docker-compose-mariadb.yml

services:
  mariadb:
    restart: 'always'
    # @see https://hub.docker.com/r/bitnami/mariadb
    image: bitnami/mariadb:11.6
    ports:
      - 3306:3306
    environment:
      MARIADB_ROOT_PASSWORD:
    depends_on:
      - certbot-mariadb
    volumes:
      - ./data/mysql:/bitnami/mariadb
      - ./data/mysql_certificates:/etc/mysql/certificates:ro
      - ./mariadb/conf/ssl.cnf:/opt/bitnami/mariadb/conf/my_custom.cnf:ro
    networks:
      - dbs
  # official certbot to retrieve our ssl certificate (stops after retrieval)
  certbot-mariadb:
    restart: 'no'
    image: certbot/dns-cloudflare
    networks:
      - dbs
    environment:
      MYSQL_DOMAIN:
    volumes:
      - ./data/certbot_mysql:/etc/letsencrypt
      - ./data/mysql_certificates:/mysql_certificates
      - ./mariadb/certbot/deploy_mariadb.sh:/usr/local/bin/deploy_mariadb.sh
      - ./.cloudflare.ini:/root/cloudflare.ini
    command: >-
      certonly --dns-cloudflare
      --non-interactive
      --keep-until-expiring
      --dns-cloudflare-credentials /root/cloudflare.ini
      --dns-cloudflare-propagation-seconds 15
      --email ssl@kontextwork.de
      --agree-tos --no-eff-email
      -d ${MYSQL_DOMAIN}
      --deploy-hook /usr/local/bin/deploy_mariadb.sh
  # handles re-triggering the certbot container using cron
  certbot-mariadb-cron:
    build: ./build/docker-certbot-cron/
    image: kontextwork/certbot-cron
    networks:
      - dbs
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      CERTBOT_SERVICE_NAME: ${CERTBOT_SERVICE_NAME:-certbot-mariadb-cron_1}
      COMPOSE_PROJECT_NAME: '${COMPOSE_PROJECT_NAME}'
    restart: 'always'