---
version: "3.8"

services:
  outline-authentik-connector:
    image: burritosoftware/outline-authentik-connector:1.2

    secrets:
      - agsoutline
      - agsauthentik
      - agswebhook
      
    environment:
      - AUTHENTIK_URL=${AGS_AUTHENTIK_URL}
      - OUTLINE_URL=https://${DOMAIN}
      - OUTLINE_TOKEN_FILE=/var/run/secrets/agsoutline
      - OUTLINE_WEBHOOK_SECRET_FILE=/var/run/secrets/agswebhook
      - AUTHENTIK_TOKEN_FILE=/var/run/secrets/agsauthentik
      - AUTO_CREATE_GROUPS=${AGS_AUTO_CREATE_GROUPS:-True}
      - DEBUG=${AGS_DEBUG:-False}
      - SYNC_GROUP_REGEX=${AGS_SYNC_GROUP_REGEX:-.*}

    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.sync-router.rule=Host(`groupsync.${DOMAIN}`)"
        - "traefik.http.routers.sync-router.entrypoints=web-secure"
        - "traefik.http.routers.sync-router.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.services.sync-router.loadbalancer.server.port=80"

    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://0.0.0.0:80/ | grep -q '\"status\":\"running\"' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3

    networks:
      - backend
      - proxy

    configs:
      - source: ags_entrypoint
        target: /docker-entrypoint.sh
        mode: 0555

    entrypoint: /docker-entrypoint.sh

secrets:
  agsoutline:
    name: ${STACK_NAME}_agsoutline_${SECRET_AGS_OUTLINE_TOKEN_VERSION}
    external: true
  agsauthentik:
    name: ${STACK_NAME}_agsauthentik_${SECRET_AGS_AUTHENTIK_TOKEN_VERSION}
    external: true
  agswebhook:
    name: ${STACK_NAME}_agswebhook_${SECRET_AGS_WEBHOOK_SECRET_VERSION}
    external: true

configs:
  ags_entrypoint:
    name: ${STACK_NAME}_ags_entrypoint_${AGS_ENTRYPOINT_VERSION}
    file: entrypoint.authentikgroupsync.sh