mintel.me/docker-compose.yml

services:
  mintel-me-app:
    image: registry.infra.mintel.me/mintel/mintel.me:${IMAGE_TAG:-latest}
    restart: always
    networks:
      - default
      - infra
    env_file:
      - ${ENV_FILE:-.env}
    labels:
      - "traefik.enable=true"
      # HTTP ⇒ HTTPS redirect
      - 'traefik.http.routers.mintel-me-web.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
      - "traefik.http.routers.mintel-me-web.entrypoints=web"
      # - "traefik.http.routers.mintel-me-web.middlewares=redirect-https"
      # HTTPS router (Standard)
      - 'traefik.http.routers.mintel-me.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
      - "traefik.http.routers.mintel-me.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
      - "traefik.http.routers.mintel-me.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
      - "traefik.http.routers.mintel-me.tls=${TRAEFIK_TLS:-false}"
      - "traefik.http.routers.mintel-me.service=mintel-me-app-svc"
      - "traefik.http.routers.mintel-me.middlewares=${AUTH_MIDDLEWARE:-mintel-me-ratelimit,mintel-me-forward}"
      - "traefik.http.services.mintel-me-app-svc.loadbalancer.server.port=3000"
      - "traefik.docker.network=infra"
      - "caddy=${TRAEFIK_HOST:-mintel.localhost}"
      - "caddy.reverse_proxy={{upstreams 3000}}"

      # Public Router (Whitelist for OG Images, Sitemaps, Health)
      - 'traefik.http.routers.mintel-me-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
      - "traefik.http.routers.mintel-me-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
      - "traefik.http.routers.mintel-me-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
      - "traefik.http.routers.mintel-me-public.tls=${TRAEFIK_TLS:-false}"
      - "traefik.http.routers.mintel-me-public.service=mintel-me-app-svc"
      - "traefik.http.routers.mintel-me-public.middlewares=${AUTH_MIDDLEWARE_UNPROTECTED:-mintel-me-ratelimit,mintel-me-forward}"
      - "traefik.http.routers.mintel-me-public.priority=2000"

      # Middlewares
      - "traefik.http.middlewares.mintel-me-ratelimit.ratelimit.average=100"
      - "traefik.http.middlewares.mintel-me-ratelimit.ratelimit.burst=50"

      # Gatekeeper Router (Path-based)
      - 'traefik.http.routers.mintel-me-gatekeeper.rule=(Host("${TRAEFIK_HOST:-mintel.localhost}") && PathPrefix("/gatekeeper"))'
      - "traefik.http.routers.mintel-me-gatekeeper.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
      - "traefik.http.routers.mintel-me-gatekeeper.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
      - "traefik.http.routers.mintel-me-gatekeeper.tls=${TRAEFIK_TLS:-false}"
      - "traefik.http.routers.mintel-me-gatekeeper.service=mintel-me-gatekeeper-svc"

      - "traefik.http.middlewares.mintel-me-auth.forwardauth.address=http://mintel-me-gatekeeper:3000/gatekeeper/api/verify"
      - "traefik.http.middlewares.mintel-me-auth.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.mintel-me-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
      - "traefik.http.middlewares.mintel-me-auth.forwardauth.authResponseHeaders=X-Auth-User"

      # Forwarded Headers
      - "traefik.http.middlewares.mintel-me-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.mintel-me-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"

  mintel-me-gatekeeper:
    profiles: [ "gatekeeper" ]
    image: registry.infra.mintel.me/mintel/gatekeeper:v1.7.12
    container_name: ${PROJECT_NAME:-mintel-me}-gatekeeper
    restart: always
    networks:
      infra:
        aliases:
          - mintel-me-gatekeeper
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      PORT: 3000
      PROJECT_NAME: ${PROJECT_NAME:-Mintel.me}
      PROJECT_COLOR: ${PROJECT_COLOR:-#ff00ff}
      COOKIE_DOMAIN: ${COOKIE_DOMAIN:-localhost}
      AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-mintel_gatekeeper_session}
      GATEKEEPER_PASSWORD: ${GATEKEEPER_PASSWORD:-mintel}
      NEXT_PUBLIC_BASE_URL: ${GATEKEEPER_ORIGIN}
    labels:
      - "traefik.http.services.mintel-me-gatekeeper-svc.loadbalancer.server.port=3000"
      - "traefik.docker.network=infra"
      - "caddy=gatekeeper.${TRAEFIK_HOST:-mintel.localhost}"
      - "caddy.reverse_proxy={{upstreams 3000}}"

  mintel-me-cms:
    image: registry.infra.mintel.me/mintel/directus:latest
    restart: always
    networks:
      - default
      - infra
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      KEY: ${DIRECTUS_KEY}
      SECRET: ${DIRECTUS_SECRET}
      DB_CLIENT: "pg"
      DB_HOST: "mintel-me-db"
      DB_PORT: "5432"
      DB_DATABASE: ${DIRECTUS_DB_NAME:-directus}
      DB_USER: ${DIRECTUS_DB_USER:-directus}
      DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-directus}
      PUBLIC_URL: ${DIRECTUS_URL:-https://cms.mintel.me}
      SENTRY_DSN: ${SENTRY_DSN}
      SENTRY_ENVIRONMENT: ${TARGET:-development}
      LOGGER_LEVEL: ${LOG_LEVEL:-info}
    volumes:
      - ./directus/uploads:/directus/uploads
      - ./directus/extensions:/directus/extensions
      - ./directus/schema:/directus/schema
      - ./directus/migrations:/directus/migrations
    healthcheck:
      test: [ "CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:8055/server/ping" ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - "traefik.enable=true"
      - 'traefik.http.routers.mintel-me-cms.rule=${TRAEFIK_DIRECTUS_RULE:-Host("${DIRECTUS_HOST:-cms.mintel.localhost}")}'
      - "traefik.http.routers.mintel-me-cms.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
      - "traefik.http.routers.mintel-me-cms.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
      - "traefik.http.routers.mintel-me-cms.tls=${TRAEFIK_TLS:-false}"
      - "traefik.http.routers.mintel-me-cms.service=mintel-me-cms-svc"
      - "traefik.http.routers.mintel-me-cms.middlewares=mintel-me-forward"
      - "traefik.http.services.mintel-me-cms-svc.loadbalancer.server.port=8055"
      - "traefik.docker.network=infra"
      - "caddy=${DIRECTUS_HOST:-cms.mintel.localhost}"
      - "caddy.reverse_proxy={{upstreams 8055}}"

  mintel-me-db:
    image: postgres:15-alpine
    restart: always
    networks:
      - default
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      POSTGRES_DB: ${DIRECTUS_DB_NAME:-directus}
      POSTGRES_USER: ${DIRECTUS_DB_USER:-directus}
      POSTGRES_PASSWORD: ${DIRECTUS_DB_PASSWORD:-directus}
    volumes:
      - directus-db-data:/var/lib/postgresql/data

networks:
  default:
    name: ${PROJECT_NAME:-mintel-me}-internal
    external: true
  infra:
    external: true

volumes:
  directus-db-data:
    external: true
    name: mintel-me_directus-db-data