Auto-sync Fri Feb 13 10:42:01 UTC 2026

docker-compose.yml

@@ -1,4 +1,4 @@
-version: "3.7"
+version: "3.9"
 
 x-logging: &default-logging
   driver: "json-file"
@@ -7,10 +7,15 @@ x-logging: &default-logging
     max-file: "${LOG_MAX_FILE:-10}"
     compress: "true"
 
+networks:
+  traefik-net:
+    external: true # Traefik管理下のネットワーク
+  windmill-internal:
+    driver: bridge # Windmill内部通信用
+
 services:
   db:
     deploy:
-      # To use an external database, set replicas to 0 and set DATABASE_URL to the external database url in the .env file
       replicas: 1
     image: postgres:16
     shm_size: 1g
@@ -28,9 +33,12 @@ services:
       timeout: 5s
       retries: 5
     logging: *default-logging
+    networks:
+      - windmill-internal
 
   windmill_server:
     image: ${WM_IMAGE}
+    container_name: windmill_server
     pull_policy: always
     deploy:
       replicas: 1
@@ -46,7 +54,24 @@ services:
         condition: service_healthy
     volumes:
       - worker_logs:/tmp/windmill/logs
-      - /home/akira/develop/windmill:/workspace
+      - /home/windmill/windmill:/workspace
+    labels:
+      # Traefik設定
+      - "traefik.enable=true"
+      # HTTPSルーター
+      - "traefik.http.routers.windmill.rule=Host(`windmill.keinafarm.net`)"
+      - "traefik.http.routers.windmill.entrypoints=websecure"
+      - "traefik.http.routers.windmill.tls=true"
+      - "traefik.http.routers.windmill.tls.certresolver=letsencrypt"
+      - "traefik.http.services.windmill.loadbalancer.server.port=8000"
+      # HTTPからHTTPSへのリダイレクト
+      - "traefik.http.routers.windmill-http.rule=Host(`windmill.keinafarm.net`)"
+      - "traefik.http.routers.windmill-http.entrypoints=web"
+      - "traefik.http.routers.windmill-http.middlewares=windmill-https-redirect"
+      - "traefik.http.middlewares.windmill-https-redirect.redirectscheme.scheme=https"
+    networks:
+      - traefik-net
+      - windmill-internal
     logging: *default-logging
 
   windmill_worker:
@@ -58,37 +83,24 @@ services:
         limits:
           cpus: "1"
           memory: 2048M
-          # for GB, use syntax '2Gi'
     restart: unless-stopped
-    # Uncomment to enable PID namespace isolation (recommended for security)
-    # Requires privileged mode for --mount-proc flag
-    # See: https://www.windmill.dev/docs/advanced/security_isolation
-    # privileged: true
     environment:
       - DATABASE_URL=${DATABASE_URL}
       - MODE=worker
       - WORKER_GROUP=default
-      # If running with non-root/non-windmill UID (e.g., user: "1001:1001"),
-      # add: - HOME=/tmp
-      # Uncomment to enable PID namespace isolation (requires privileged: true above)
-      # - ENABLE_UNSHARE_PID=true
     depends_on:
       db:
         condition: service_healthy
-    # to mount the worker folder to debug, KEEP_JOB_DIR=true and mount /tmp/windmill
     volumes:
-      # mount the docker socket to allow to run docker containers from within the workers
       - /var/run/docker.sock:/var/run/docker.sock
       - worker_dependency_cache:/tmp/windmill/cache
       - worker_logs:/tmp/windmill/logs
-      # mount the windmill workspace directory for git sync workflow
-      - /home/akira/develop/windmill:/workspace
-
+      - /home/windmill/windmill:/workspace
+    networks:
+      - windmill-internal
     logging: *default-logging
 
