4 - Portainer

Compose do Portainer

mkdir -p /srv/docker/core/portainer /srv/docker/volumes/portainer/data

tee /srv/docker/core/portainer/docker-compose.yml > /dev/null <<'EOF'
version: "3.8"

services:
  portainer:
    image: portainer/portainer-ce:latest
    command: -H unix:///var/run/docker.sock
    networks:
      - traefik
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock   # bind (necessário)
      - portainer_data:/data                        # volume nomeado preso ao esqueleto
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik"
        - "traefik.http.routers.portainer.rule=Host(`portainer.wsl.lab.local`)"
        - "traefik.http.routers.portainer.entrypoints=websecure"
        - "traefik.http.routers.portainer.tls=true"
        - "traefik.http.services.portainer.loadbalancer.server.port=9000"

networks:
  traefik:
    external: true

volumes:
  portainer_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /srv/docker/volumes/portainer/data
EOF

Deploy do Portainer

docker stack deploy -c /srv/docker/core/portainer/docker-compose.yml portainer

Acessar via navegador

https://portainer.wsl.lab.local

A primeira vez, crie o usuário administrador.

Comandos Úteis

Garantir a rede overlay (idempotente)

docker network create --driver overlay --attachable traefik 2>/dev/null || echo "Overlay 'traefik' já existe"

Atualizar (redeploy) o Portainer

docker stack deploy -c /srv/docker/core/portainer/docker-compose.yml portainer

Opcional: forçar recriação dos serviços se nada mudou no spec

docker service update --force portainer_portainer

Verificação rápida

docker stack ps portainer

Logs em tempo real (Ctrl+C para sair)

docker service logs -f portainer_portainer

Backup

sudo bash -lc 'cd /srv/docker && mkdir -p .backup \
&& TS=$(date +%F_%H-%M-%S) \
&& tar -czf ".backup/traefik-${TS}.tar.gz" \
core/traefik/docker-compose.yml core/traefik/traefik.yml core/traefik/dynamic shared/certs \
&& echo "Gerado: /srv/docker/.backup/traefik-${TS}.tar.gz"'

Restore — Portainer (último backup)

sudo bash -lc '
cd /srv/docker
BAK=$(ls -1t .backup/portainer-*.tar.gz | head -n1) || { echo "Nenhum backup portainer encontrado"; exit 1; }
echo ">> Restaurando: $BAK"
docker stack rm portainer >/dev/null 2>&1 || true
# espera o stack sumir
while docker stack ps portainer >/dev/null 2>&1; do sleep 1; done
tar -xzf "$BAK" -C /srv/docker
docker network create --driver overlay --attachable traefik 2>/dev/null || true
docker stack deploy -c core/portainer/docker-compose.yml portainer
'