---
version: '3.7'

services:
  es-dev-elastic-stack-01:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0
    container_name: es-dev-elastic-stack-01
    hostname: es-dev-elastic-stack-01
    extra_hosts:
      - "es-dev-elastic-stack-02:10.0.0.3"
      - "es-dev-elastic-stack-03:10.0.0.4"
    environment:
      ES_JAVA_OPTS: -Xms3886m -Xmx3886m
      node.name: es-dev-elastic-stack-01
      cluster.name: es-docker-cluster
      discovery.seed_hosts: es-dev-elastic-stack-02,es-dev-elastic-stack-03
      cluster.initial_master_nodes: es-dev-elastic-stack-01,es-dev-elastic-stack-02,es-dev-elastic-stack-03
      bootstrap.memory_lock: "true"
      network.publish_host: 10.0.0.2
      xpack.security.enabled: "true"
      xpack.security.enabled: "true"
      xpack.security.http.ssl.enabled: "true"
      xpack.security.http.ssl.key: /usr/share/elasticsearch/config/certificates/es-dev-elastic-stack-01/es-dev-elastic-stack-01.key
      xpack.security.http.ssl.certificate_authorities: /usr/share/elasticsearch/config/certificates/ca/ca.crt
      xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/certificates/es-dev-elastic-stack-01/es-dev-elastic-stack-01.crt
      xpack.security.transport.ssl.enabled: "true"
      xpack.security.transport.ssl.verification_mode: certificate
      xpack.security.transport.ssl.certificate_authorities: /usr/share/elasticsearch/config/certificates/ca/ca.crt
      xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/certificates/es-dev-elastic-stack-01/es-dev-elastic-stack-01.crt
      xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/certificates/es-dev-elastic-stack-01/es-dev-elastic-stack-01.key
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - es-dev-elastic-stack-01-data:/usr/share/elasticsearch/data
      - ./certs:/usr/share/elasticsearch/config/certificates:ro
      - ./config/roles.yml:/usr/share/elasticsearch/config/roles.yml:ro
    ports:
      - 9200:9200
      - 9300:9300
    networks:
      - back-tier
    healthcheck:
      test: curl --cacert /usr/share/elasticsearch/config/certificates/ca/ca.crt -s https://localhost:9200 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
      interval: 30s
      timeout: 10s
      retries: 5

volumes:
  es-dev-elastic-stack-01-data:
    name: es-dev-elastic-stack-01-data

networks:
  back-tier:
    external: true