docker-compose.yml

# HAProxy Controller - single self-contained service.
#
# One service, one image. HAProxy is compiled from the source vendored in
# third_party/haproxy, so the build pulls nothing from the network, and the
# controller supervises it as a child process at runtime. There is no second
# service, no database container and no init system to add.
#
# Powered by Ebdaa.me - https://ebdaa.me

services:
  haproxy-controller:
    build:
      context: .
      args:
        VERSION: "1.0.0"
    image: haproxy-controller:latest
    container_name: haproxy-controller
    restart: unless-stopped

    ports:
      # Control panel. Bind it to localhost and reach it over a tunnel unless
      # you have enabled TLS and restricted access at the network layer.
      - "0.0.0.0:9000:9000"
      # Traffic ports. These must match the listeners you define in the panel.
      - "8080:80"
      - "8443:443"

    environment:
      HC_LISTEN_PORT: "9000"
      HC_LOG_LEVEL: "info"
      # Uncomment to name the first administrator something other than "admin".
      # HC_ADMIN_USER: "operator"

    volumes:
      # The SQLite database, config versions and backups.
      - controller-data:/var/lib/haproxy-controller
      # The generated haproxy.cfg, certificates and error pages.
      - haproxy-etc:/etc/haproxy
      # The controller's own settings file, including its session secret.
      - controller-conf:/etc/haproxy-controller

    # Binding ports below 1024 is the only elevated capability needed.
    cap_drop: ["ALL"]
    cap_add: ["NET_BIND_SERVICE", "SETUID", "SETGID", "CHOWN", "DAC_OVERRIDE"]
    security_opt: ["no-new-privileges:true"]

    healthcheck:
      test: ["CMD", "/usr/local/bin/haproxy-controller", "-healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

    # HAProxy keeps many sockets open under load.
    ulimits:
      nofile:
        soft: 65535
        hard: 65535

volumes:
  controller-data:
  haproxy-etc:
  controller-conf: