msys2-main-server/docker-compose.yml

name: 'msys2-repo'

x-logging:
  &default-logging
  driver: 'journald'

services:
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:v0.5.0
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      - CONTAINERS=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - docker-socket-proxy
    restart: unless-stopped

  traefik:
    image: traefik:v3.7
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    depends_on:
      - docker-socket-proxy
    command:
      # - "--api.insecure=true" # for debug interface on 8080
      # - "--log.level=INFO"
      - "--providers.docker=true"
      - "--providers.docker.endpoint=tcp://docker-socket-proxy:2375"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.file.directory=/configs/"
      - "--entrypoints.rsync.address=:873"
      - "--entryPoints.rsync.transport.respondingTimeouts.readTimeout=0"
      - "--entrypoints.rsync-ssl.address=:874"
      - "--entryPoints.rsync-ssl.transport.respondingTimeouts.readTimeout=0"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.web-secure.address=:443"
      - "--certificatesResolvers.le.acme.email=david.macek.0@gmail.com"
      - "--certificatesResolvers.le.acme.storage=/letsencrypt/acme.json"
      - "--certificatesResolvers.le.acme.keyType=EC256"
      - "--certificatesResolvers.le.acme.httpChallenge=true"
      - "--certificatesResolvers.le.acme.httpChallenge.entryPoint=web"
      - "--entrypoints.web-secure.http3"
      # Access logs: Which request+status from which IP using which User-Agent?
      - "--accesslog=true"
      - "--accesslog.bufferingsize=100"
      - "--accesslog.format=json"
      - "--accesslog.fields.defaultmode=drop"
      - "--accesslog.fields.names.RequestHost=keep"
      - "--accesslog.fields.names.RequestMethod=keep"
      - "--accesslog.fields.names.RequestPath=keep"
      - "--accesslog.fields.names.RequestPort=keep"
      - "--accesslog.fields.names.RequestProtocol=keep"
      - "--accesslog.fields.names.ClientHost=keep"
      - "--accesslog.fields.names.DownstreamStatus=keep"
      - "--accesslog.fields.headers.defaultmode=drop"
      - "--accesslog.fields.headers.names.User-Agent=keep"
    logging: *default-logging
    ports:
      - "80:80"
      - "443:443/tcp"
      - "443:443/udp"
      - "873:873"
      - "874:874"
      # - "8080:8080" # for debug interface on 8080
    volumes:
      - ./services/traefik/traefik-tls.yml:/configs/traefik-tls.yml:ro
      - letsencrypt:/letsencrypt/
    networks:
      - default
      - docker-socket-proxy
      - rsync
      - mirrorbits
      - stagingrepo
      - repo
      - packages
      - stats
      - redir
      - mingw-w64-redir
    restart: unless-stopped

  stats:
    build: ./services/stats
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - SETGID
      - SETUID
    networks:
      - stats
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.stats.loadbalancer.server.port=80"
      - "traefik.docker.network=msys2-repo_stats"
      - "traefik.http.middlewares.stats-strip.stripprefix.prefixes=/stats"
      - "traefik.http.middlewares.stats-slash-redir.redirectregex.regex=^http(s?)://([^/]*)/stats($$|[?].*)"
      - "traefik.http.middlewares.stats-slash-redir.redirectregex.replacement=http$${1}://$${2}/stats/$${3}"
      - "traefik.http.middlewares.stats-scheme-redir.redirectscheme.scheme=https"
      - "traefik.http.middlewares.stats-headers.headers.stsseconds=31536000"
      # http
      - "traefik.http.routers.stats.rule=Host(`repo.msys2.org`) && (Path(`/stats`) || PathPrefix(`/stats/`))"
      - "traefik.http.routers.stats.middlewares=stats-scheme-redir,stats-slash-redir,stats-strip"
      - "traefik.http.routers.stats.entrypoints=web"
      # https
      - "traefik.http.routers.stats-secure.rule=Host(`repo.msys2.org`) && (Path(`/stats`) || PathPrefix(`/stats/`))"
      - "traefik.http.routers.stats-secure.tls=true"
      - "traefik.http.routers.stats-secure.tls.certresolver=le"
      - "traefik.http.routers.stats-secure.middlewares=stats-headers,stats-slash-redir,stats-strip"
      - "traefik.http.routers.stats-secure.entrypoints=web-secure"
    volumes:
      - /var/lib/vnstat/:/var/lib/vnstat/:ro
      - /usr/bin/vnstat:/usr/bin/vnstat:ro
    restart: unless-stopped

