mkdir /root/semaphore
mkdir /my_ssl
nano /root/semaphore/docker-compose.yaml

services:
  postgres:
    restart: unless-stopped
    image: postgres:14
    hostname: postgres
    volumes:
      - semaphore-postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: semaphore
      POSTGRES_PASSWORD: semaphore
      POSTGRES_DB: semaphore
    networks:
      default:
        ipv4_address: 172.20.0.100

  web:
    image: nginx
    restart: unless-stopped
    volumes:
       - ./nginx.conf:/etc/nginx/nginx.conf
       - /my_ssl:/etc/nginx/cert
    ports:
       - "80:80"
       - "443:443"
    networks:
      default:
        ipv4_address: 172.20.0.102

  semaphore:
    restart: unless-stopped
    ports:
      - 3000:3000
    image: semaphoreui/semaphore:latest
    environment:
      SEMAPHORE_DB_USER: semaphore
      SEMAPHORE_DB_PASS: semaphore
      SEMAPHORE_DB_HOST: postgres
      SEMAPHORE_DB_PORT: 5432
      SEMAPHORE_DB_DIALECT: postgres
      SEMAPHORE_DB: semaphore
      SEMAPHORE_PLAYBOOK_PATH: /tmp/semaphore/
      SEMAPHORE_ADMIN_PASSWORD: PASS
      SEMAPHORE_ADMIN_NAME: admin
      SEMAPHORE_ADMIN_EMAIL: admin@mail.ru
      SEMAPHORE_ADMIN: admin
      SEMAPHORE_ACCESS_KEY_ENCRYPTION: uWDFSdf234wDAKgvsHrV9Z/teoVQ4geotcogxaBg=
      SEMAPHORE_LDAP_ACTIVATED: 'no' # if you wish to use ldap, set to: 'yes'
      SEMAPHORE_SCHEDULE_TIMEZONE: Asia/Yekaterinburg
      TZ: Asia/Yekaterinburg
      ANSIBLE_HOST_KEY_CHECKING: "False"
    volumes:
      - ./playbooks:/home/semaphore/playbooks
      - /my_ssl:/home/semaphore/ssl
    depends_on:
      - postgres
    networks:
      default:
        ipv4_address: 172.20.0.103

volumes:
  semaphore-postgres:

networks:
  default:
    ipam:
      driver: default
      config:
        - subnet: 172.20.0.0/16

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
        server {
          listen 443 ssl;
          server_name  semaphore.domain.com;

          # add Strict-Transport-Security to prevent man in the middle attacks
          add_header Strict-Transport-Security "max-age=31536000" always;

          # SSL
          ssl_certificate /etc/nginx/cert/fullchain.pem;
          ssl_certificate_key /etc/nginx/cert/privkey.pem;

          # Recommendations from
          # https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx/
          #ssl_protocols TLSv1.1 TLSv1.2;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
          #ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
          ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;


          ssl_prefer_server_ciphers on;
          ssl_session_cache shared:SSL:10m;

          # required to avoid HTTP 411: see Issue #1486
          # (https://github.com/docker/docker/issues/1486)
          chunked_transfer_encoding on;

          location / {
            proxy_pass http://172.20.0.103:3000/;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_buffering off;
            proxy_request_buffering off;
          }

          location /api/ws {
            proxy_pass http://172.20.0.103:3000/api/ws;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Origin "";
          }
        }

        include       /etc/nginx/mime.types;
        default_type  application/octet-stream;

        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

        access_log  /var/log/nginx/access.log  main;

        sendfile        on;
        #tcp_nopush     on;

        keepalive_timeout  65;

        #gzip  on;

        include /etc/nginx/conf.d/*.conf;
}