---
version: "3.8"

services:
  app:
    image: codeberg.org/klasse-methode/lauti:${IMAGE_TAG:-1.0.0}
    networks:
      - proxy
    environment:
      - LAUTI_SQLITE_DB=/data/lauti.db
      - LAUTI_ADDR=0.0.0.0:3333
      - LAUTI_HTTP_READ_TIMEOUT=5s
      - LAUTI_HTTP_WRITE_TIMEOUT=5s
      - LAUTI_HTTP_HANDLER_TIMEOUT=5s
      - LAUTI_SEARCH_INDEX_PATH=/data/lauti.bleve
      - LAUTI_SEARCH_TIMEOUT=5s
      - LAUTI_SEARCH_RESULT_CACHE_SIZE=100
      - LAUTI_SEARCH_BUCKET_CACHE_SIZE=100
      - LAUTI_ADMIN_EMAIL
      - LAUTI_MEDIA_PATH=/data/media
      - LAUTI_ADMIN_PASSWORD_FILE=/run/secrets/admin_password
      - LAUTI_BASE_URL=https://${DOMAIN}
      - LAUTI_KILLSWITCH_HASHES
      - LAUTI_TIMEZONE
      - LAUTI_THEME
      - LAUTI_THEMES_PATH=/data/themes
      - LAUTI_OSM_TILE_CACHE_DIR=/data/cache/osm
      - LAUTI_OSM_TILE_SERVER=https://tile.openstreetmap.org/{z}/{x}/{y}.png
      - LAUTI_DEBUG
      - LAUTI_AUTH_KEY_PATH=/data/auth-key
    secrets:
      - admin_password
    deploy:
      update_config:
        failure_action: rollback
        order: start-first
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=3333"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.regex=^https://(${REDIRECTS})/(.*)"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
        - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
        - "backupbot.backup=true"
        - "coop-cloud.${STACK_NAME}.version=1.0.1+1.0.0"
    volumes:
      - "data:/data"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3333"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 1m


secrets:
  admin_password:
    name: ${STACK_NAME}_admin_password_${SECRET_ADMIN_PASSWORD_VERSION}
    external: true

networks:
  proxy:
    external: true

volumes:
  data: