docker-compose-single-traefik.yml

# =============================================================================
# MinIO - Single Server Mode (Traefik Reverse Proxy)
# =============================================================================
# Usage: docker compose -f docker-compose-single-traefik.yml up -d
#
# Prerequisites:
#   - Traefik reverse proxy running on the ${PROXY_NETWORK} network
#   - DNS records pointing to this server:
#     - ${S3_HOSTNAME}         -> S3 API (path-style access)
#     - ${S3_CONSOLE_HOSTNAME} -> Console (admin console)
#
# Features:
#   - HTTPS via Let's Encrypt (automatic certificate management)
#   - S3 path-style access with no-buffering for large uploads
#   - Separate endpoints for S3 API and Console
#   - Admin console with full management UI
#   - Init container for declarative bucket/user setup
#   - Traefik v2 and v3 compatible
#   - IPv6 support
#
# DNS-Style Bucket Access:
#   For virtual-host-style access (e.g., bucket.s3.example.com), uncomment
#   the HostRegexp rules below and configure wildcard certificates or
#   explicit SANs for each bucket hostname.
#
# Access:
#   - S3 API:  https://${S3_HOSTNAME}
#   - Console: https://${S3_CONSOLE_HOSTNAME}
# =============================================================================


### Service Templates ###
x-minio-common: &minio-common
  image: ${MINIO_IMAGE:-ghcr.io/bauer-group/cs-minio/minio}:${MINIO_VERSION:-latest}
  restart: unless-stopped
  logging:
    driver: json-file
    options:
      max-size: "50m"
      max-file: "3"
  command: server --address ":9000" --console-address ":9001" /data
  environment:
    - TZ=${TIME_ZONE:-Etc/UTC}
    - MINIO_ROOT_USER=${MINIO_ROOT_USER:-minioadmin}
    - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:-minioadmin}
    - MINIO_REGION_NAME=${MINIO_REGION:-eu-central-1}
    # Enable virtual-host-style bucket access (bucket.s3.example.com)
    - MINIO_DOMAIN=${S3_HOSTNAME}
    # Disable built-in browser (admin console provides full management UI)
    - MINIO_BROWSER=off
    # ── Prometheus Monitoring (optional) ────────────────────────────
    # Metrics endpoints: /minio/v2/metrics/cluster, /minio/v2/metrics/node
    # Uncomment to allow unauthenticated scraping (default: jwt):
    # - MINIO_PROMETHEUS_AUTH_TYPE=public
  expose:
    - 9000/tcp
    - 9001/tcp
  networks:
    local:


services:
### Application Services ###
  # MinIO S3 Server
  minio-server:
    <<: *minio-common
    container_name: ${STACK_NAME:-s3-app}_SERVER
    hostname: minio-server
    volumes:
      - minio-data:/data
    networks:
      local:
      proxy:
    labels:
      - "traefik.enable=true"

      # ── Middleware: HTTP to HTTPS Redirect ──────────────────────────────
      - "traefik.http.middlewares.${STACK_NAME:-s3-app}-redirect-to-secure.redirectscheme.scheme=https"
      - "traefik.http.middlewares.${STACK_NAME:-s3-app}-redirect-to-secure.redirectscheme.permanent=true"

      # ── Middleware: No Buffering (large S3 uploads) ────────────────────
      - "traefik.http.middlewares.${STACK_NAME:-s3-app}-nobuffer.buffering.maxRequestBodyBytes=0"
      - "traefik.http.middlewares.${STACK_NAME:-s3-app}-nobuffer.buffering.memRequestBodyBytes=0"
      - "traefik.http.middlewares.${STACK_NAME:-s3-app}-nobuffer.buffering.maxResponseBodyBytes=0"
      - "traefik.http.middlewares.${STACK_NAME:-s3-app}-nobuffer.buffering.memResponseBodyBytes=0"

      # ── Router: S3 API - HTTP (redirect to HTTPS) ─────────────────────
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-http.rule=Host(`${S3_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-http.entrypoints=web"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-http.middlewares=${STACK_NAME:-s3-app}-redirect-to-secure"

      # ── Router: S3 API - HTTPS (path-style access) ────────────────────
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3.rule=Host(`${S3_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3.entrypoints=web-secure"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3.tls=true"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3.tls.certresolver=letsencrypt"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3.service=${STACK_NAME:-s3-app}-s3"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-s3.middlewares=${STACK_NAME:-s3-app}-nobuffer"

      # ── Service: S3 API ────────────────────────────────────────────────
      - "traefik.http.services.${STACK_NAME:-s3-app}-s3.loadBalancer.server.port=9000"

