAEVSI_EMAIL_LIMIT24H: ${MAEVSI_NUXT_PUBLIC_MAEVSI_EMAIL_LIMIT24H}
      NUXT_PUBLIC_SITE_URL: https://${STACK_DOMAIN}
      NUXT_PUBLIC_TURNSTILE_SITE_KEY: ${MAEVSI_NUXT_PUBLIC_TURNSTILE_SITE_KEY}
      PGHOST: ${MAEVSI_PGHOST}
    image: maevsi/maevsi:dev
    secrets:
      - source: maevsi_api-notification-secret
        target: /run/environment-variables/NUXT_PRIVATE_API_NOTIFICATION_SECRET
      - source: maevsi_aws-credentials
        target: /home/node/.aws/credentials # TODO: switch to user `node`
      - source: maevsi_openai-api-key
        target: /run/environment-variables/NUXT_PRIVATE_OPENAI_API_KEY
      - source: maevsi_turnstile-key
        target: /run/environment-variables/NUXT_TURNSTILE_SECRET_KEY
      - source: postgres_db
        target: /run/environment-variables/PGDATABASE
      - source: postgres_role_maevsi-tusd_password
        target: /run/environment-variables/PGPASSWORD
      - source: postgres_role_maevsi-tusd_username
        target: /run/environment-variables/PGUSER
    user: node:node # files created inside a docker container, like node_modules by pnpm, gain correct permissions by setting the user to `node`
    volumes:
      - ${PNPM_STORE_DIR}:/srv/.pnpm-store/ #DARGSTACK-REMOVE
      - ./certificates/:/srv/certificates/ #DARGSTACK-REMOVE
      - ../../../maevsi/:/srv/app/ #DARGSTACK-REMOVE
      - ./configurations/postgraphile/jwtRS256.key.pub:/run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY:ro
  minio: #DARGSTACK-REMOVE
    # You can access the s3 console at [minio.localhost](https://minio.localhost/).
    # You can access the s3 api service at [s3.localhost](https://s3.localhost/) if you want to access via cli from outside the stack.
    entrypoint: /patched-entrypoint.sh #DARGSTACK-REMOVE
    command: server /data --console-address ":9001" #DARGSTACK-REMOVE
    deploy: #DARGSTACK-REMOVE
      labels: #DARGSTACK-REMOVE
        - traefik.enable=true #DARGSTACK-REMOVE
        # Minio Console
        - traefik.http.routers.minio.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.minio.rule=Host(`minio.${STACK_DOMAIN}`) #DARGSTACK-REMOVE
        - traefik.http.routers.minio.service=minio #DARGSTACK-REMOVE
        - traefik.http.routers.minio_secure.rule=Host(`minio.${STACK_DOMAIN}`) #DARGSTACK-REMOVE
        - traefik.http.routers.minio_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.routers.minio_secure.service=minio #DARGSTACK-REMOVE
        - traefik.http.services.minio.loadbalancer.server.port=9001 #DARGSTACK-REMOVE
        - traefik.http.services.minio.loadbalancer.passhostheader=true #DARGSTACK-REMOVE
        # Minio itself
        - traefik.http.routers.s3.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.s3.rule=Host(`s3.${STACK_DOMAIN}`) #DARGSTACK-REMOVE
        - traefik.http.routers.s3.service=s3 #DARGSTACK-REMOVE
        - traefik.http.routers.s3_secure.rule=Host(`s3.${STACK_DOMAIN}`) #DARGSTACK-REMOVE
        - traefik.http.routers.s3_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.routers.s3_secure.service=s3 #DARGSTACK-REMOVE
        - traefik.http.services.s3.loadbalancer.server.port=9000 #DARGSTACK-REMOVE
        - traefik.http.services.s3.loadbalancer.passhostheader=true #DARGSTACK-REMOVE
    image: minio/minio #DARGSTACK-REMOVE
    volumes: #DARGSTACK-REMOVE
      - minio_data:/data #DARGSTACK-REMOVE
      - ./configurations/minio/entrypoint.sh:/patched-entrypoint.sh #DARGSTACK-REMOVE
    environment: #DARGSTACK-REMOVE
      MINIO_ROOT_PASSWORD: s3password #DARGSTACK-REMOVE
      MINIO_ROOT_USER: s3user #DARGSTACK-REMOVE
  portainer:
    # You can access the container manager's frontend at [portainer.localhost](https://portainer.localhost/).
    command: -H tcp://tasks.portainer-agent:9001 --tlsskipverify --admin-password-file '/run/secrets/portainer_admin-password'
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.portainer.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.portainer.rule=Host(`portainer.${STACK_DOMAIN}`)
        - traefik.http.routers.portainer_secure.rule=Host(`portainer.${STACK_DOMAIN}`)
        - traefik.http.routers.portainer_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.services.portainer.loadbalancer.server.port=9000
      mode: replicated
      placement:
        constraints:
          - node.role == manager
      replicas: 1
    image: portainer/portainer-ce:2.27.0-alpine
    secrets:
      - portainer_admin-password
    volumes:
      - portainer_data:/data
  portainer-agent:
    # You cannot access the container manager's agent directly.
    deploy:
      mode: global
      placement:
        constraints:
          - node.platform.os == linux
    environment:
      AGENT_CLUSTER_ADDR: tasks.portainer-agent
    image: portainer/agent:2.27.0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
  postgraphile:
    # You can access the GraphQL API for the PostgreSQL database at [postgraphile.localhost](https://postgraphile.localhost/).