-  ## This worker is specialized for "native" jobs. Native jobs run in-process and thus are much more lightweight than other jobs
   windmill_worker_native:
-    # Use ghcr.io/windmill-labs/windmill-ee:main for the ee
     image: ${WM_IMAGE}
     pull_policy: always
     deploy:
@@ -97,64 +109,27 @@ services:
         limits:
           cpus: "1"
           memory: 2048M
-          # for GB, use syntax '2Gi'
     restart: unless-stopped
-    # Uncomment to enable PID namespace isolation (recommended for security)
-    # Requires privileged mode for --mount-proc flag
-    # See: https://www.windmill.dev/docs/advanced/security_isolation
-    # privileged: true
     environment:
       - DATABASE_URL=${DATABASE_URL}
       - MODE=worker
       - WORKER_GROUP=native
       - NUM_WORKERS=8
       - SLEEP_QUEUE=200
-      # Uncomment to enable PID namespace isolation (requires privileged: true above)
-      # - ENABLE_UNSHARE_PID=true
     depends_on:
       db:
         condition: service_healthy
     volumes:
       - worker_logs:/tmp/windmill/logs
+    networks:
+      - windmill-internal
     logging: *default-logging
-  # This worker is specialized for reports or scraping jobs. It is assigned the "reports" worker group which has an init script that installs chromium and can be targeted by using the "chromium" worker tag.
-  # windmill_worker_reports:
-  #   image: ${WM_IMAGE}
-  #   pull_policy: always
-  #   deploy:
-  #     replicas: 1
-  #     resources:
-  #       limits:
-  #         cpus: "1"
-  #         memory: 2048M
-  #         # for GB, use syntax '2Gi'
-  #   restart: unless-stopped
-  #   # Uncomment to enable PID namespace isolation (recommended for security)
-  #   # Requires privileged mode for --mount-proc flag
-  #   # See: https://www.windmill.dev/docs/advanced/security_isolation
-  #   # privileged: true
-  #   environment:
-  #     - DATABASE_URL=${DATABASE_URL}
-  #     - MODE=worker
-  #     - WORKER_GROUP=reports
-  #     # Uncomment to enable PID namespace isolation (requires privileged: true above)
-  #     # - ENABLE_UNSHARE_PID=true
-  #   depends_on:
-  #     db:
-  #       condition: service_healthy
-  #   # to mount the worker folder to debug, KEEP_JOB_DIR=true and mount /tmp/windmill
-  #   volumes:
-  #     # mount the docker socket to allow to run docker containers from within the workers
-  #     - /var/run/docker.sock:/var/run/docker.sock
-  #     - worker_dependency_cache:/tmp/windmill/cache
-  #     - worker_logs:/tmp/windmill/logs
 
-  # The indexer powers full-text job and log search, an EE feature.
   windmill_indexer:
     image: ${WM_IMAGE}
     pull_policy: always
     deploy:
-      replicas: 0 # set to 1 to enable full-text job and log search
+      replicas: 0 # 必要に応じて1に変更
     restart: unless-stopped
     expose:
       - 8002
@@ -168,51 +143,35 @@ services:
     volumes:
       - windmill_index:/tmp/windmill/search
       - worker_logs:/tmp/windmill/logs
+    networks:
+      - windmill-internal
     logging: *default-logging
 
-  # Combined extra services: LSP, Multiplayer, and Debugger
-  # Each service can be enabled/disabled via environment variables:
-  #   - ENABLE_LSP=true (default) - Language Server Protocol for code intelligence
-  #   - ENABLE_MULTIPLAYER=false - Real-time collaboration (Enterprise Edition)
-  #   - ENABLE_DEBUGGER=false - Interactive debugging via DAP WebSocket
   windmill_extra:
     image: ghcr.io/windmill-labs/windmill-extra:latest
     pull_policy: always
     restart: unless-stopped
     expose:
-      - 3001 # LSP
-      - 3002 # Multiplayer
-      - 3003 # Debugger
+      - 3001
+      - 3002
+      - 3003
     environment:
       - ENABLE_LSP=true
-      - ENABLE_MULTIPLAYER=false # Set to true to enable multiplayer (Enterprise Edition)
-      - ENABLE_DEBUGGER=true # Set to true to enable debugger
-      - DEBUGGER_PORT=3003 # Debugger service port
-      - ENABLE_NSJAIL=false # Set to true for nsjail sandboxing (requires privileged: true)
-      - REQUIRE_SIGNED_DEBUG_REQUESTS=false # Set to true to require JWT tokens for debug sessions
+      - ENABLE_MULTIPLAYER=false
+      - ENABLE_DEBUGGER=true
+      - DEBUGGER_PORT=3003
+      - ENABLE_NSJAIL=false
+      - REQUIRE_SIGNED_DEBUG_REQUESTS=false
       - WINDMILL_BASE_URL=http://windmill_server:8000
     volumes:
       - lsp_cache:/pyls/.cache
+    networks:
+      - windmill-internal
     logging: *default-logging
-
-  caddy:
-    image: ghcr.io/windmill-labs/caddy-l4:latest
-    restart: unless-stopped
-    # Configure the mounted Caddyfile and the exposed ports or use another reverse proxy if needed
-    volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
-      - caddy_data:/data
-      # - ./certs:/certs # Provide custom certificate files like cert.pem and key.pem to enable HTTPS - See the corresponding section in the Caddyfile
-    ports:
-      # To change the exposed port, simply change 80:80 to <desired_port>:80. No other changes needed
-      - 80:80
-      - 25:25
-      # - 443:443 # Uncomment to enable HTTPS handling by Caddy
-    environment:
-      - BASE_URL=":80"
-      # - BASE_URL=":443" # uncomment and comment line above to enable HTTPS via custom certificate and key files
-      # - BASE_URL=mydomain.com # Uncomment and comment line above to enable HTTPS handling by Caddy
-    logging: *default-logging
+  # Caddyは使わない（Traefikを使用）
+  # caddy:
+  #   deploy:
+  #     replicas: 0
 
 volumes:
   db_data: null
@@ -221,4 +180,3 @@ volumes:
   worker_memory: null
   windmill_index: null
   lsp_cache: null
-  caddy_data: null