version: "3.1"

services:
  server:
    image: zabbix/zabbix-server-mysql:alpine-6.4-latest
    container_name: zabbix-server
    hostname: zabbix.[redacted]
    depends_on:
      - sql
    environment:
      - DB_SERVER_HOST=sql
      - MYSQL_DB=zabbix
      - MYSQL_USER=zabbix
      - MYSQL_PASSWORD_FILE=/run/secrets/zabbix-dbpasswd
      - ZBX_TIMEOUT=30
      - ZBX_STARTREPORTWRITERS=1
      - ZBX_WEBSERVICEURL=http://zabbix-websvc:10053/report
      #- ZBX_DEBUGLEVEL=3
    restart: on-failure
    volumes:
      - alertscripts:/usr/lib/zabbix/alertscripts
      - conf:/etc/zabbix
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      net:
        ipv4_address: 172.22.239.2
      sql:
    ports:
      - 10051:10051/tcp
    secrets:
      - zabbix-dbpasswd

  web:
    image: zabbix/zabbix-web-nginx-mysql:alpine-6.4-latest
    container_name: zabbix-web
    depends_on:
      - server
      - sql
    restart: on-failure
    volumes:
      - web-certs:/etc/zabbix/web/certs:ro
    networks:
      net:
        ipv4_address: 172.22.239.3
      sql:
      proxy:
    environment:
      - ZBX_SERVER_HOST=zabbix-server
      - DB_SERVER_HOST=zabbix-sql
      - MYSQL_USER=zabbix
      - MYSQL_PASSWORD_FILE=/run/secrets/zabbix-dbpasswd
      - PHP_TZ=Europe/London
      - ZBX_SERVER_NAME=zabbix.[redacted]
      - ZBX_MEMORYLIMIT=256M
      - ZBX_POSTMAXSIZE=64M
      - ZBX_UPLOADMAXFILESIZE=64M
      - 'ZBX_SSO_SETTINGS={ "use_proxy_headers":true, "security":{ "requestedAuthnContext":false } }'
    secrets:
      - zabbix-dbpasswd

  websvc:
    image: zabbix/zabbix-web-service:alpine-6.4-latest
    container_name: zabbix-websvc
    depends_on:
      - server
      - sql
    restart: on-failure
    networks:
      net:
        ipv4_address: 172.22.239.4
      sql:
      proxy:
    environment:
      - ZBX_ALLOWEDIP=172.22.239.2
      - ZBX_TIMEOUT=30
      - ZBX_TLSACCEPT=unencrypted
      - ZBX_IGNOREURLCERTERRORS=1

  sql:
    image: mariadb:10.7
    container_name: zabbix-sql
    environment:
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/root-dbpasswd
      - MYSQL_DATABASE=zabbix
      - MYSQL_USER=zabbix
      - MYSQL_PASSWORD_FILE=/run/secrets/zabbix-dbpasswd
    command: --character-set-server=utf8 --collation-server=utf8_bin
    volumes:
      - sql:/var/lib/mysql
    networks:
      - sql
      - pma
    secrets:
      - root-dbpasswd
      - zabbix-dbpasswd
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-u", "healthcheck"]
      timeout: 20s
      retries: 10

volumes:
  sql:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/docker/volumes/zabbix/zabbix-sql
  conf:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/docker/volumes/zabbix/zabbix-server
  web-certs:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/docker/volumes/zabbix/zabbix-web/certs
  alertscripts:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/docker/volumes/zabbix/zabbix-alertscripts
secrets:
  root-dbpasswd:
    file: ./secrets/root-dbpasswd.secret
  zabbix-dbpasswd:
    file: ./secrets/zabbix-dbpasswd.secret

networks:
  net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.22.239.0/29
  sql:
    driver: bridge
  proxy:
    external: true
    name: shared-proxy
  pma:
    external: true
    name: shared-pma​