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.middlewares.postgraphile_auth.plugin.body-forward-auth.AuthUrl=http://maevsi:3000/api/auth-proxy
        - traefik.http.middlewares.postgraphile_cors.headers.accessControlAllowHeaders=authorization,baggage,content-type,sentry-trace,x-turnstile-key
        - traefik.http.middlewares.postgraphile_cors.headers.accessControlAllowOriginList=*
        - traefik.http.routers.postgraphile.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.postgraphile.rule=Host(`postgraphile.${STACK_DOMAIN}`)
        - traefik.http.routers.postgraphile_secure.middlewares=postgraphile_auth,postgraphile_cors
        - traefik.http.routers.postgraphile_secure.rule=Host(`postgraphile.${STACK_DOMAIN}`)
        - traefik.http.routers.postgraphile_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.routers.postgraphile_secure_graphiql.rule=Host(`postgraphile.${STACK_DOMAIN}`) && Path(`/graphiql`)
        - traefik.http.routers.postgraphile_secure_graphiql.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.services.postgraphile.loadbalancer.server.port=5000
    environment:
      POSTGRAPHILE_CONNECTION_FILE: /run/secrets/postgraphile_connection
      POSTGRAPHILE_JWT_PUBLIC_KEY_FILE: /run/config/postgraphile_jwt-public-key
      POSTGRAPHILE_JWT_SECRET_KEY_FILE: /run/secrets/postgraphile_jwt-secret
      POSTGRAPHILE_OWNER_CONNECTION_FILE: /run/secrets/postgraphile_owner-connection
    image: ghcr.io/maevsi/postgraphile:4.14.0
    secrets:
      - postgraphile_connection
      - postgraphile_jwt-secret
      - postgraphile_owner-connection
    volumes:
      - ./configurations/postgraphile/jwtRS256.key.pub:/run/config/postgraphile_jwt-public-key:ro
      - ../production/configurations/postgraphile/.postgraphilerc.js:/postgraphile/.postgraphilerc.js:ro
  postgres:
    # You can access the database via `adminer`.
    command: -c maevsi.jwt_expiry_duration='1 month'
    environment:
      POSTGRES_ADDITIONAL_DBS: grafana
      POSTGRES_DB_FILE: /run/secrets/postgres_db
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_USER_FILE: /run/secrets/postgres_user
    image: quay.io/debezium/postgres:17-alpine
    # # Expose ports (only) e.g. to generate a database graph image or similar.
    # ports:
    #   - 5432:5432
    secrets:
      - postgres_db
      - postgres_password
      - postgres_user
    # sysctls:
    #   # Prevent Docker Swarm from killing pg-amqp-bridge connections (https://github.com/moby/moby/issues/31208)
    #   - net.ipv4.tcp_keepalive_time=600
    #   - net.ipv4.tcp_keepalive_intvl=30
    #   - net.ipv4.tcp_keepalive_probes=10
    volumes:
      - /run/:/run/ # Make PGSQL socket available. # #DARGSTACK-REMOVE
      - postgres_data:/var/lib/postgresql/data/
      - ../production/configurations/postgres/docker-entrypoint-initdb.d/:/docker-entrypoint-initdb.d/:ro
  prometheus:
    # You can access the metrics monitoring at [prometheus.localhost](https://prometheus.localhost/).
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.prometheus.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.prometheus.rule=Host(`prometheus.${STACK_DOMAIN}`)
        - traefik.http.routers.prometheus_secure.rule=Host(`prometheus.${STACK_DOMAIN}`)
        - traefik.http.routers.prometheus_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.services.prometheus.loadbalancer.server.port=9090
    image: prom/prometheus:v3.2.0
    volumes:
      - ../production/configurations/prometheus/prometheus.yaml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
  redpanda:
    # You can access the event streaming platform's ui as described under `redpanda-console`.
    command:
      - redpanda start
      - --mode dev-container #DARGSTACK-REMOVE
      - --kafka-addr internal://0.0.0.0:9092,external://0.0.0.0:19092
      - --advertise-kafka-addr internal://redpanda:9092,external://localhost:19092
      - --pandaproxy-addr internal://0.0.0.0:8082,external://0.0.0.0:18082
      - --advertise-pandaproxy-addr internal://redpanda:8082,external://localhost:18082
      - --schema-registry-addr internal://0.0.0.0:8081,external://0.0.0.0:18081
    # healthcheck:
    #   test: ["CMD-SHELL", "output=$(rpk cluster health --json); echo \"$output\" | grep -q '\"healthy\":true' || { echo \"$output\"; exit 1; }"]
    #   interval: 30s
    #   timeout: 10s
    #   retries: 3
    #   start_period: 10s
    image: redpandadata/redpanda:v24.3.5
    volumes:
      - redpanda_data:/var/lib/redpanda/data
  redpanda-console:
