version: '3.8'

services:
  app:
    image: fireflyiii/core:version-5.5.13
    volumes:
      - firefly_iii_upload:/var/www/html/storage/upload
    secrets:
      - db_password
      - cron_token
      - app_key
    environment:
      - APP_NAME
      - SITE_OWNER
      - TZ
      - DEFAULT_LANGUAGE
      - DEFAULT_LOCALE
      - APP_DEBUG
      - DISABLE_CSP_HEADER
      - ALLOW_WEBHOOKS
      - TRUSTED_PROXIES
      - APP_KEY_FILE=/run/secrets/app_key
      - STATIC_CRON_TOKEN_FILE=
      - LOG_CHANNEL=stack
      - APP_LOG_LEVEL=notice
      - AUDIT_LOG_LEVEL=info
      - DB_CONNECTION=pgsql
      - DB_HOST=db
      - DB_PORT=5432
      - DB_DATABASE=firefly
      - DB_USERNAME=firefly
      - DB_PASSWORD_FILE=/run/secrets/db_password
      - PGSQL_SSL_MODE=prefer
      - PGSQL_SSL_ROOT_CERT=null
      - PGSQL_SSL_CERT=null
      - PGSQL_SSL_KEY=null
      - PGSQL_SSL_CRL_FILE=null
      - CACHE_DRIVER=file
      - SESSION_DRIVER=file
      - COOKIE_PATH="/"
      - COOKIE_DOMAIN=
      - COOKIE_SECURE=false
      - COOKIE_SAMESITE=lax
      - SEND_REGISTRATION_MAIL=false
      - SEND_ERROR_MESSAGE=false
      - SEND_LOGIN_NEW_IP_WARNING=false
      - SEND_REPORT_JOURNALS=false
      - ENABLE_EXTERNAL_MAP=false
      - AUTHENTICATION_GUARD=web
      - CUSTOM_LOGOUT_URL=
      - DISABLE_FRAME_HEADER=false
      - DKR_CHECK_SQLITE=false
      - DKR_RUN_MIGRATION=true
      - DKR_RUN_UPGRADE=true
      - DKR_RUN_VERIFY=true
      - DKR_RUN_REPORT=true
      - DKR_RUN_PASSPORT_INSTALL=true
      - ADLDAP_CONNECTION=default
      - BROADCAST_DRIVER=log
      - QUEUE_DRIVER=sync
      - CACHE_PREFIX=firefly
      - PUSHER_KEY=
      - IPINFO_TOKEN=
      - PUSHER_SECRET=
      - PUSHER_ID=
      - DEMO_USERNAME=
      - DEMO_PASSWORD=
      - IS_HEROKU=false
      - FIREFLY_III_LAYOUT=v1
      - APP_URL=http://localhost
    depends_on:
      - db
    networks:
      - internal
      - proxy 
    deploy:
      restart_policy:
        condition: on-failure
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8080" 
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
        - coop-cloud.${STACK_NAME}.web.version=0.1
    healthcheck:
      test: ["CMD", "curl", "http://localhost:8080"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 2m
  db:
    image: postgres:13-alpine
    environment:
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password 
      - POSTGRES_USER=firefly
      - POSTRES_DB=firefly
    volumes:
      - firefly_iii_db:/var/lib/mysql
    secrets:
      - db_password
    networks:
      - internal
networks:
  internal:
  proxy:
    external: true
volumes:
   firefly_iii_upload:
   firefly_iii_db:
secrets:
  cron_token:
    name: ${STACK_NAME}_static_cron_token_${SECRET_STATIC_CRON_TOKEN_VERSION}
    external: true
  app_key:
    name: ${STACK_NAME}_app_key_${SECRET_APP_KEY_VERSION}
    external: true
  db_password:
    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
    external: true
#  cron:
#    image: alpine
#    command: command: sh -c "echo \"0 3 * * * wget -qO- https://<Firefly III URL>/api/v1/cron/<TOKEN>\" | crontab - && crond -f -L /dev/stdout"
#    secrets:
#      - cron_token