services:
  app:
    image: "nextcloud/aio-talk:20251128_084214"
    environment:
      - NC_DOMAIN=${NC_DOMAINS}
      - TALK_HOST=${DOMAIN}
      - TZ
      - TALK_PORT=3478
      - INTERNAL_SECRET_FILE=/run/secrets/internal 
      - TURN_SECRET_FILE=/run/secrets/turn
      - SIGNALING_SECRET_FILE=/run/secrets/signaling
    deploy:
      labels:
        - traefik.enable=true
        - traefik.docker.network=proxy
        - traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8081
        - traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)
        - traefik.http.routers.${STACK_NAME}.entrypoints=web-secure
        - traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}
        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.rule=HostSNI(`*`)
        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.entrypoints=nextcloud-talk-hpb
        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.service=${STACK_NAME}_nextcloud-talk-hpb-svc
        - traefik.tcp.services.${STACK_NAME}_nextcloud-talk-hpb-svc.loadbalancer.server.port=3478
        - traefik.udp.routers.${STACK_NAME}_nextcloud-talk-hpb-udp.entrypoints=nextcloud-talk-hpb-udp
        - traefik.udp.routers.${STACK_NAME}_nextcloud-talk-hpb-udp.service=${STACK_NAME}_nextcloud-talk-hpb-udp-svc
        - traefik.udp.services.${STACK_NAME}_nextcloud-talk-hpb-udp-svc.loadbalancer.server.port=3478
        - backupbot.backup=${ENABLE_BACKUPS:-true}
    networks:
      - proxy
    configs:
      - source: entrypoint
        target: /custom-entrypoint.sh
        mode: 775
    entrypoint: /custom-entrypoint.sh
    secrets:
      - source: internal
        uid: "1000"
        gid: "122"
        mode: 0600
      - source: turn
        uid: "1000"
        gid: "122"
        mode: 0600
      - source: signaling
        uid: "1000"
        gid: "122"
        mode: 0600

secrets:
  internal:
    external: true
    name: ${STACK_NAME}_internal_${SECRET_INTERNAL_VERSION}
  turn:
    external: true
    name: ${STACK_NAME}_turn_${SECRET_TURN_VERSION}
  signaling:
    external: true
    name: ${STACK_NAME}_signaling_${SECRET_SIGNALING_VERSION}

configs:
  entrypoint:
    name: ${STACK_NAME}_entrypoint_${ENTRYPOINT_VERSION}
    file: entrypoint.sh.tmpl
    template_driver: golang

networks:
  proxy:
    external: true