  packages:
    image: ghcr.io/msys2/msys2-web:latest
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    networks:
      - packages
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=msys2-repo_packages"
      - "traefik.http.middlewares.packages-compress.compress=true"
      - "traefik.http.middlewares.packages-scheme-redir.redirectscheme.scheme=https"
      - "traefik.http.middlewares.packages-headers.headers.stsseconds=31536000"
      # http
      - "traefik.http.routers.packages.rule=Host(`packages.msys2.org`)"
      - "traefik.http.routers.packages.middlewares=packages-scheme-redir,packages-compress"
      - "traefik.http.routers.packages.entrypoints=web"
      # https
      - "traefik.http.routers.packages-secure.rule=Host(`packages.msys2.org`)"
      - "traefik.http.routers.packages-secure.tls=true"
      - "traefik.http.routers.packages-secure.tls.certresolver=le"
      - "traefik.http.routers.packages-secure.middlewares=packages-headers,packages-compress"
      - "traefik.http.routers.packages-secure.entrypoints=web-secure"
    environment:
      - FORWARDED_ALLOW_IPS=*
    restart: unless-stopped

  redir:
    image: nginx:1.30
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - SETGID
      - SETUID
    networks:
      - redir
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.redir.loadbalancer.server.port=80"
      - "traefik.docker.network=msys2-repo_redir"
      - "traefik.http.middlewares.homepage-redir.redirectregex.regex=^http(s?)://(?:www[.])?msys2[.](?:org|com|net)/(.*)$$"
      - "traefik.http.middlewares.homepage-redir.redirectregex.replacement=http$${1}://www.msys2.org/$${2}"
      - "traefik.http.middlewares.homepage-headers.headers.stsseconds=31536000"
      # http
      - "traefik.http.routers.homepage.rule=Host(`msys2.org`) || Host(`msys2.com`) || Host(`www.msys2.com`) || Host(`msys2.net`) || Host(`www.msys2.net`)"
      - "traefik.http.routers.homepage.middlewares=homepage-redir"
      - "traefik.http.routers.homepage.entrypoints=web"
      # https
      - "traefik.http.routers.homepage-secure.rule=Host(`msys2.org`) || Host(`msys2.com`) || Host(`www.msys2.com`) || Host(`msys2.net`) || Host(`www.msys2.net`)"
      - "traefik.http.routers.homepage-secure.tls=true"
      - "traefik.http.routers.homepage-secure.tls.certresolver=le"
      - "traefik.http.routers.homepage-secure.middlewares=homepage-headers,homepage-redir"
      - "traefik.http.routers.homepage-secure.entrypoints=web-secure"
    restart: unless-stopped

  mingw-w64-redir:
    image: nginx:1.30
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - SETGID
      - SETUID
    networks:
      - mingw-w64-redir
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.mingw-w64-redir.loadbalancer.server.port=80"
      - "traefik.docker.network=msys2-repo_mingw-w64-redir"
      - "traefik.http.middlewares.mingw-w64-redir.redirectregex.regex=^http(s?)://(?:www[.])?mingw-w64[.](?:org|net)/(.*)$$"
      - "traefik.http.middlewares.mingw-w64-redir.redirectregex.replacement=http$${1}://www.mingw-w64.org/$${2}"
      - "traefik.http.middlewares.mingw-w64-headers.headers.stsseconds=31536000"
      # http
      - "traefik.http.routers.mingw-w64.rule=Host(`mingw-w64.org`) || Host(`mingw-w64.net`) || Host(`www.mingw-w64.net`)"
      - "traefik.http.routers.mingw-w64.middlewares=mingw-w64-redir"
      - "traefik.http.routers.mingw-w64.entrypoints=web"
      # https
      - "traefik.http.routers.mingw-w64-secure.rule=Host(`mingw-w64.org`) || Host(`mingw-w64.net`) || Host(`www.mingw-w64.net`)"
      - "traefik.http.routers.mingw-w64-secure.tls=true"
      - "traefik.http.routers.mingw-w64-secure.tls.certresolver=le"
      - "traefik.http.routers.mingw-w64-secure.middlewares=mingw-w64-headers,mingw-w64-redir"
      - "traefik.http.routers.mingw-w64-secure.entrypoints=web-secure"
    restart: unless-stopped

