docker-compose.yml

version: '3.6'

services:
  
  traefik:
    image: traefik
    # Extra configs placeholder
    #configs:
    #  - source: proxy_conf_file
    #    target: /etc/traefik/traefik.toml
    command:
      - "--web"
      - "--web.address=:7080"
      - "--docker"
      - "--docker.swarmMode"
      - "--docker.domain=fqdn.domain"
      - "--docker.watch"
      - "--logLevel=DEBUG"
      #- "--entryPoints='Name:http://traefik.fqdn.domain:80'"
      - "--defaultEntryPoints='http'"
      - "--accessLogsFile='log/access.log'"
    ports:
      - 80:80
      - 7080:7080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /dev/null:/traefik.toml
    networks:
      - traefik-net
    deploy:
      placement:
        constraints: [node.role==manager]
      labels:
        flip.enabled: "true"

  puppet-docker:
    hostname: '{{.Node.Hostname}}'
    image: registry.fqdn:5000/puppet/puppetserver6-local
    #image: puppet/puppetserver
    #ports:
    #  - target: 8140
    #    published: 8140
    #    mode: host
    ports:
      - 8140:8140
    networks:
      - traefik-net
    volumes:
      - data_vol_code:/etc/puppetlabs/code/
      - data_vol_puppet:/etc/puppetlabs/puppet/
      - data_vol_ssl:/etc/puppetlabs/puppet/ssl/
      - data_vol_srvdata:/opt/puppetlabs/server/data/puppetserver/
    # In some cases unqualified hostnames can have the .local suffix
    # added, I've seen this under Docker of Mac Beta for instance.
    # Due to needing to access PuppetDB on same hostame as signed in the
    # certificate you may need to uncommant the following lines
    environment:
      - PUPPETDB_SERVER_URLS=https://puppetdb1.fqdn.domain:8081,https://puppetdb2.fqdn.domain:8081
      - CA_SERVER=puppetca.fqdn.domain
      - CA_DISABLE=true
      - DNS_ALT_NAMES=puppetca.fqdn.domain,swarm_manager.fqdn.domain,puppet-swarm001.fqdn.domain,puppet-swarm002.fqdn.domain,swarm_node003.fqdn.domain,swarm_node004.fqdn.domain,puppet-swarm.fqdn.domain,flip.fqdn.domain
      - BASEMODULEPATH=/etc/puppetlabs/code/modules:/etc/puppetlabs/code/modules-gic:/etc/puppetlabs/code/modules-eis
    deploy:
      mode: replicated
      #mode: global
      # 1 puppetca & 2 workers. Scale accordingly 
      replicas: 2
      placement:
        constraints:
        - node.labels.type == puppet_node
        - node.role == worker
      labels:
        - "traefik.port=8140"
        - "traefik.backend=puppet-docker"
        - "traefik.enable=true"
        - "traefik.logLevel=DEBUG"
        - "traefik.backend.loadbalancer.swarm=true"
        - "traefik.docker.network=traefik-net"
        - "traefik.frontend.rule=Host:puppet-docker.fqdn.domain"



# Primary Read/Write Postgres
  puppetdb-postgres1:
    #hostname: '{{.Node.Hostname}}'
    hostname: puppetdb-postgres1
    image: puppet/puppetdb-postgres
    environment:
      - POSTGRES_PASSWORD=puppetdb
      - POSTGRES_USER=puppetdb
    volumes:
      - puppetdb-postgres-data1:/var/lib/postgresql/data/
    # Published only for testing, but not necessary to publish postgres ports in production
    ports:
      - target: 5432
        published: 5432
        mode: host
    #ports:
    #  - 5432:5432
    networks:
      - traefik-net
    deploy:
      #mode: replicated
      # Prevents idle session timeout
      endpoint_mode: dnsrr
      mode: global
      #replicas: 2
      placement:
        constraints:
        - node.labels.type == puppetdb1_node
        #- node.labels.type == primary
        - node.role == worker
      labels:
        - "traefik.port=5432"
        - "traefik.backend=puppetdb-postgres1"
        - "traefik.enable=false"
        - "traefik.docker.network=traefik-net"
        - "traefik.frontend.rule=Host:puppetdb-postgres.fqdn.domain"
        #- "traefik.backend.loadbalancer.sticky=true"

