docker-compose.yaml

# A number of environment variables must be defined for this Compose file to be
# useful.  Here's the list:
#
# BOOKSTACK_TZ: The Olson time zone name for your local time zone.
#
# BOOKSTACK_URL: The URL to your Bookstack install.
#   It must be an HTTPS URL, and must _not_ contain any forward-slashes.
#   This will also be used as your Bookstack's SAML SP entityID.
#
# BOOKSTACK_AUTH_METHOD: This can be "standard" or "saml2".
#   It's suggested to start out as "standard", and make sure you can log in.
#   Then, switch to "saml2" and log in as yourself.
#   Next, switch back to "standard", log in as the admin, and give your SAML
#   identity admin rights.
#   Finally, switch back to "saml2" and use Bookstack!
#
# BOOKSTACK_SAML_IDP_NAME: Set this to the name of your SAML Login method.
#   Example: Stanford Login
#
# BOOKSTACK_SAML_IDP_ENTITYID: Set this to the URL of your SAML IdP's Metadata.
#   Example: https://login.stanford.edu/metadata.xml
#
# BOOKSTACK_SECRET_DB_BOOKSTACK_PASSWORD: Set this to the path of a file.
#   This will contain the password for the Bookstack DB account.
#   This is _not_ the MariaDB root password.
#
# BOOKSTACK_SECRET_DB_ROOT_PASSWORD: Set this to the path of a file.
#   This will contain the password for the MariaDB root account.
#
# BOOKSTACK_SECRET_RESTIC_GOOGLE_CREDENTIALS: Set this to the path of a JSON file.
#   This will contain the credentials for the Google Cloud service account used
#   to access the Restic repository.
#
# BOOKSTACK_SECRET_RESTIC_PASSWORD: Set this to the path of a file.
#   This will contain the password used to encrypt all of the data in the
#   Restic repository.
#   WARNING: Chaning or deleting this will destroy all of the data in the
#   Restic (backup) repository!
#
# BOOKSTACK_SECRET_SAML_CERT: Set this to the path of a file.
#   This will contain the PEM-encoded X.509 self-signed SAML SP cert.
#
# BOOKSTACK_SECRET_SAML_KEY: Set this to the path of a file.
#   This will contain the PEM-encoded RSA key for the SAML SP.
#   Do not encrypt the key file.
#
# GOOGLE_PROJECT_ID: Set this to a Google Cloud project ID.
#   This Google Cloud project will be used to store backups.
#
# GOOGLE_RESTIC_BUCKET: Set this to a Google Cloud Storage bucket name.
#   Backups will be stored in this bucket.
#
# LETS_ENCRYPT_CONTACT: Set this to an email address.
#   This email will receive important notifications from Let's Encrypt.
#
# LETS_ENCRYPT_TOS_AGREE: Set this to the word "yes".
#   This indicates acceptance of the Let's Encrypt Terms of Service.
#
# LETS_ENCRYPT_STAGING: Optional.  If you set it, set it to a non-empty string.
#   This tells Certbot to use the Let's Encrypt staging environment.
#
# MAIL_FROM: 

version: "2"

networks:
  # The front-end network is used for web access
  front:
    name: bookstack-frontend

  # The back-end network is used for app-DB communication
  back:
    name: bookstack-backend
    internal: true

secrets:
  db-bookstack-password:
    file: "${BOOKSTACK_SECRET_DB_BOOKSTACK_PASSWORD}"

  db-root-password:
    file: "${BOOKSTACK_SECRET_DB_ROOT_PASSWORD}"

  restic-gcp:
    file: "${BOOKSTACK_SECRET_RESTIC_GOOGLE_CREDENTIALS}"

  restic-password:
    file: "${BOOKSTACK_SECRET_RESTIC_PASSWORD}"

  saml-cert:
    file: "${BOOKSTACK_SECRET_SAML_CERT}"

  saml-key:
    file: "${BOOKSTACK_SECRET_SAML_KEY}"


volumes:
  bookstack-data:
    name: bookstack-data

  db-data:
    name: bookstack-db


services:
  app:
    container_name: bookstack-app
    image: ghcr.io/stanford-rc/docker-bookstack-certbot:main
    depends_on:
      - db
    restart: unless-stopped
    
    secrets: 
      - db-bookstack-password
      - saml-cert
      - saml-key

    environment:
      # Application information
      APP_URL: "${BOOKSTACK_URL}"
      APP_DEBUG: "${BOOKSTACK_DEBUG-}"
      TZ: "${BOOKSTACK_TZ}"
      STORAGE_TYPE: "local_secure"
      LETS_ENCRYPT_TOS_AGREE: "${LETS_ENCRYPT_TOS_AGREE}"
      LETS_ENCRYPT_CONTACT: "${LETS_ENCRYPT_CONTACT}"
      LETS_ENCRYPT_STAGING: "${LETS_ENCRYPT_STAGING-}"