    # You can access the event streaming platform's ui at [redpanda.localhost](https://redpanda.localhost/).
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.redpanda.middlewares=redirectscheme
        - traefik.http.routers.redpanda.rule=Host(`redpanda.${STACK_DOMAIN}`)
        - traefik.http.routers.redpanda_secure.rule=Host(`redpanda.${STACK_DOMAIN}`)
        - traefik.http.routers.redpanda_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.services.redpanda.loadbalancer.server.port=8080
    environment:
      CONFIG_FILEPATH: /srv/app/redpanda-config.yaml
    image: redpandadata/console:v2.8.2
    volumes:
      - ../production/configurations/redpanda/config.yaml:/srv/app/redpanda-config.yaml:ro
  sqitch:
    # You cannot access the database migrations directly.
    image: maevsi/sqitch:dev
    secrets:
      - postgres_role_grafana_password
      - postgres_role_grafana_username
      - postgres_role_maevsi-postgraphile_password
      - postgres_role_maevsi-postgraphile_username
      - postgres_role_maevsi-tusd_password
      - postgres_role_maevsi-tusd_username
      - sqitch_target
    volumes:
      - ../../../sqitch/:/srv/app/
      - /run/postgresql/:/run/postgresql/
  traefik:
    # You can access the reverse proxy's dashboard at [traefik.localhost](https://traefik.localhost/).
    command:
      - --api=true
      - --entryPoints.web.address=:80
      - --entryPoints.web-secure.address=:443
      - --experimental.plugins.body-forward-auth.moduleName=github.com/PatrickMi/body-forward-auth
      - --experimental.plugins.body-forward-auth.version=v0.1.2
      - --providers.swarm=true
      - --providers.swarm.endpoint=unix:///var/run/docker.sock
      - --providers.swarm.exposedByDefault=false
      - --providers.file.filename=/dynamic.yml #DARGSTACK-REMOVE
      - --providers.file.watch=true #DARGSTACK-REMOVE
      - --log.level=DEBUG #DARGSTACK-REMOVE
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.middlewares.redirectscheme.redirectscheme.scheme=https #DARGSTACK-REMOVE
        - traefik.http.routers.traefik.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.traefik.rule=Host(`traefik.${STACK_DOMAIN}`)
        - traefik.http.routers.traefik_secure.rule=Host(`traefik.${STACK_DOMAIN}`)
        - traefik.http.routers.traefik_secure.service=api@internal
        - traefik.http.routers.traefik_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.services.traefik.loadbalancer.server.port=8080
      mode: global
      placement:
        constraints:
          - node.role == manager
    image: traefik:v3.3.3
    ports: #DARGSTACK-REMOVE
      - mode: host #DARGSTACK-REMOVE
        protocol: tcp #DARGSTACK-REMOVE
        published: 80 #DARGSTACK-REMOVE
        target: 80 #DARGSTACK-REMOVE
      - mode: host #DARGSTACK-REMOVE
        protocol: tcp #DARGSTACK-REMOVE
        published: 443 #DARGSTACK-REMOVE
        target: 443 #DARGSTACK-REMOVE
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./certificates/:/etc/traefik/acme/
      - ./configurations/traefik/dynamic.yml:/dynamic.yml:ro #DARGSTACK-REMOVE
  tusd:
    # You can access the upload service at [tusd.localhost](https://tusd.localhost/).
    command: -behind-proxy --hooks-enabled-events pre-create,pre-finish,post-terminate --hooks-http http://maevsi:3000/api/tusd -max-size ${TUSD_MAX_SIZE} -s3-bucket ${TUSD_BUCKET} -s3-endpoint ${TUSD_ENDPOINT}
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.tusd.middlewares=redirectscheme #DARGSTACK-REMOVE
        - traefik.http.routers.tusd.rule=Host(`tusd.${STACK_DOMAIN}`)
        - traefik.http.middlewares.tusd_cors.headers.customresponseheaders.Cross-Origin-Resource-Policy=cross-origin
        - traefik.http.routers.tusd_secure.middlewares=tusd_cors
        - traefik.http.routers.tusd_secure.rule=Host(`tusd.${STACK_DOMAIN}`) && (Method(`GET`) || Method(`HEAD`) || Method(`OPTIONS`) || Method(`POST`) || Method(`PUT`) || Method(`PATCH`))
        - traefik.http.routers.tusd_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
        - traefik.http.services.tusd.loadbalancer.server.port=8080
    environment:
      AWS_REGION: ${TUSD_REGION}
    image: tusproject/tusd:v2.6.0
    secrets:
      - source: tusd_aws
        target: /home/tusd/.aws/credentials
version: "3.7"
volumes:
  grafana_data:
    # The observation dashboard's data.
    {}
  minio_data:
    # The s3 server's data.
    {}
  portainer_data:
    # The container manager's data.
    {}
  postgres_data:
    # The database's data.
    {}
  prometheus_data:
    # The metrics monitoring's data.
    {}
  redpanda_data:
    # The message queue's data.
    {}