docs: single server setup example (#715)

* docs: single server setup example

* docs: lint single server setup example

* docs: LAN based setup

* docs: fix traefik ssl override

* docs: move data directory to user home

* docs: remove env-file from exec commands

docs/compose/compose.custom-domain-ssl.yaml

@@ -0,0 +1,5 @@
+services:
+  custom-domain:
+    labels:
+      - traefik.http.routers.${ROUTER}.entrypoints=http,https
+      - traefik.http.routers.${ROUTER}.tls.certresolver=le

docs/compose/compose.custom-domain.yaml

@@ -0,0 +1,31 @@
+version: "3.3"
+
+services:
+  custom-domain:
+    image: caddy:2
+    command:
+      - caddy
+      - reverse-proxy
+      - --to
+      - frontend:8080
+      - --from
+      - :2016
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-public
+      - traefik.http.services.${ROUTER?ROUTER not set}.loadbalancer.server.port=2016
+      - traefik.http.routers.${ROUTER}.service=${ROUTER}
+      - traefik.http.routers.${ROUTER}.entrypoints=http
+      - traefik.http.routers.${ROUTER}.rule=Host(${SITES?SITES not set})
+      - traefik.http.middlewares.${ROUTER}.headers.customrequestheaders.Host=${BASE_SITE?BASE_SITE not set}
+      - traefik.http.routers.${ROUTER}.middlewares=${ROUTER}
+    networks:
+      - traefik-public
+      - bench-network
+
+networks:
+  traefik-public:
+    external: true
+  bench-network:
+    name: ${BENCH_NETWORK?BENCH_NETWORK not set}
+    external: true

docs/compose/compose.mariadb-shared.yaml

@@ -0,0 +1,27 @@
+version: "3.3"
+
+services:
+  database:
+    container_name: mariadb-database
+    image: mariadb:10.6
+    restart: unless-stopped
+    healthcheck:
+      test: mysqladmin ping -h localhost --password=${DB_PASSWORD:-changeit}
+      interval: 1s
+      retries: 15
+    command:
+      - --character-set-server=utf8mb4
+      - --collation-server=utf8mb4_unicode_ci
+      - --skip-character-set-client-handshake
+      - --skip-innodb-read-only-compressed
+    environment:
+      MYSQL_ROOT_PASSWORD: ${DB_PASSWORD:-changeit}
+    volumes:
+      - ${HOME}/data/mariadb:/var/lib/mysql
+    networks:
+      - mariadb-network
+
+networks:
+  mariadb-network:
+    name: mariadb-network
+    external: false

docs/compose/compose.multi-bench-ssl.yaml

@@ -0,0 +1,5 @@
+services:
+  frontend:
+    labels:
+      - traefik.http.routers.${ROUTER}.entrypoints=http,https
+      - traefik.http.routers.${ROUTER}.tls.certresolver=le

docs/compose/compose.multi-bench.yaml

@@ -0,0 +1,46 @@
+services:
+  frontend:
+    networks:
+      - traefik-public
+      - mariadb-network
+      - bench-network
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-public
+      - traefik.http.services.${ROUTER?ROUTER not set}.loadbalancer.server.port=8080
+      - traefik.http.routers.${ROUTER}.service=${ROUTER}
+      - traefik.http.routers.${ROUTER}.entrypoints=http
+      - traefik.http.routers.${ROUTER}.rule=Host(${SITES?SITES not set})
+  configurator:
+    networks:
+      - mariadb-network
+  backend:
+    networks:
+      - mariadb-network
+  websocket:
+    networks:
+      - mariadb-network
+  scheduler:
+    networks:
+      - mariadb-network
+  queue-default:
+    networks:
+      - mariadb-network
+  queue-short:
+    networks:
+      - mariadb-network
+  queue-long:
+    networks:
+      - mariadb-network
+  redis:
+    networks:
+      - mariadb-network
+
+networks:
+  traefik-public:
+    external: true
+  mariadb-network:
+    external: true
+  bench-network:
+    name: ${ROUTER}
+    external: false