      # DB connection information
      DB_HOST: "bookstack-db"
      DB_PORT: 3306
      DB_USER: "bookstack"
      FILE__DB_PASS: "/run/secrets/db-bookstack-password"
      DB_DATABASE: "bookstack"

      # SAML general configuration
      AUTH_METHOD: "${BOOKSTACK_AUTH_METHOD}"
      SAML2_AUTOLOAD_METADATA: "true"
      SAML2_NAME: "${BOOKSTACK_SAML_IDP_NAME}"
      SAML2_IDP_ENTITYID: "${BOOKSTACK_SAML_IDP_ENTITYID}"
      SAML2_USER_TO_GROUPS: "true"
      SAML2_REMOVE_FROM_GROUPS: "true"
      FILE__SAML2_SP_x509: "/run/secrets/saml-cert" 
      FILE__SAML2_SP_x509_KEY: "/run/secrets/saml-key"
      SAML2_ONELOGIN_OVERRIDES: "{\"sp\":{\"entityId\":\"${BOOKSTACK_URL}\"},\"security\":{\"authnRequestsSigned\":true,\"logoutRequestSigned\":true,\"wantMessagesSigned\":true,\"wantAssertionsSigned\":true,\"wantAssertionsEncrypted\":true}}"
      SAML2_DUMP_USER_DETAILS: "${BOOKSTACK_SAML_DUMP_USER_DETAILS-}"

      # SAML Attribute OID mapping
      SAML2_EMAIL_ATTRIBUTE: "urn:oid:0.9.2342.19200300.100.1.3"
      SAML2_EXTERNAL_ID_ATTRIBUTE: "urn:oid:0.9.2342.19200300.100.1.1"
      SAML2_DISPLAY_NAME_ATTRIBUTES: "urn:oid:2.16.840.1.113730.3.1.241"
      SAML2_GROUP_ATTRIBUTE: "urn:oid:1.3.6.1.4.1.5923.1.1.1.7"

      # SMTP configuration
      MAIL_DRIVER: "smtp"
      MAIL_HOST: "${MAIL_HOST}"
      MAIL_PORT: "${MAIL_PORT}"
      MAIL_ENCRYPTION: "tls"
      MAIL_FROM: "${MAIL_FROM}"
      MAIL_FROM_NAME: "${MAIL_FROM_NAME}"

    networks:
      - front
      - back

    ports:
      - 80:80/tcp
      - 443:443/tcp

    volumes:
      - bookstack-data:/config


  db:
    container_name: bookstack-db
    image: mariadb:10.11.6
    restart: unless-stopped

    secrets:
      - db-bookstack-password
      - db-root-password

    environment:
      MARIADB_ROOT_PASSWORD_FILE: "/run/secrets/db-root-password"
      MARIADB_AUTO_UPGRADE: "true"
      MARIADB_DATABASE: "bookstack"
      MARIADB_USER: "bookstack"
      MARIADB_PASSWORD_FILE: "/run/secrets/db-bookstack-password"

    networks:
      - back

    ports:
      - 3306/tcp

    volumes:
      - db-data:/var/lib/mysql


  restic:
    container_name: bookstack-restic
    image: ghcr.io/stanford-rc/bookstack-restic:main
    command: cron
    depends_on:
      - db
    restart: unless-stopped

    environment:
      MYSQL_HOST: "bookstack-db"
      MYSQL_TCP_PORT: "3306"
      TZ: "${BOOKSTACK_TZ}"

      RESTIC_REPOSITORY: "gs:${GOOGLE_RESTIC_BUCKET}:/"
      RESTIC_PASSWORD_FILE: "/run/secrets/restic-password"
      GOOGLE_PROJECT_ID: "${GOOGLE_PROJECT_ID}"
      GOOGLE_APPLICATION_CREDENTIALS: "/run/secrets/restic-gcp"

      DB_DATABASE: "bookstack"
      DB_PASS_FILE: "/run/secrets/db-root-password"

      RETAIN_HOURLY: 48
      RETAIN_DAILY: 7
      RETAIN_WEEKLY: 4
      RETAIN_MONTHLY: 18
      RETAIN_YEARLY: 0
      REPACK_MAX_UNUSED: "80%"

    secrets:
      - db-root-password
      - restic-gcp
      - restic-password

    networks:
      - front
      - back

    volumes:
      - bookstack-data:/bookstack