version: "2.0"
services:

  wiki-lb:
    image: nginx
    ports:
      - 80:80
      - 443:443
    volumes:
      - /docker/etc/nginx:/etc/nginx
      - /docker/etc/ssl:/etc/ssl:ro

  wiki-server:
    image: atlassian/confluence-server
    ports:
      - 8090:8090
      - 8091:8091
    environment:
      - POSTGRES_INITDB_ARGS="--encoding=UTF8 --lc-collate='en_US.UTF-8'
      - CATALINA_CONNECTOR_PROXYNAME=wiki.example.com
      - CATALINA_CONNECTOR_PROXYPORT=443
      - CATALINA_CONNECTOR_SCHEME=https
      - CATALINA_CONNECTOR_SECURE=true
      - CATALINA_OPTS=-Xms1g -Xmx4g
      - JVM_MINIMUM_MEMORY=1024m
      - JVM_MAXIMUM_MEMORY=4096m
      - CONFLUENCE_CONFIG_PROPERTY1=confluence.setup.server.id
      - CONFLUENCE_CONFIG_VALUE1=xxxx-xxxx-xxxx-xxxx
      - ATL_TOMCAT_MAXTHREADS=35
    volumes:
      - /docker/var/atlassian/application-data/confluence:/var/atlassian/application-data/confluence
    depends_on:
      - wiki-lb
      - wiki-db

  wiki-db:
    image: postgres:10
    ports:
      - 5432:5432
    environment:
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=password
      - POSTGRES_ENCODING=UTF8
      - POSTGRES_COLLATE=en_US.UTF-8
      - PGDATA=/var/lib/postgresql/data/pgdata
    volumes:
      - /docker/var/lib/postgresql/data:/var/lib/postgresql/data

server {
        listen       80;
        server_name wiki.example.com;
        add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload;';
        return 301 https://$server_name$request_uri;
        location / {
        }

    }
server {
        listen 443 ssl http2;
        server_name wiki.example.com;
        ssl on;
        ssl_certificate /etc/ssl/private/wiki.example.com.pem;
        ssl_certificate_key /etc/ssl/private/wiki.example.com.key;
        ssl_protocols TLSv1 TLSv1.13 TLSv1.2; 
        ssl_ciphers 'HIGH:!aNULL:!MD5:!kEDH' "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 5m;
        ssl_prefer_server_ciphers on;
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate "/etc/ssl/certs/ca-certs.pem";
        resolver 81.81.81.81 8.8.4.4 valid=300s;
        resolver_timeout 5s;
        location /.well-known {
            alias /var/www/$server_name/.well-known;
        }
        location / {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://192127.1680.0.1:8090;
      }

}