services:
  nextcloud-aio-mastercontainer:
    container_name: nextcloud-aio-mastercontainer
    image: ghcr.io/nextcloud-releases/all-in-one:latest
    restart: unless-stopped
    init: true

    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /mnt/bindmounts:/mnt/bindmounts

    environment:
      - APACHE_PORT=11000
      - APACHE_IP_BINDING=0.0.0.0
      - NEXTCLOUD_PUBLIC_IP=82.65.62.73
      - NEXTCLOUD_TURN_PUBLIC_IP=82.65.62.73
      - NEXTCLOUD_MOUNT=/mnt/bindmounts
      - DOCKER_SECURITY_OPTS=apparmor=unconfined
      - SKIP_DOMAIN_VALIDATION=true

    ports:
      - 8080:8080
      
    networks:
      tan-network:
        ipv4_address: 10.10.0.80
      nextcloud-aio:

  nextcloud-proxy:
    image: alpine
    container_name: nextcloud-proxy
    command: tail -f /dev/null
    restart: unless-stopped

    networks:
      nextcloud-aio:

    labels:
      - traefik.enable=true

      # ROUTER
      - traefik.http.routers.nextcloud.rule=Host(`cloud.luckyden.org`)
      - traefik.http.routers.nextcloud.entrypoints=websecure
      - traefik.http.routers.nextcloud.tls.certresolver=cloudflare

      # SERVICE → apache AIO DIRECT
      - traefik.http.services.nextcloud.loadbalancer.server.url=http://nextcloud-aio-apache:11000

      # HEADERS NEXTCLOUD
      - traefik.http.middlewares.nextcloud.headers.customrequestheaders.X-Forwarded-Proto=https
      - traefik.http.middlewares.nextcloud.headers.customresponseheaders.Strict-Transport-Security=max-age=15552000

      # UPLOAD ILLIMITÉ
      - traefik.http.middlewares.nextcloud-buffer.buffering.maxRequestBodyBytes=0

      - traefik.http.routers.nextcloud.middlewares=nextcloud,nextcloud-buffer

networks:
  tan-network:
    external: true
  nextcloud-aio:
    external: true

volumes:
  nextcloud_aio_mastercontainer:
    external: true