  repo:
    image: nginx:1.30
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - SETGID
      - SETUID
    networks:
      - repo
    volumes:
      - /srv/msys2repo/:/usr/share/nginx/html/:ro
      - ./services/repo/nginx.conf:/etc/nginx/conf.d/repo.conf:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.repo.loadbalancer.server.port=80"
      - "traefik.docker.network=msys2-repo_repo"
      - "traefik.http.middlewares.repo-scheme-redir.redirectscheme.scheme=https"
      - "traefik.http.middlewares.repo-headers.headers.stsseconds=31536000"
      - "traefik.http.middlewares.repo-legacy-mingw32-redir.redirectregex.regex=^http(s?)://([^/]*)/mingw/i686($$|/.*)"
      - "traefik.http.middlewares.repo-legacy-mingw32-redir.redirectregex.replacement=http$${1}://$${2}/mingw/mingw32$${3}"
      - "traefik.http.middlewares.repo-legacy-mingw64-redir.redirectregex.regex=^http(s?)://([^/]*)/mingw/x86_64($$|/.*)"
      - "traefik.http.middlewares.repo-legacy-mingw64-redir.redirectregex.replacement=http$${1}://$${2}/mingw/mingw64$${3}"
      # http
      - "traefik.http.routers.repo.rule=Host(`repo.msys2.org`)"
      - "traefik.http.routers.repo.middlewares=repo-scheme-redir"
      - "traefik.http.routers.repo.entrypoints=web"
      # https
      - "traefik.http.routers.repo-secure.rule=Host(`repo.msys2.org`)"
      - "traefik.http.routers.repo-secure.tls=true"
      - "traefik.http.routers.repo-secure.tls.certresolver=le"
      - "traefik.http.routers.repo-secure.middlewares=repo-headers,repo-legacy-mingw32-redir,repo-legacy-mingw64-redir"
      - "traefik.http.routers.repo-secure.entrypoints=web-secure"
    restart: unless-stopped

  staging:
    build: ./services/staging/
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - staging
    volumes:
      - staging-gnupg:/root/.gnupg/
      - staging-repos:/srv/msys2staging/
    env_file:
      - ./github_token.env
    restart: unless-stopped

  stagingrepo:
    image: nginx:1.30
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - SETGID
      - SETUID
    networks:
      - stagingrepo
    volumes:
      - staging-repos:/usr/share/nginx/html/:ro
      - ./services/stagingrepo/nginx.conf:/etc/nginx/conf.d/repo.conf:ro
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=msys2-repo_stagingrepo"
      - "traefik.http.services.stagingrepo.loadbalancer.server.port=80"
      - "traefik.http.middlewares.staging-strip.stripprefix.prefixes=/staging"
      - "traefik.http.middlewares.staging-slash-redir.redirectregex.regex=^http(s?)://([^/]*)/staging($$|[?].*)"
      - "traefik.http.middlewares.staging-slash-redir.redirectregex.replacement=http$${1}://$${2}/staging/$${3}"
      - "traefik.http.middlewares.staging-scheme-redir.redirectscheme.scheme=https"
      - "traefik.http.middlewares.staging-headers.headers.stsseconds=31536000"
      # http
      - "traefik.http.routers.staging.rule=Host(`repo.msys2.org`) && (Path(`/staging`) || PathPrefix(`/staging/`))"
      - "traefik.http.routers.staging.middlewares=staging-scheme-redir,staging-slash-redir,staging-strip"
      - "traefik.http.routers.staging.entrypoints=web"
      # https
      - "traefik.http.routers.staging-secure.rule=Host(`repo.msys2.org`) && (Path(`/staging`) || PathPrefix(`/staging/`))"
      - "traefik.http.routers.staging-secure.tls=true"
      - "traefik.http.routers.staging-secure.tls.certresolver=le"
      - "traefik.http.routers.staging-secure.middlewares=staging-headers,staging-slash-redir,staging-strip"
      - "traefik.http.routers.staging-secure.entrypoints=web-secure"
    restart: unless-stopped

  rsync:
    build: ./services/rsync/
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    volumes:
      - /srv/msys2repo/:/rsync-volume/:ro
      - ./services/rsync/rsyncd.conf:/etc/rsyncd.conf:ro
    networks:
      - rsync
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=msys2-repo_rsync"
      - "traefik.tcp.routers.rsync.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.rsync.entrypoints=rsync"
      - "traefik.tcp.routers.rsync-ssl.rule=HostSNI(`repo.msys2.org`)"
      - "traefik.tcp.routers.rsync-ssl.entrypoints=rsync-ssl"
      - "traefik.tcp.routers.rsync-ssl.tls=true"
      - "traefik.tcp.routers.rsync-ssl.tls.certresolver=le"
      - "traefik.tcp.services.rsync.loadbalancer.server.port=873"
      - "traefik.tcp.services.rsync.loadbalancer.proxyprotocol.version=2"
    restart: unless-stopped

  valkey:
    image: valkey/valkey:9.1
    user: "999:999"
    restart: unless-stopped
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - mirrorbits-valkey
    environment:
      - VALKEY_EXTRA_FLAGS=--save 3600 1 --loglevel warning
    volumes:
      - valkey-data:/data

