version: "3.0"

{# Updated: 2023-12-05 #}
# master: {{ common_mastering }}
# updated: {{ ansible_date_time.date }}

#
# stack:   x-host
#

services:

  x-host:

    logging:
      driver: loki
      options:
        loki-url: "http://${MASTER_HOST}:${VM_PORT_LOKI}/loki/api/v1/push"
        loki-retries: "2"
        loki-max-backoff: 800ms
        loki-timeout: 1s
        loki-batch-wait: 60s
        loki-batch-size: "2097152"
        no-file: "false"
        keep-file: "true"
        max-size: "512m"
        max-file: "8"

    restart: unless-stopped
    stop_grace_period: 5s
    stdin_open: true
    tty: true

    user: ${VM_USER}:${VM_GROUP}

    privileged: false

    security_opt:
      - no-new-privileges=true

    cap_drop:
      - ALL

    cap_add:
      - KILL

    ipc: "private"

    healthcheck:
      interval: 60s
      timeout: 10s
      retries: 5
      start_period: 60s

    environment:
      TZ: "Europe/Paris"
      PUID: 1000
      PGID: 1000
      DOCKER_HOST: "tcp://${VM_HOST}:${VM_PORT_DOCKERPROXY}"

    labels:
      com.centurylinklabs.watchtower.enable: true
      logging: "promtail"
      com.vm.os.id: "{{ vm_os_id }}"
      com.vm.os.codename: "{{ vm_os_codename }}"
      com.vm.os.description: "{{ vm_os_description }}"
      com.vm.versionning: "${VM_VERSIONNING}"
      com.stack.owner: "Olivier Le Bris"
      com.stack.owner.email: "tech@zogg.fr"
      com.stack.owner.url: "https://zogg.fr"
      com.stack.name: "common"
      com.stack.service.name: "common"
      traefik.docker.network: traefik

    ulimits:
      nproc: 65535
      nofile:
        soft: 20000
        hard: 40000

    deploy:
      resources:
        limits:
          cpus: "{{ vm_resources_cpu }}"
          memory: "{{ vm_resources_memory }}"
          pids: {{ vm_resources_pid }}

    tmpfs:
      - /tmp:rw,exec,size=64M
      - /run:rw,exec,size=16M,mode=01777
      - /var/log:rw,size=64M,mode=01777
      - /var/cache:rw,size=64M,mode=01777

    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - /opt/docker/ssl:/ssl:ro
      - /proc/cgroups:/cgroup:rw