---
services:
  geoipupdate:
    image: "maxmindinc/geoipupdate:v7.1.1"
    restart: unless-stopped
    volumes:
      - "geoip:/usr/share/GeoIP"
    environment:
      GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
      GEOIPUPDATE_FREQUENCY: "8"
      GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?MaxMind GeoIP account ID required}"
      GEOIPUPDATE_LICENSE_KEY_FILE: /run/secrets/geoip_license_key
    secrets:
      - geoip_license_key

  postgresql: !reset []
    # env_file: !override []
    # environment:
    #   POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    # secrets:
    #   - postgres_password
    # networks:
    #   - backend
    # ports: !override []

  redis:
    networks:
      - backend

  server:
    depends_on:
      postgresql: !reset []
    env_file: !reset []
    environment:
      AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
      AUTHENTIK_POSTGRESQL__HOST: ${AUTHENTIK_POSTGRESQL__HOST:?Authentik PostgreSQL host required}
      AUTHENTIK_POSTGRESQL__PORT: ${AUTHENTIK_POSTGRESQL__PORT:?Authentik PostgreSQL port required}
      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
      AUTHENTIK_POSTGRESQL__SSLMODE: ${AUTHENTIK_POSTGRESQL__SSLMODE:-disable}
      AUTHENTIK_POSTGRESQL__SSLROOTCERT: ${AUTHENTIK_POSTGRESQL__SSLROOTCERT:-/etc/ssl/certs/ca-certificates.crt}
      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
    ports: !reset []
    secrets:
      - authentik_email_password
      - authentik_secret_key
      - postgres_password
    volumes:
      - media:/media
      - ./data/authentik/custom-templates:/templates
      - geoip:/geoip
    networks:
      - backend
      - frontend
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=frontend"

      - "traefik.http.services.sso-server.loadbalancer.server.port=9443" # set port the container listenes to
      - "traefik.http.services.sso-server.loadbalancer.server.scheme=https"

      - "traefik.http.routers.sso-server-web.rule=Host(`${PUBLIC_DOMAIN}`)"
      - "traefik.http.routers.sso-server-web.service=sso-server@docker"
      - "traefik.http.routers.sso-server-web.entrypoints=web"
      - "traefik.http.routers.sso-server-web.middlewares=redirect-to-https@file"

      - "traefik.http.routers.sso-server-websecure.rule=Host(`${PUBLIC_DOMAIN}`)" # change hostname!
      - "traefik.http.routers.sso-server-websecure.service=sso-server@docker"
      - "traefik.http.routers.sso-server-websecure.entrypoints=websecure"
      - "traefik.http.routers.sso-server-websecure.tls=true"
      - "traefik.http.routers.sso-server-websecure.tls.options=modern@file"
      - "traefik.http.routers.sso-server-websecure.tls.certresolver=acmeDns"
      - "traefik.http.routers.sso-server-websecure.tls.domains[0].main=${TLS_DOMAIN}"
      - "traefik.http.routers.sso-server-websecure.middlewares=secHeaders@file, hsts-header@file"


  worker:
    depends_on:
      postgresql: !reset []
    env_file: !reset []
    environment:
      AUTHENTIK_EMAIL__PASSWORD: file:///run/secrets/authentik_email_password
      AUTHENTIK_POSTGRESQL__HOST: ${AUTHENTIK_POSTGRESQL__HOST:?Authentik PostgreSQL host required}
      AUTHENTIK_POSTGRESQL__PORT: ${AUTHENTIK_POSTGRESQL__PORT:?Authentik PostgreSQL port required}
      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_password
      AUTHENTIK_POSTGRESQL__SSLMODE: ${AUTHENTIK_POSTGRESQL__SSLMODE:-disable}
      AUTHENTIK_POSTGRESQL__SSLROOTCERT: ${AUTHENTIK_POSTGRESQL__SSLROOTCERT:-/etc/ssl/certs/ca-certificates.crt}
      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
    secrets:
      - authentik_email_password
      - authentik_secret_key
      - postgres_password
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - media:/media
      - certs:/certs
      - ./data/authentik/custom-templates:/templates
      - geoip:/geoip
    networks:
      - backend

secrets:
  authentik_email_password:
    environment: AUTHENTIK_EMAIL__PASSWORD
  authentik_secret_key:
    environment: AUTHENTIK_SECRET_KEY
  geoip_license_key:
    environment: GEOIPUPDATE_LICENSE_KEY
  postgres_password:
    environment: PG_PASS

volumes:
  geoip:
    driver: local
  media:
    driver: local
  certs:
    driver: local

networks:
  backend:
  frontend: