---
services:
  app:
    image: ghcr.io/nodebb/nodebb:4.7.0
    environment:
      URL: "https://${DOMAIN}"
    volumes:
      - nodebb-build:/usr/src/app/build:rw
      - nodebb-uploads:/usr/src/app/public/uploads:rw
      - nodebb-nodemodules:/usr/src/app/node_modules:rw
      - nodebb-config:/opt/config:rw
    configs:
        - source: config_json
          target: /opt/config/config.json
    secrets:
      - db_password
      - secret
    networks:
      - proxy
      - internal
    deploy:
      restart_policy:
        condition: on-failure
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=4567"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "coop-cloud.${STACK_NAME}.version=1.0.0+4.7.0"

  postgres:
    image: postgres:17.6-alpine
    environment:
      POSTGRES_USER: nodebb
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
      POSTGRES_DB: nodebb
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - internal
    secrets:
      - db_password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready", "-U", "nodebb"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      labels:
        backupbot.backup.pre-hook: "/pg_backup.sh backup"
        backupbot.backup.volumes.postgres.path: "backup.sql"
        backupbot.restore.post-hook: '/pg_backup.sh restore'
    configs:
        - source: pg_backup
          target: /pg_backup.sh
          mode: 0555

volumes:
  nodebb-build:
  nodebb-uploads:
  nodebb-config:
  nodebb-nodemodules:
  postgres-data:

networks:
  internal:
  proxy:
    external: true

secrets:
  db_password:
    external: true
    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
  secret:
    external: true
    name: ${STACK_NAME}_secret_${SECRET_SECRET_VERSION}

configs:
  config_json:
    name: ${STACK_NAME}_config_json_${CONFIG_JSON_VERSION}
    file: config.json.tmpl
    template_driver: golang
  pg_backup:
    name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
    file: pg_backup.sh