docker-compose.yml

version: '3'

services:
  traefik:
    container_name: traefik
    image: traefik:v2.6
    networks:
      - proxy_net
    ports:
      - "80:80"
      - "443:443"
      - "8088:8080"
    volumes:
       - '/var/run/docker.sock:/var/run/docker.sock:ro'
       - './traefik_conf/traefik.providers.file.toml:/etc/traefik/traefik.providers.file.toml'
       - './letsencrypt:/letsencrypt'
    restart: always
    environment:
      - TRAEFIK_API=true
      - TRAEFIK_API_DASHBOARD=true
      - TRAEFIK_API_INSECURE=true
      - TRAEFIK_CERTIFICATESRESOLVERS_LE=true
      # - TRAEFIK_CERTIFICATESRESOLVERS_LE_ACME_CASERVER=https://acme-staging-v02.api.letsencrypt.org/directory   # Uncomment for using Letsencrypt staging server (Info at https://letsencrypt.org/docs/staging-environment/)
      - TRAEFIK_CERTIFICATESRESOLVERS_LE_ACME_EMAIL=${LE_EMAIL:?err}
      - TRAEFIK_CERTIFICATESRESOLVERS_LE_ACME_HTTPCHALLENGE=true
      - TRAEFIK_CERTIFICATESRESOLVERS_LE_ACME_HTTPCHALLENGE_ENTRYPOINT=http
      - TRAEFIK_CERTIFICATESRESOLVERS_LE_ACME_STORAGE=/letsencrypt/acme.json
      - TRAEFIK_ENTRYPOINTS_HTTP=true
      - TRAEFIK_ENTRYPOINTS_HTTP_ADDRESS=:80
      - TRAEFIK_ENTRYPOINTS_HTTPS=true
      - TRAEFIK_ENTRYPOINTS_HTTPS_ADDRESS=:443
      - TRAEFIK_GLOBAL_CHECKNEWVERSION=false
      - TRAEFIK_GLOBAL_SENDANONYMOUSUSAGE=false
      - TRAEFIK_LOG=true
      - TRAEFIK_LOG_LEVEL=INFO
      - TRAEFIK_PROVIDERS_DOCKER=true
      - TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT=false
      - TRAEFIK_PROVIDERS_DOCKER_NETWORK=${COMPOSE_PROJECT_NAME:-workfromhome-with-docker}_proxy_net
      - TRAEFIK_PROVIDERS_FILE_FILENAME=/etc/traefik/traefik.providers.file.toml
      - TRAEFIK_PROVIDERS_FILE_WATCH=true



  guacd:
    image: guacamole/guacd
    restart: always
    container_name: guacamole-guacd
    depends_on:
      - traefik
    networks:
      - backend

  db:
    image: mysql
    restart: always
    container_name: guacamole-db
    depends_on:
      - traefik
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:-guacsomethingsecret4444}
      - MYSQL_USER=${MYSQL_USER:-guacamole}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-guacsomethingsecret8888}
      - MYSQL_DATABASE=${MYSQL_DATABASE:-guacamole}
    volumes:
      - ./mysql:/var/lib/mysql
      - ./mysql_init/schema.sql:/docker-entrypoint-initdb.d/schema.sql:ro
    networks:
      - backend


  guacamole:
    image: guacamole/guacamole
    container_name: guacamole-app
    restart: always
    ports:
      - 8081:8080
    links:
      - guacd:guacd
      - db:mysql
    depends_on:
      - db
      - guacd
    volumes:
      - "./guac_conf/server.xml:/usr/local/tomcat/conf/server.xml"
      - "./guac_home:/guac_home"
    environment:
      - GUACAMOLE_HOME=/guac_home
      - MYSQL_HOSTNAME=mysql
      - MYSQL_DATABASE=${MYSQL_DATABASE:-guacamole}
      - MYSQL_USER=${MYSQL_USER:-guacamole}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-guacsomethingsecret8888}
      - GUACD_HOSTNAME=guacd
      - GUACD_PORT=4822
      - LDAP_HOSTNAME=${LDAP_HOSTNAME}
      - LDAP_PORT=${LDAP_PORT:-389}
      - LDAP_ENCRYPTION_METHOD=${LDAP_ENCRYPTION_METHOD:-none}
      - LDAP_USER_BASE_DN=${LDAP_USER_BASE_DN}
      - LDAP_GROUP_BASE_DN=${LDAP_GROUP_BASE_DN}
      - LDAP_SEARCH_BIND_DN=${LDAP_SEARCH_BIND_DN}
      - LDAP_SEARCH_BIND_PASSWORD=${LDAP_SEARCH_BIND_PASSWORD}
      - LDAP_USERNAME_ATTRIBUTE=${LDAP_USERNAME_ATTRIBUTE:-userPrincipalName}
      - LDAP_GROUP_NAME_ATTRIBUTE=${LDAP_GROUP_NAME_ATTRIBUTE:-cn}
      - LDAP_MEMBER_ATTRIBUTE=${LDAP_MEMBER_ATTRIBUTE:-member}
      - LDAP_USER_SEARCH_FILTER=${LDAP_USER_SEARCH_FILTER:-(&(objectCategory=person)(objectclass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))}
      - TOTP_ISSUER=${FQDN_HOST_NAME:?err}
    networks:
      - backend
      - proxy_net
    labels:
      - "traefik.enable=true"
      # HTTP
      - "traefik.http.routers.guac.rule=Host(`${FQDN_HOST_NAME:?err}`)"
      - "traefik.http.routers.guac.entrypoints=http"
      - "traefik.http.routers.guac.middlewares=https_redirect_permanent@file"
      # HTTPS
      - "traefik.http.routers.guac_ssl.rule=Host(`${FQDN_HOST_NAME:?err}`)"
      - "traefik.http.routers.guac_ssl.entrypoints=https"
      - "traefik.http.routers.guac_ssl.service=guac"
      - "traefik.http.routers.guac_ssl.middlewares=guac_headers,guac_addprefix"
      - "traefik.http.routers.guac_ssl.tls=true"
      - "traefik.http.routers.guac_ssl.tls.certResolver=le"
      - "traefik.http.routers.guac_ssl.tls.options=default"
      # Middleware
      - "traefik.http.middlewares.guac_headers.headers.stsincludesubdomains=true"
      - "traefik.http.middlewares.guac_headers.headers.stsseconds=315360000"
      - "traefik.http.middlewares.guac_headers.headers.forcestsheader=true"
      - "traefik.http.middlewares.guac_addprefix.addprefix.prefix=/guacamole"
      # Service
      - "traefik.http.services.guac.loadbalancer.server.port=8080"

networks:
  proxy_net:
  backend: