services:
  gitlab:
    image: gitlab/gitlab-ce:latest
    restart: unless-stopped
    hostname: gitlab
    container_name: gitlab
    ports:
      - 22:22
    healthcheck:
      disable: true
    #environment:
      #GITLAB_OMNIBUS_CONFIG: |
      #  from_file "/etc/gitlab/gitlab_omnibus_config.rb"
      #GITLAB_ROOT_PASSWORD: "password"
      #GITLAB_SKIP_UNMIGRATED_DATA_CHECK: true
    volumes:
      - ${STORAGE}/${ROUTER}/gitlab.rb:/etc/gitlab/gitlab.rb
      - ${STORAGE}/${ROUTER}/host.cert:/etc/gitlab/ssl/pages.${DOMAIN}.de.crt
      - ${STORAGE}/${ROUTER}/host.key:/etc/gitlab/ssl/pages.${DOMAIN}.de.key
      - gitlab_config:/etc/gitlab
      - gitlab_logs:/var/log/gitlab
      #- gitlab_data:/var/opt/gitlab
      - /home/container/gitlab-data:/var/opt/gitlab
      - /etc/localtime:/etc/localtime:ro
      - /home/container/gitlab-data:/import
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.${ROUTER}_${SERVICE1}.rule=Host(`${SERVICE1}.${DOMAIN}`)"
      - "traefik.http.routers.${ROUTER}_${SERVICE1}.entrypoints=websecure"
      - "traefik.http.routers.${ROUTER}_${SERVICE1}.service=${ROUTER}_${SERVICE1}_svc"
      - "traefik.http.routers.${ROUTER}_${SERVICE1}.tls=true"
      - "traefik.http.routers.${ROUTER}_${SERVICE1}.tls.certResolver=scow"
      - "traefik.http.services.${ROUTER}_${SERVICE1}_svc.loadbalancer.server.port=80"

      - "traefik.http.routers.${ROUTER}_${SERVICE2}.rule=Host(`${SERVICE2}.${DOMAIN}`)"
      - "traefik.http.routers.${ROUTER}_${SERVICE2}.entrypoints=websecure"
      - "traefik.http.routers.${ROUTER}_${SERVICE2}.service=${ROUTER}_${SERVICE2}_svc"
      - "traefik.http.routers.${ROUTER}_${SERVICE2}.tls=true"
      - "traefik.http.routers.${ROUTER}_${SERVICE2}.tls.certResolver=scow"
      - "traefik.http.services.${ROUTER}_${SERVICE2}_svc.loadbalancer.server.port=81"

      - "traefik.http.routers.pages.rule=Host(`${SERVICE3}.${DOMAIN}`)"
      - "traefik.http.routers.pages.entrypoints=websecure"
      - "traefik.http.routers.pages.service=pages"
      - "traefik.http.routers.pages.tls.certresolver=scow"
      - "traefik.http.routers.pages.tls.domains[0].main=${SERVICE1}.${DOMAIN}"
      - "traefik.http.routers.pages.tls.domains[0].sans=*.${SERVICE1}.${DOMAIN}"
      - "traefik.http.routers.pages.tls.domains[0].sans=*.${SERVICE3}.${DOMAIN}"

      - "traefik.http.services.pages.loadbalancer.server.port=5202"
      - "traefik.http.services.pages.loadbalancer.server.scheme=https"
      - "traefik.http.services.pages.loadbalancer.passhostheader=true"

      - "traefik.http.middlewares.pages-redirectscheme.redirectscheme.scheme=https"
      - "traefik.http.middlewares.pages-redirectscheme.redirectscheme.permanent=false"

      - "traefik.http.routers.pages-wildcard.rule=HostRegexp(`${SERVICE3}.${DOMAIN}`) || HostRegexp(`{sub:[a-zA-Z0-9-]+}.${SERVICE3}.${DOMAIN}`)"
      - "traefik.http.routers.pages-wildcard.entrypoints=websecure"
      - "traefik.http.routers.pages-wildcard.service=pages-wildcard"
      - "traefik.http.routers.pages-wildcard.middlewares=pages-wildcard-redirectscheme"
      - "traefik.http.routers.pages-wildcard.tls.certresolver=scow"
      - "traefik.http.routers.pages-wildcard.tls.domains[0].main=${SERVICE1}.${DOMAIN}"
      - "traefik.http.routers.pages-wildcard.tls.domains[0].sans=*.${SERVICE1}.${DOMAIN}"
      - "traefik.http.routers.pages-wildcard.tls.domains[0].sans=*.${SERVICE3}.${DOMAIN}"
      - "traefik.http.services.pages-wildcard.loadbalancer.server.port=5202" #5100
      - "traefik.http.services.pages-wildcard.loadbalancer.passhostheader=true"
      - "traefik.http.services.pages-wildcard.loadbalancer.server.scheme=https"

      - "traefik.http.middlewares.pages-wildcard-redirectscheme.redirectscheme.scheme=https"
      - "traefik.http.middlewares.pages-wildcard-redirectscheme.redirectscheme.permanent=false"

      - "traefik.docker.network=proxy"

      - "com.centurylinklabs.watchtower.enable=true"
    networks:
      - proxy
      - db

volumes:
  gitlab_config:
  gitlab_logs:
  gitlab_data:
networks:
  proxy:
    external: true
  db:
    external: true