portainer-docker-stack.yml

portainer-docker-stack.yml

---

# docker network create -d overlay --attachable public
# docker stack deploy portainer -c portainer-agent-stack.yml

version: '3.9'

x-default-opts:
  &default-opts
  logging:
    driver: 'syslog'
    options:
      syslog-address: '${CFG_STACK_LOGGING_SYSLOG_ADDRESS:-udp://127.0.0.1:514}'
#  logging:
#    options:
#      max-size: "1m"
#    driver: "gelf"
#    options:
#      gelf-address: "udp://127.0.0.1:500

services:

  agent:
    <<: *default-opts
    image: 'portainer/agent:${CFG_PORTAINER_AGENT_IMAGE_TAG:-latest}'
    environment:
      # REQUIRED: Should be equal to the service name prefixed by "tasks." when
      # deployed inside an overlay network
      AGENT_CLUSTER_ADDR: 'tasks.agent'
      # AGENT_PORT: 9001
      # LOG_LEVEL: debug
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
      - '/var/lib/docker/volumes:/var/lib/docker/volumes'
      - '/:/host'
    ports:
      - target: 9001
        published: 9001
        protocol: 'tcp'
        mode: 'host'
    networks:
      - 'agent_network'
    deploy:
      mode: 'global'
      placement:
        constraints: [ node.platform.os == linux ]

  portainer:
    <<: *default-opts
    image: "portainer/portainer-ce:${CFG_PORTAINER_CE_IMAGE_TAG:-latest}"
    command: '-H tcp://tasks.agent:9001 --tlsskipverify'
    ports:
      - '9443:9443'
      - '9000:9000'
      - '8000:8000'
    volumes:
      - 'portainer_data:/data'
    networks:
      - 'agent_network'
      - 'public'
    deploy:
      mode: 'replicated'
      replicas: 1
      placement:
        constraints: ['node.role == manager']
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=public"
        # Portainer
        - "traefik.http.services.portainer.loadbalancer.server.port=9000"
        - "traefik.http.routers.portainer.rule=Host(`${CFG_PORTAINER_DASHBOARD_HOSTNAME?}`)"
        - "traefik.http.routers.portainer.entrypoints=websecure"
        #- "traefik.http.routers.portainer.middlewares=anti-ddos,https-headers,https-sts"
        - "traefik.http.routers.portainer.tls=true"
        - "traefik.http.routers.portainer.tls.certresolver=le"
        #- "traefik.http.routers.portainer.tls.options=highSecurity@file"
        - "traefik.http.routers.portainer.service=portainer"
        # Edge
        - "traefik.http.services.edge.loadbalancer.server.port=8000"
        - "traefik.http.routers.edge.rule=Host(`${CFG_PORTAINER_EDGE_HOSTNAME?}`)"
        - "traefik.http.routers.edge.entrypoints=websecure"
        #- "traefik.http.routers.edge.middlewares=anti-ddos,https-headers,https-sts"
        - 'traefik.http.routers.edge.tls=true'
        - 'traefik.http.routers.edge.tls.certresolver=le-staging'
        #- "traefik.http.routers.edge.tls.options=highSecurity@file"
        - 'traefik.http.routers.edge.service=edge'
        # middlewares
        #- "traefik.http.middlewares.https-sts.headers.sslredirect=true"
        #- "traefik.http.middlewares.https-sts.headers.stsSeconds=5259600"
        #- "traefik.http.middlewares.https-headers.headers.browserXssFilter=true"
        #- "traefik.http.middlewares.https-headers.headers.referrerPolicy=no-referrer-when-downgrade"
        #- "traefik.http.middlewares.anti-ddos.ratelimit.average=5"
        #- "traefik.http.middlewares.anti-ddos.ratelimit.burst=10"
    environment:
      LOG_LEVEL: 'info'
      # AGENT_SECRET: "${CFG_AGENT_SECRET:-}"

networks:
  agent_network:
    attachable: true
  public:
    external: true
    name: '${CFG_INGRESS_NETWORK:-public}'

volumes:
  portainer_data:

# curl -L https://downloads.portainer.io/ce2-14/portainer-agent-stack.yml -o portainer-agent-stack.yml
# docker stack deploy -c portainer-agent-stack.yml portainer

#version: '3.2'

#services:
#  agent:
#    image: portainer/agent:2.14.0
#    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock
#      - /var/lib/docker/volumes:/var/lib/docker/volumes
#    networks:
#      - agent_network
#    deploy:
#      mode: global
#      placement:
#        constraints: [node.platform.os == linux]

#  portainer:
#    image: portainer/portainer-ce:2.14.0
#    command: -H tcp://tasks.agent:9001 --tlsskipverify
#    ports:
#      - "9443:9443"
#      - "9000:9000"
#      - "8000:8000"
#    volumes:
#      - portainer_data:/data
#    networks:
#      - agent_network
#    deploy:
#      mode: replicated
#      replicas: 1
#      placement:
#        constraints: [node.role == manager]

#networks:
#  agent_network:
#    driver: overlay
#    attachable: true

#volumes:
#  portainer_data: