docker-compose.yaml

# ========================================
# docker-compose.yml - Matomo mit chialab/php
# ========================================

services:
  php-apache:
    image: chialab/php:8.3-apache
    container_name: ${COMPOSE_PROJECT_NAME}-php-apache
    depends_on:
      sql:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      - TZ=${TIMEZONE}
      - APACHE_DOCUMENT_ROOT=${APACHE_DOCUMENT_ROOT}
      - COMPOSER_ALLOW_SUPERUSER=1
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:80/index.php || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    labels:
      # Traefik Labels - HTTPS Router
      - traefik.enable=true
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.rule=${HOSTRULE}
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.entrypoints=websecure-https
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls.certresolver=letsEncrypt
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls.options=modern@file
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.middlewares=security-headers@file,compression@file,rate-limit@file
      - traefik.http.services.${COMPOSE_PROJECT_NAME}.loadbalancer.passHostHeader=true
      - traefik.http.services.${COMPOSE_PROJECT_NAME}.loadbalancer.server.port=80

      # Traefik Labels - HTTP -> HTTPS Redirect
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-http.rule=${HOSTRULE}
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-http.entrypoints=websecure-http
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}-http.middlewares=redirect-to-https@file

      # Ofelia Labels - CronJobs
      - ofelia.enabled=true
      # Archivierung: Stündlich (archiviert automatisch alle konfigurierten Sites)
      - ofelia.job-exec.${COMPOSE_PROJECT_NAME}-core-archive.schedule=0 * * * *
      - ofelia.job-exec.${COMPOSE_PROJECT_NAME}-core-archive.command=php /var/www/html/console core:archive
      # Alte Logs löschen: Täglich um 2 Uhr (älter als 180 Tage)
      - ofelia.job-exec.${COMPOSE_PROJECT_NAME}-logs-delete.schedule=0 2 * * *
      - ofelia.job-exec.${COMPOSE_PROJECT_NAME}-logs-delete.command=php /var/www/html/console core:delete-logs-data --dates=180
      # Temporäre Daten bereinigen: Täglich um 3 Uhr
      - ofelia.job-exec.${COMPOSE_PROJECT_NAME}-tmp-purge.schedule=0 3 * * *
      - ofelia.job-exec.${COMPOSE_PROJECT_NAME}-tmp-purge.command=php /var/www/html/console core:purge-old-archive-data

    networks:
      - default
      - ${PROXY_NETWORK}
    restart: unless-stopped
    tmpfs:
      - /var/www/html/tmp:size=1G,mode=1777
    volumes:
      - www-data:/var/www/html
      - ./configs/php/matomo.ini:/usr/local/etc/php/conf.d/matomo.ini:ro
      - ./configs/apache/matomo-security.conf:/etc/apache2/conf-enabled/matomo-security.conf:ro

# ========================================
# Redis
# ========================================
  redis:
    image: redis:7-alpine
    container_name: ${COMPOSE_PROJECT_NAME}-redis
    command:
      - redis-server
      - --appendonly
      - "no"
      - --save
      - ""
      - --maxmemory
      - 1gb
      - --maxmemory-policy
      - volatile-lru
      - --requirepass
      - "${REDIS_PASSWORD}"
    environment:
      - TZ=${TIMEZONE}
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: "1G"
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 3s
      retries: 3
    networks:
      default:
        aliases:
          - redis
    restart: unless-stopped

# ========================================
# MariaDB
# ========================================
  sql:
    image: mariadb:11.4
    container_name: ${COMPOSE_PROJECT_NAME}-sql
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: "4G"
    environment:
      - MYSQL_ROOT_PASSWORD=${SQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=${SQL_DATABASE}
      - MYSQL_USER=${SQL_USER}
      - MYSQL_PASSWORD=${SQL_PASSWORD}
      - MARIADB_AUTO_UPGRADE=1
      - MYSQL_CHARSET=utf8mb4
      - TZ=${TIMEZONE}
    healthcheck:
      test: ["CMD-SHELL", "mariadb-admin ping -uroot -p\"${SQL_ROOT_PASSWORD}\" || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 30s
    networks:
      default:
        aliases:
          - mysql
          - database
    restart: unless-stopped
    volumes:
      - sql-data:/var/lib/mysql
      - ./configs/sql/custom.cnf:/etc/mysql/mariadb.conf.d/99-custom.cnf:ro

# ========================================
# Datenbank Backup
# ========================================
  sqlbackup:
    image: fradelg/mysql-cron-backup:latest
    container_name: ${COMPOSE_PROJECT_NAME}-sqlbackup
    depends_on:
      sql:
        condition: service_healthy
    environment:
      TZ: ${TIMEZONE}
      MYSQL_HOST: sql
      MYSQL_USER: root
      MYSQL_PASS: ${SQL_ROOT_PASSWORD}
      MAX_BACKUPS: 12
      INIT_BACKUP: 1
      CRON_TIME: "3 */6 * * *"
      GZIP_LEVEL: 9
    healthcheck:
      test: ["CMD-SHELL", "test -d /backup || exit 1"]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - default
    restart: unless-stopped
    volumes:
      - ${BACKUPVOLUME}/${COMPOSE_PROJECT_NAME}:/backup

# ========================================
# Networks
# ========================================
networks:
  default:
    driver: bridge
  traefik_proxy_network:
    external: true
    name: ${PROXY_NETWORK}

# ========================================
# Volumes
# ========================================
volumes:
  sql-data:
    driver: local
    driver_opts:
      device: ${PWD}/volumes/sql
      o: bind
      type: none

  www-data:
    driver: local
    driver_opts:
      device: ${PWD}/volumes/html
      o: bind
      type: none