## Replica Postgres DB.
## usually replicas are read only. But for PuppetDB we have to have 2 Full Primary DB that allow write
## This is to allow full PuppetDB functionality
## The Postgres DBs will be synched regularly through the PuppetDB
  puppetdb-postgres2:
    #hostname: '{{.Node.Hostname}}'
    hostname: puppetdb-postgres2
    image: puppet/puppetdb-postgres
    environment:
      - POSTGRES_PASSWORD=puppetdb
      - POSTGRES_USER=puppetdb
    volumes:
      - puppetdb-postgres-data2:/var/lib/postgresql/data/
    ports:
      - target: 5432
        published: 5432
        mode: host
    #ports:
    #  - 5432:5432
    networks:
      - traefik-net
    deploy:
      mode: global
      # Prevents idle session timeout
      endpoint_mode: dnsrr
      placement:
        constraints:
        - node.labels.type == puppetdb2_node
        - node.role == worker
      labels:
        - "traefik.port=5432"
        - "traefik.backend=puppetdb-postgres2"
        - "traefik.enable=false"
        - "traefik.docker.network=traefik-net"
        - "traefik.frontend.rule=Host:puppetdb-postgres2.fqdn.domain"
#

# Primary PuppetDB. Uses Primary Read/write postgres
  puppetdb-primary:
    hostname: '{{.Node.Hostname}}'
    #image: puppet/puppetdb:5.2.4
    image: puppet/puppetdb:6.0.0
    environment:
      - PUPPETSERVER_HOSTNAME=puppetca.fqdn.domain
      - PUPPETDB_DATABASE_CONNECTION="//puppetdb-postgres1:5432/puppetdb"
    networks:
      - traefik-net
    ports:
      - target: 8081
        published: 8081
        mode: host
      - target: 8080
        published: 8080
        mode: host
    #ports:
    #  - 8080:8080
    #  - 8081:8081
    volumes:
      - data_puppetdb_vol1:/etc/puppetlabs/puppet/ssl/
    deploy:
      #mode: replicated
      mode: global
      #replicas: 2
      placement:
        constraints:
        #- node.labels.type == puppetdb_node
        - node.labels.type == puppetdb1_node
        - node.role == worker
      labels:
        - "traefik.port=8080"
        - "traefik.port=8081"
        - "traefik.backend=puppetdb-primary"
        - "traefik.enable=true"
        - "traefik.logLevel=DEBUG"
        - "traefik.docker.network=traefik-net"
        - "traefik.frontend.rule=Host:puppetdb-primary.fqdn.domain"

## This is a Puppetdb replica. Uses read/write postgres DB
  puppetdb-replica:
    hostname: '{{.Node.Hostname}}'
    #image: puppet/puppetdb:5.2.4
    image: puppet/puppetdb:6.0.0
    environment:
      - PUPPETSERVER_HOSTNAME=puppetca.fqdn.domain
      - PUPPETDB_DATABASE_CONNECTION="//puppetdb-postgres2:5432/puppetdb"
    networks:
      - traefik-net
    ports:
      - target: 8081
        published: 8081
        mode: host
      - target: 8080
        published: 8080
        mode: host
    #ports:
    #  - 8080
    #  - 8081
    volumes:
      - data_puppetdb_vol2:/etc/puppetlabs/puppet/ssl/
    deploy:
      #mode: replicated
      mode: global
      #replicas: 2
      placement:
        constraints:
        - node.labels.type == puppetdb2_node
        - node.role == worker
      labels:
        - "traefik.port=8080"
        - "traefik.port=8081"
        - "traefik.backend=puppetdb-replica"
        - "traefik.enable=true"
        - "traefik.logLevel=DEBUG"
        - "traefik.docker.network=traefik-net"
        - "traefik.frontend.rule=Host:puppetdb-replica.fqdn.domain"


volumes:
  data_vol_code:
  data_vol_puppet:
  data_vol_ssl:
  data_vol_srvdata:
  data_puppetdb_vol1:
  data_puppetdb_vol2:
  puppetdb-postgres-data1:
  puppetdb-postgres-data2:
networks:
  traefik-net:

configs:
  proxy_conf_file:
    file: ./traefik.toml