      # ── DNS-Style Bucket Access (virtual-host) ─────────────────────────
      # Uncomment if using wildcard certificates or explicit SANs.
      # Requires: MINIO_DOMAIN=${S3_HOSTNAME} (set above in environment)
      #
      # Option A: Wildcard certificate (requires DNS challenge)
      #
      #   Traefik v2 syntax:
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets-http.rule=HostRegexp(`{subdomain:.+}.${S3_HOSTNAME}`)"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets.rule=HostRegexp(`{subdomain:.+}.${S3_HOSTNAME}`)"
      #
      #   Traefik v3 syntax:
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets-http.rule=HostRegexp(`.+\\.${S3_HOSTNAME}`)"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets.rule=HostRegexp(`.+\\.${S3_HOSTNAME}`)"
      #
      #   Common labels (both versions):
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets-http.entrypoints=web"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets-http.middlewares=${STACK_NAME:-s3-app}-redirect-to-secure"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets.entrypoints=web-secure"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets.tls=true"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets.tls.certresolver=letsencrypt"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets.service=${STACK_NAME:-s3-app}-s3"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3-buckets.middlewares=${STACK_NAME:-s3-app}-nobuffer"
      #
      # Option B: Explicit SANs (Let's Encrypt HTTP challenge, max 100 per cert)
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3.tls.domains[0].main=${S3_HOSTNAME}"
      # - "traefik.http.routers.${STACK_NAME:-s3-app}-s3.tls.domains[0].sans=${S3_BUCKET_SANS}"


### Admin Console ###
  admin-console:
    image: ${CONSOLE_IMAGE:-ghcr.io/bauer-group/cs-minio/minio-console}:${CONSOLE_VERSION:-latest}
    container_name: ${STACK_NAME:-s3-app}_CONSOLE
    hostname: admin-console
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    environment:
      - TZ=${TIME_ZONE:-Etc/UTC}
      - CONSOLE_MINIO_SERVER=http://minio-server:9000
      - CONSOLE_MINIO_REGION=${MINIO_REGION:-eu-central-1}
    expose:
      - 9090/tcp
    depends_on:
      minio-server:
        condition: service_healthy
    networks:
      local:
      proxy:
    labels:
      - "traefik.enable=true"

      # ── Router: Console - HTTP (redirect to HTTPS) ─────────────────────
      - "traefik.http.routers.${STACK_NAME:-s3-app}-console-http.rule=Host(`${S3_CONSOLE_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-console-http.entrypoints=web"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-console-http.middlewares=${STACK_NAME:-s3-app}-redirect-to-secure"

      # ── Router: Console - HTTPS ────────────────────────────────────────
      - "traefik.http.routers.${STACK_NAME:-s3-app}-console.rule=Host(`${S3_CONSOLE_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-console.entrypoints=web-secure"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-console.tls=true"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-console.tls.certresolver=letsencrypt"
      - "traefik.http.routers.${STACK_NAME:-s3-app}-console.service=${STACK_NAME:-s3-app}-console"

      # ── Service: Console ───────────────────────────────────────────────
      - "traefik.http.services.${STACK_NAME:-s3-app}-console.loadBalancer.server.port=9090"


### Initialization ###
  # MinIO Init Container (runs on every start, idempotent)
  minio-init:
    image: ${MINIO_INIT_IMAGE:-ghcr.io/bauer-group/cs-minio/minio-init}:${MINIO_INIT_VERSION:-latest}
    container_name: ${STACK_NAME:-s3-app}_INIT
    restart: "no"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "1"
    environment:
      - TZ=${TIME_ZONE:-Etc/UTC}
      - MINIO_ENDPOINT=http://minio-server:9000
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-minioadmin}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:-minioadmin}
      - MINIO_WAIT_TIMEOUT=${MINIO_WAIT_TIMEOUT:-60}
      # Pass through environment variables used in config JSON files
      - CONSOLE_USER=${CONSOLE_USER:-console-admin}
      - CONSOLE_PASSWORD=${CONSOLE_PASSWORD:-console-admin}
    volumes:
      # Optional: mount custom initialization config (see config/minio-init.example.json)
      # - ${MINIO_INIT_CONFIG:-./config/minio-init.json}:/app/config/init.json:ro
      - minio-credentials:/data/credentials
    depends_on:
      minio-server:
        condition: service_healthy
    networks:
      local:


### Volumes ###
volumes:
  minio-data:
    driver: local
    name: ${STACK_NAME:-s3-app}-data
  minio-credentials:
    driver: local
    name: ${STACK_NAME:-s3-app}-credentials


### Networks ###
networks:
  local:
    driver: bridge
    name: ${STACK_NAME:-s3-app}
    enable_ipv6: true

  proxy:
    name: ${PROXY_NETWORK:-EDGEPROXY}
    external: true