Portainer stacks

1_portainer-with-ssl-and-admin-password.yml

version: "3.6"
services:
  portainer:
    image: portainer/portainer
    command: --ssl --sslcert /path/to/certificate.crt --sslkey /path/to/certificate.key --admin-password-file '/path/to/password.txt' 
    ports:
      - "9000:9000"
    networks:
      - portainer-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer-data:/data
    deploy:
      placement:
        constraints: [node.role == manager]
      restart_policy:
        condition: any
      resources:
        limits:
          cpus: '0.20'
          memory: 256M

networks:
  portainer-net:

volumes:
  portainer-data:

2_portainer-with-ssl-and-admin-password-from-docker-secrets.yml

version: "3.6"
services:
  portainer:
    image: portainer/portainer
    command: --ssl --sslcert /run/secrets/portainer.crt --sslkey /run/secrets/portainer.key --admin-password-file '/run/secrets/portainer-pass' 
    ports:
      - "9000:9000"
    networks:
      - portainer-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer-data:/data
    deploy:
      placement:
        constraints: [node.role == manager]
      restart_policy:
        condition: any
      resources:
        limits:
          cpus: '0.20'
          memory: 256M
    secrets:
      - portainer.crt
      - portainer.key
      - portainer-pass

networks:
  portainer-net:

volumes:
  portainer-data:

secrets:
  portainer.crt:
    external: true
  portainer.key:
    external: true
  portainer-pass:
    external: true

3_portainer-secrets-setup.sh

#!/bin/sh

# init secrets
echo -n P@s$w0rd123! | docker secret create portainer-pass -
docker secret create portainer.crt your_ssl_cert.crt
docker secret create portainer.key your_ssl_key.key

# deploy portainer
docker stack deploy -c portainer-with-ssl-and-admin-password.yml portainer

4_portainer-agent-stack.yml

# from https://gist.github.com/deviantony/a332e874756af8b7c8e009b9df1a5c8a#file-portainer-agent-stack-yml
version: '3.6'
services:
  agent:
    image: portainer/agent:latest
    environment:
      AGENT_PORT: 9001
      # Should be equal to the service name prefixed by "tasks." when
      # deployed inside an overlay network
      AGENT_CLUSTER_ADDR: tasks.agent
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - portainer-net
    deploy:
      mode: global

  portainer:
    image: portainer/portainer:latest
    command: -H tcp://tasks.agent:9001 --tlsskipverify --ssl --sslcert /path/to/certificate.crt --sslkey /path/to/certificate.key --admin-password-file '/path/to/password.txt' 
    ports:
      - "9000:9000"
    volumes:
      - portainer_data:/data
    networks:
      - portainer-net
    deploy:
      placement:
        constraints: [node.role == manager]
      mode: replicated
      replicas: 1
      restart_policy:
        condition: any
      resources:
        limits:
          cpus: '0.20'
          memory: 256M

networks:
  portainer-net:
    driver: overlay

volumes:
  portainer_data: