services:
  traefik:
    image: traefik:v2.11
    restart: unless-stopped
    environment:
      # Docker Engine 29 akzeptiert keine veralteten API-Anfragen unter v1.40.
      DOCKER_API_VERSION: "1.40"
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=${CONTACT_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --ping=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/letsencrypt:/letsencrypt
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 15s
      timeout: 5s
      retries: 5
    networks:
      - web

  postgres:
    image: postgres:17
    restart: unless-stopped
    environment:
      POSTGRES_DB: fedeo_push
      POSTGRES_USER: fedeo_push
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-fedeo_push}
    volumes:
      - push_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U fedeo_push -d fedeo_push"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - internal

  api:
    restart: unless-stopped
    image: git.federspiel.tech/flfeders/fedeo/central-services-api:${FEDEO_CENTRAL_TAG:-dev}
    env_file: ${CENTRAL_ENV_FILE:-.env}
    environment:
      DATABASE_URL: postgres://fedeo_push:${POSTGRES_PASSWORD:-fedeo_push}@postgres:5432/fedeo_push
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4020/health"]
      interval: 15s
      timeout: 5s
      retries: 5
    labels:
      - traefik.enable=true
      - traefik.http.routers.fedeo-central-api.rule=Host(`${CENTRAL_API_DOMAIN}`)
      - traefik.http.routers.fedeo-central-api.entrypoints=websecure
      - traefik.http.routers.fedeo-central-api.tls.certresolver=letsencrypt
      - traefik.http.services.fedeo-central-api.loadbalancer.server.port=4020
      - traefik.docker.network=fedeo_central_web
    networks:
      - web
      - internal

  admin:
    restart: unless-stopped
    image: git.federspiel.tech/flfeders/fedeo/central-services-admin:${FEDEO_CENTRAL_TAG:-dev}
    env_file: ${CENTRAL_ENV_FILE:-.env}
    environment:
      NUXT_PUBLIC_API_BASE: https://${CENTRAL_API_DOMAIN}
    depends_on:
      api:
        condition: service_healthy
    labels:
      - traefik.enable=true
      - traefik.http.routers.fedeo-central-admin.rule=Host(`${CENTRAL_ADMIN_DOMAIN}`)
      - traefik.http.routers.fedeo-central-admin.entrypoints=websecure
      - traefik.http.routers.fedeo-central-admin.tls.certresolver=letsencrypt
      - traefik.http.services.fedeo-central-admin.loadbalancer.server.port=3000
      - traefik.docker.network=fedeo_central_web
    networks:
      - web

volumes:
  push_postgres_data:

networks:
  web:
    name: fedeo_central_web
  internal:
    name: fedeo_central_internal
    internal: true