  geoipupdate:
    image: ghcr.io/maxmind/geoipupdate:v7.1
    restart: unless-stopped
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - geoipupdate
    env_file:
      - ./geoip.env
    environment:
      - GEOIPUPDATE_EDITION_IDS=GeoLite2-City GeoLite2-ASN
      - GEOIPUPDATE_FREQUENCY=24
      - GEOIPUPDATE_VERBOSE=1
    volumes:
      - geoip-data:/usr/share/GeoIP

  cron:
    build: ./services/cron
    restart: unless-stopped
    network_mode: "none"
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    volumes:
      - /srv/msys2repo:/repo-volume

  mirrorbits:
    build: ./services/mirrorbits
    restart: unless-stopped
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    depends_on:
      - valkey
      - geoipupdate
    networks:
      - mirrorbits
      - mirrorbits-valkey
    volumes:
      - geoip-data:/usr/share/GeoIP:ro
      - /srv/msys2repo:/repo-volume:ro
      - ./services/mirrorbits/mirrorbits.conf:/etc/mirrorbits.conf:ro
      - ./services/mirrorbits/add_mirrors.sh:/add_mirrors.sh:ro
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=msys2-repo_mirrorbits"
      - "traefik.http.middlewares.mirrorbits-scheme-redir.redirectscheme.scheme=https"
      - "traefik.http.middlewares.mirrorbits-headers.headers.stsseconds=31536000"
      - "traefik.http.middlewares.mirrorbits-legacy-mingw32-redir.redirectregex.regex=^http(s?)://([^/]*)/mingw/i686($$|/.*)"
      - "traefik.http.middlewares.mirrorbits-legacy-mingw32-redir.redirectregex.replacement=http$${1}://$${2}/mingw/mingw32$${3}"
      - "traefik.http.middlewares.mirrorbits-legacy-mingw64-redir.redirectregex.regex=^http(s?)://([^/]*)/mingw/x86_64($$|/.*)"
      - "traefik.http.middlewares.mirrorbits-legacy-mingw64-redir.redirectregex.replacement=http$${1}://$${2}/mingw/mingw64$${3}"
      # http
      - "traefik.http.routers.mirrorbits.rule=Host(`mirror.msys2.org`)"
      - "traefik.http.routers.mirrorbits.entrypoints=web"
      - "traefik.http.routers.mirrorbits.middlewares=mirrorbits-scheme-redir"
      # https
      - "traefik.http.routers.mirrorbits-secure.rule=Host(`mirror.msys2.org`)"
      - "traefik.http.routers.mirrorbits-secure.tls=true"
      - "traefik.http.routers.mirrorbits-secure.tls.certresolver=le"
      - "traefik.http.routers.mirrorbits-secure.middlewares=mirrorbits-headers,mirrorbits-legacy-mingw32-redir,mirrorbits-legacy-mingw64-redir"
      - "traefik.http.routers.mirrorbits-secure.entrypoints=web-secure"

  autobuild-controller:
    image: ghcr.io/msys2/msys2-autobuild-controller:latest
    restart: unless-stopped
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    volumes:
      - ./services/autobuild-controller:/app/instance:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.autobuild-controller-scheme-redir.redirectscheme.scheme=https"
      - "traefik.http.middlewares.autobuild-controller-headers.headers.stsseconds=31536000"
      # http
      - "traefik.http.routers.autobuild-controller.rule=Host(`autobuildcontroller.msys2.org`)"
      - "traefik.http.routers.autobuild-controller.entrypoints=web"
      - "traefik.http.routers.autobuild-controller.middlewares=autobuild-controller-scheme-redir"
      # https
      - "traefik.http.routers.autobuild-controller-secure.rule=Host(`autobuildcontroller.msys2.org`)"
      - "traefik.http.routers.autobuild-controller-secure.tls=true"
      - "traefik.http.routers.autobuild-controller-secure.tls.certresolver=le"
      - "traefik.http.routers.autobuild-controller-secure.middlewares=autobuild-controller-headers"
      - "traefik.http.routers.autobuild-controller-secure.entrypoints=web-secure"
    environment:
      - FORWARDED_ALLOW_IPS=*

  imbridge:
    image: 42wim/matterbridge:1
    restart: unless-stopped
    logging: *default-logging
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - imbridge
    env_file:
      - ./imbridge.env
    volumes:
      - ./services/imbridge/matterbridge.toml:/etc/matterbridge/matterbridge.toml:ro

volumes:
  letsencrypt:
  staging-gnupg:
  staging-repos:
  geoip-data:
  valkey-data:

networks:
  default:
  docker-socket-proxy:
    internal: true
  rsync:
    internal: true
  mirrorbits:
  mirrorbits-valkey:
    internal: true
  geoipupdate:
  stagingrepo:
    internal: true
  staging:
  repo:
    internal: true
  packages:
  stats:
    internal: true
  imbridge:
  redir:
    internal: true
  mingw-w64-redir:
    internal: true