docker-compose.yml

version: '3.8'

services:
  db:
    image: mysql:9.0
    container_name: guac-mysql
    restart: unless-stopped
    user: "1000:1000"
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
    volumes:
      - ./mysql-data:/var/lib/mysql
    command: >
      /bin/sh -c "
        mkdir -p /var/lib/mysql &&
        chown 1000:1000 /var/lib/mysql &&
        chmod 770 /var/lib/mysql &&
        docker-entrypoint.sh mysqld
      "
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 150s
    logging:
      driver: json-file
      options:
        max-size: ${LOG_MAX_SIZE:-10m}
        max-file: ${LOG_MAX_FILE:-3}
    networks:
      - guac-net

  guacd:
    image: guacamole/guacd:1.6.0
    container_name: guac-guacd
    restart: unless-stopped
    user: "1000:1000"
    environment:
      - GUACD_LOG_LEVEL=debug
    volumes:
      - ./recordings:/var/lib/guacamole/recordings
      - ./recordings:/var/lib/guacamole/typescripts
    command: >
      /bin/sh -c "
        mkdir -p /var/lib/guacamole/recordings /var/lib/guacamole/typescripts &&
        chown 1000:1000 /var/lib/guacamole/recordings /var/lib/guacamole/typescripts &&
        chmod 2775 /var/lib/guacamole/recordings /var/lib/guacamole/typescripts &&
        /opt/guacamole/sbin/guacd -f
      "
    logging:
      driver: json-file
      options:
        max-size: ${LOG_MAX_SIZE:-10m}
        max-file: ${LOG_MAX_FILE:-3}
    networks:
      - guac-net

  guacamole:
    image: guacamole/guacamole:1.6.0
    container_name: guac-guacamole
    restart: unless-stopped
    user: "999:1000"
    environment:
      - MYSQL_HOSTNAME=db
      - MYSQL_PORT=${MYSQL_PORT:-3306}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
      - GUACD_HOSTNAME=guacd
      - GUACD_PORT=${GUACD_PORT:-4822}
      - REMOTE_IP_VALVE_ENABLED=true
      - PROXY_ALLOWED_IPS_REGEX=^(10\.|172\.1[6789]\.|192\.168\.)
      - RECORDING_ENABLED=true
      - GUACAMOLE_RECORD_PATH=/var/lib/guacamole/recordings
      - GUACAMOLE_TYPESCRIPT_PATH=/var/lib/guacamole/typescripts
    volumes:
      - ./recordings:/var/lib/guacamole/recordings
    depends_on:
      db:
        condition: service_healthy
      guacd:
        condition: service_started
    logging:
      driver: json-file
      options:
        max-size: ${LOG_MAX_SIZE:-10m}
        max-file: ${LOG_MAX_FILE:-3}
    networks:
      - guac-net

  nginx:
    image: nginx:1.28
    container_name: guac-nginx
    restart: unless-stopped
    ports:
      - "${HTTP_PORT:-8080}:80"
      - "${HTTPS_PORT:-8443}:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx-certs:/etc/nginx/certs
    command: >
      /bin/sh -c "
        mkdir -p /etc/nginx/certs &&
        chown root:root /etc/nginx/certs &&
        chmod 755 /etc/nginx/certs &&
        rm -f /etc/nginx/conf.d/* &&
        if [ ! -f /etc/nginx/certs/server.crt ] || [ ! -f /etc/nginx/certs/server.key ]; then
          openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
            -keyout /etc/nginx/certs/server.key \
            -out /etc/nginx/certs/server.crt \
            -subj '/C=US/ST=State/L=City/O=Org/CN=${SERVER_NAME:-localhost}';
          echo 'Certificates generated';
        else
          echo 'Certificates already exist';
        fi &&
        nginx -g 'daemon off;'
      "
    depends_on:
      - guacamole
    logging:
      driver: json-file
      options:
        max-size: ${LOG_MAX_SIZE:-10m}
        max-file: ${LOG_MAX_FILE:-3}
    networks:
      - guac-net

networks:
  guac-net:
    name: guac-net
    driver: bridge