compose.yaml

configs:
  ts-serve:
    content: |
      {"TCP":{"443":{"HTTPS":true}},
      "Web":{"$${TS_CERT_DOMAIN}:443":
          {"Handlers":{"/":
          {"Proxy":"http://127.0.0.1:8065"}}}},
      "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}}

services:
# Make sure you have updated/checked the .env file with the correct variables. 
# All the ${ xx } need to be defined there.
  # Tailscale Sidecar Configuration
  tailscale:
    image: tailscale/tailscale:latest # Image to be used
    container_name: tailscale-${SERVICE} # Name for local container management
    hostname: ${SERVICE} # Name used within your Tailscale environment
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required
      - TS_USERSPACE=false
      - TS_ENABLE_HEALTH_CHECK=true              # Enable healthcheck endpoint: "/healthz"
      - TS_LOCAL_ADDR_PORT=127.0.0.1:41234       # The <addr>:<port> for the healthz endpoint
      #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS
      - TS_AUTH_ONCE=true
    configs:
      - source: ts-serve
        target: /config/serve.json
    volumes:
      - ./config:/config # Config folder used to store Tailscale files - you may need to change the path
      - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path
    devices:
      - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work
    cap_add:
      - net_admin # Tailscale requirement
    #ports:
    #  - ${HTTP_PORT}:${HTTP_PORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required
    #  - ${HTTPS_PORT}:${HTTPS_PORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required
    #  - ${CALLS_PORT}:${CALLS_PORT}/udp
    #  - ${CALLS_PORT}:${CALLS_PORT}/tcp
    # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below
    # dns: 
    #   - ${DNS_SERVER}
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational
      interval: 1m # How often to perform the check
      timeout: 10s # Time to wait for the check to succeed
      retries: 3 # Number of retries before marking as unhealthy
      start_period: 10s # Time to wait before starting health checks
    restart: always

  application:
    image: ${IMAGE_URL} # Image to be used
    container_name: app-${SERVICE} # Name for local container management
    network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale
    volumes:
      - ${MATTERMOST_CONFIG_PATH}:/mattermost/config:rw ## ./${SERVICE}-data/mattermost/
      - ${MATTERMOST_DATA_PATH}:/mattermost/data:rw
      - ${MATTERMOST_LOGS_PATH}:/mattermost/logs:rw
      - ${MATTERMOST_PLUGINS_PATH}:/mattermost/plugins:rw
      - ${MATTERMOST_CLIENT_PLUGINS_PATH}:/mattermost/client/plugins:rw
      - ${MATTERMOST_BLEVE_INDEXES_PATH}:/mattermost/bleve-indexes:rw
      # When you want to use SSO with GitLab, you have to add the cert pki chain of GitLab inside Alpine
      # to avoid Token request failed: certificate signed by unknown authority 
      # (link: https://github.com/mattermost/mattermost-server/issues/13059 and https://github.com/mattermost/docker/issues/34)
      # - ${GITLAB_PKI_CHAIN_PATH}:/etc/ssl/certs/pki_chain.pem:ro
    security_opt:
      - no-new-privileges:true
      - label:disable
    pids_limit: 200
    environment:
      # timezone inside container
      - TZ=Europe/Amsterdam
      # necessary Mattermost options/variables (see .env file)
      - MM_SQLSETTINGS_DRIVERNAME
      - MM_SQLSETTINGS_DATASOURCE
      # necessary for bleve
      - MM_BLEVESETTINGS_INDEXDIR
      # additional settings
      - MM_SERVICESETTINGS_SITEURL
    restart: always
    depends_on:
      - database
      - tailscale

  database:
    image: postgres:latest
    container_name: db-${SERVICE}
    restart: always
    security_opt:
      - no-new-privileges:true
    pids_limit: 100
    read_only: true
    tmpfs:
      - /tmp
      - /var/run/postgresql
    volumes:
      - ${POSTGRES_DATA_PATH}:/var/lib/postgresql/data
    environment:
      # timezone inside container
      - TZ=Europe/Amsterdam
      # necessary Postgres options/variables defined in the .env file
      - POSTGRES_USER
      - POSTGRES_PASSWORD
      - POSTGRES_DB