docs/compose/compose.traefik-ssl.yaml

@@ -0,0 +1,45 @@
+services:
+  traefik:
+    labels:
+      # https-redirect middleware to redirect HTTP to HTTPS
+      # It can be re-used by other stacks in other Docker Compose files
+      - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
+      - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
+      # traefik-http to use the middleware to redirect to https
+      - traefik.http.routers.traefik-public-http.middlewares=https-redirect
+      # traefik-https the actual router using HTTPS
+      # Uses the environment variable DOMAIN
+      - traefik.http.routers.traefik-public-https.rule=Host(`${TRAEFIK_DOMAIN}`)
+      - traefik.http.routers.traefik-public-https.entrypoints=https
+      - traefik.http.routers.traefik-public-https.tls=true
+      # Use the special Traefik service api@internal with the web UI/Dashboard
+      - traefik.http.routers.traefik-public-https.service=api@internal
+      # Use the "le" (Let's Encrypt) resolver created below
+      - traefik.http.routers.traefik-public-https.tls.certresolver=le
+      # Enable HTTP Basic auth, using the middleware created above
+      - traefik.http.routers.traefik-public-https.middlewares=admin-auth
+    command:
+      # Enable Docker in Traefik, so that it reads labels from Docker services
+      - --providers.docker=true
+      # Do not expose all Docker services, only the ones explicitly exposed
+      - --providers.docker.exposedbydefault=false
+      # Create an entrypoint http listening on port 80
+      - --entrypoints.http.address=:80
+      # Create an entrypoint https listening on port 443
+      - --entrypoints.https.address=:443
+      # Create the certificate resolver le for Let's Encrypt, uses the environment variable EMAIL
+      - --certificatesresolvers.le.acme.email=${EMAIL:?No EMAIL set}
+      # Store the Let's Encrypt certificates in the mounted volume
+      - --certificatesresolvers.le.acme.storage=/certificates/acme.json
+      # Use the TLS Challenge for Let's Encrypt
+      - --certificatesresolvers.le.acme.tlschallenge=true
+      # Enable the access log, with HTTP requests
+      - --accesslog
+      # Enable the Traefik log, for configurations and errors
+      - --log
+      # Enable the Dashboard and API
+      - --api
+    ports:
+      - 443:443
+    volumes:
+      - ${HOME}/data/traefik/certificates:/certificates

docs/compose/compose.traefik-swarm.yaml

@@ -0,0 +1,7 @@
+version: "3.3"
+
+services:
+  traefik:
+    command:
+      # Enable Docker Swarm mode
+      - --providers.docker.swarmmode

docs/compose/compose.traefik.yaml

@@ -0,0 +1,46 @@
+version: "3.3"
+
+services:
+  traefik:
+    image: "traefik:v2.6"
+    labels:
+      # Enable Traefik for this service, to make it available in the public network
+      - traefik.enable=true
+      # Use the traefik-public network (declared below)
+      - traefik.docker.network=traefik-public
+      # admin-auth middleware with HTTP Basic auth
+      # Using the environment variables USERNAME and HASHED_PASSWORD
+      - traefik.http.middlewares.admin-auth.basicauth.users=admin:${HASHED_PASSWORD:?No HASHED_PASSWORD set}
+      # Uses the environment variable TRAEFIK_DOMAIN
+      - traefik.http.routers.traefik-public-http.rule=Host(`${TRAEFIK_DOMAIN:?No TRAEFIK_DOMAIN set}`)
+      - traefik.http.routers.traefik-public-http.entrypoints=http
+      # Use the special Traefik service api@internal with the web UI/Dashboard
+      - traefik.http.routers.traefik-public-http.service=api@internal
+      # Enable HTTP Basic auth, using the middleware created above
+      - traefik.http.routers.traefik-public-http.middlewares=admin-auth
+      # Define the port inside of the Docker service to use
+      - traefik.http.services.traefik-public.loadbalancer.server.port=8080
+    command:
+      # Enable Docker in Traefik, so that it reads labels from Docker services
+      - --providers.docker=true
+      # Do not expose all Docker services, only the ones explicitly exposed
+      - --providers.docker.exposedbydefault=false
+      # Create an entrypoint http listening on port 80
+      - --entrypoints.http.address=:80
+      # Enable the access log, with HTTP requests
+      - --accesslog
+      # Enable the Traefik log, for configurations and errors
+      - --log
+      # Enable the Dashboard and API
+      - --api
+    ports:
+      - 80:80
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - traefik-public
+
+networks:
+  traefik-public:
+    name: traefik-public
+    external: false