docker-compose.yml

services:
  db:
    image: mysql:8.0
    command: --default-authentication-plugin=caching_sha2_password --expire_logs_days=3 --secure-file-priv=""
    cap_add:
      - SYS_NICE  # CAP_SYS_NICE, fix error mbind: Operation not permitted
    restart: always
    environment:
      - MYSQL_ROOT_HOST=%
      - MYSQL_ROOT_PASSWORD=${MYSQL_PASSWORD:-mediawiki}
      - MYSQL_DATABASE=mediawiki
    volumes:
      - ./_initdb:/docker-entrypoint-initdb.d
      - db_data:/var/lib/mysql

  web:
    image: ghcr.io/wikiteq/taqasta:1.35.14-20260304-3381fa4
    extra_hosts:
      - "gateway.docker.internal:host-gateway"
    restart: always
    depends_on:
      - db
      - elasticsearch
      - redis
    environment:
      # Sourced from .env
      - MW_SITE_SERVER=${MW_SITE_SERVER:-http://localhost}
      - PHP_UPLOAD_MAX_FILESIZE=${PHP_UPLOAD_MAX_FILESIZE:-10M}
      - PHP_POST_MAX_SIZE=${PHP_UPLOAD_MAX_FILESIZE:-10M}
      - MW_SENTRY_DSN
      - MW_ENABLE_SITEMAP_GENERATOR=${MW_ENABLE_SITEMAP_GENERATOR:-true}
      - ESIP_TEST_WIKI # set 'true' for test wiki
      - MW_DB_NAME=mediawiki
      - MW_DB_USER=root
      - MW_DB_PASS=${MYSQL_PASSWORD:-mediawiki}
      - MW_PROXY_SERVERS=varnish:80
    volumes:
      - ./_logs/apache2:/var/log/apache2
      - web_data:/mediawiki
      - images:/mediawiki/images
      - ./extensions/DiscussionThreading:/var/www/mediawiki/w/extensions/DiscussionThreading
      - ./extensions/GoogleDocTag:/var/www/mediawiki/w/extensions/GoogleDocTag
      - ./extensions/PageSchemas:/var/www/mediawiki/w/extensions/PageSchemas
      - ./extensions/RSS:/var/www/mediawiki/w/extensions/RSS
      - ./extensions/WikiWorks:/var/www/mediawiki/w/extensions/WikiWorks
      - ./extensions/Realnames:/var/www/mediawiki/w/extensions/Realnames
      # Settings
      - ./config:/var/www/mediawiki/w/_settings
      - ./_resources/favicon:/var/www/mediawiki/favicon
      - ./_resources/robots.txt:/var/www/mediawiki/robots.txt
      - ./_resources/googlef2273af339547660.html:/var/www/mediawiki/googlef2273af339547660.html
      - ./_resources/ESIP-logo-new.png:/var/www/mediawiki/w/ESIP-logo-new-small.png
      - ./_resources/.htaccess:/var/www/mediawiki/.htaccess
      - ./_resources/symlink:/var/www/mediawiki/test # for test wiki

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.8.22
    restart: always
    environment:
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms${ES_MEMORY_MIN:-512m} -Xmx${ES_MEMORY_MAX:-512m}"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data

  varnish:
    image: pastakhov/varnish:7.0
    restart: always
    ports:
      - "${PORT:-127.0.0.1:8081}:80"
    links:
      - web
    tmpfs:
      - /var/lib/varnish:exec
    environment:
      - VARNISH_SIZE=${VARNISH_SIZE:-10G}
      - VARNISH_STORAGE_KIND=file
    volumes:
      - ./_resources/varnish:/etc/varnish/
      - varnish_data:/data

  redis:
    image: "redis:7.4.0-alpine3.20"
    restart: always
    command: "redis-server --maxmemory ${REDIS_MAX_MEMORY:-96mb} --maxmemory-policy allkeys-lru"
    volumes:
      - redis_data:/data

  restic:
    image: ghcr.io/wikiteq/restic-backup-docker:stream
    profiles:
      - production
    restart: always
    links:
      - db
    environment:
      - MW_DB_USER=root
      - MW_DB_PASS=${MYSQL_PASSWORD:-mediawiki}
      - MW_DB_NAME=${MW_DB_NAME:-mediawiki}
      - RESTIC_PASSWORD=${MW_RESTIC_PASSWORD:-rest1cpassw0rd}
      - RESTIC_TAG=${MW_RESTIC_TAG:-backup_full}
      - BACKUP_CRON=${MW_RESTIC_BACKUP_CRON:-0 1 * * *}
      - CHECK_CRON=${MW_RESTIC_CHECK_CRON:-0 23 * * 3}
      - RESTIC_FORGET_ARGS=${MW_RESTIC_FORGET_ARGS:---prune --keep-weekly 4 --keep-monthly 12 --keep-yearly 1 --group-by paths}
      # pre-backup script
      # note: this is a STREAM mode backup, so on the pre-script we have to create a database archive first
      - RESTIC_PRE_BACKUP=if [ ! -d "/data" ]; then mkdir /data; fi && mysqldump -hdb -u$$MW_DB_USER -p$$MW_DB_PASS $$MW_DB_NAME | gzip -c > /data/database.sql.gz
      # post-backup script
      - RESTIC_POST_BACKUP=rm /data/database.sql.gz
      - RESTIC_STREAM=yes
      - RESTIC_STREAM_CMD=tar -cf - -C /data_mediawiki/ /data/database.sql.gz images
      - RESTIC_STREAM_FILENAME=full.images.database.tar
    volumes:
      # read-only mount of mediawiki data directory for images access
      - images:/data_mediawiki/images:ro
      # restic repository mount
      - restic_data:/mnt/restic
      # logs
      - ./_logs/restic:/var/log

volumes:
  db_data:
  elasticsearch_data:
  varnish_data:
  redis_data:
  web_data:
  images:
  restic_data: