version: '3'

services:

  mywww:
    image: bunkerity/bunkerized-nginx
    restart: always
    depends_on:
      - mywp
      - mync
    ports:
      - 80:8080
      - 443:8443
    # bunkerized-nginx runs as an unprivileged user with UID/GID 101
    # don't forget to edit the permissions of the files and folders accordingly
    volumes:
      - ./web-files:/www:ro
      - ./letsencrypt:/etc/letsencrypt
      - ./server-confs:/server-confs:ro
      - ./modsec-confs:/modsec-confs:ro
      - ./modsec-crs-confs:/modsec-crs-confs:ro
    environment:
      - SERVER_NAME=wp.website.com nc.website.com # replace with your domains
      - MULTISITE=yes
      - AUTO_LETS_ENCRYPT=yes
      - REDIRECT_HTTP_TO_HTTPS=yes
      - DISABLE_DEFAULT_SERVER=yes
      - USE_CLIENT_CACHE=yes
      - USE_GZIP=yes
      - wp.website.com_REMOTE_PHP=mywp
      - wp.website.com_REMOTE_PHP_PATH=/var/www/html
      - nc.website.com_REMOTE_PHP=mync
      - nc.website.com_REMOTE_PHP_PATH=/var/www/html
      - nc.website.com_LIMIT_REQ_RATE=5r/s
      - nc.website.com_LIMIT_REQ_BURST=10
      - nc.website.com_ALLOWED_METHODS=GET|POST|HEAD|COPY|DELETE|LOCK|MKCOL|MOVE|PROPFIND|PROPPATCH|PUT|UNLOCK|OPTIONS
      - nc.website.com_X_FRAME_OPTIONS=SAMEORIGIN
      - nc.website.com_BAD_BEHAVIOR_STATUS_CODES=400 401 403 405 444
      - nc.website.com_WHITELIST_USER_AGENT=WebDAV
    networks:
      - net1
      - net2

  mywp:
    image: wordpress:fpm-alpine
    restart: always
    volumes:
      - ./web-files/wp.website.com:/var/www/html
    environment:
      - WORDPRESS_DB_HOST=mywpdb
      - WORDPRESS_DB_NAME=wp
      - WORDPRESS_DB_USER=user
      - WORDPRESS_DB_PASSWORD=db-user-pwd    # replace with a stronger password (must match MYSQL_PASSWORD)
      - WORDPRESS_TABLE_PREFIX=prefix_       # best practice : replace with a random prefix
    networks:
      - net1

  mywpdb:
    image: mariadb
    restart: always
    volumes:
      - ./wp-db-data:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=db-root-pwd      # replace with a stronger password
      - MYSQL_DATABASE=wp
      - MYSQL_USER=user
      - MYSQL_PASSWORD=db-user-pwd           # replace with a stronger password (must match WORDPRESS_DB_PASSWORD)
    networks:
      - net1

  mync:
    image: nextcloud:stable-fpm
    restart: always
    volumes:
      - ./web-files/nc.website.com:/var/www/html
    environment:
      - MYSQL_HOST=myncdb
      - MYSQL_DATABASE=nc
      - MYSQL_USER=user
      - MYSQL_PASSWORD=db-user-pwd           # replace with a stronger password (must match MYSQL_PASSWORD)
    networks:
      - net2

  myncdb:
    image: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - ./nc-db-data:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=db-root-pwd      # replace with a stronger password
      - MYSQL_DATABASE=nc
      - MYSQL_USER=user
      - MYSQL_PASSWORD=db-user-pwd           # replace with a stronger password (must match MYSQL_PASSWORD)
    networks:
      - net2

networks:
  net1:
  net2:
