services:

  postgresql:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready -d $${DENACCESS_POSTGRES_DB} -U $${DENACCESS_POSTGRES_USER}
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - /home/docker/DenAccess/database:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
      - POSTGRES_USER=${DENACCESS_POSTGRES_USER}
      - POSTGRES_DB=${DENACCESS_POSTGRES_DB}
    env_file:
      - .env
    networks:
      tan-network:
        ipv4_address: 10.10.0.30

  redis:
    image: docker.io/library/redis:alpine
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    healthcheck:
      test:
        - CMD-SHELL
        - redis-cli ping | grep PONG
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - /home/docker/DenAccess/redis:/data
    networks:
      tan-network:
        ipv4_address: 10.10.0.31

  server:
    image: ghcr.io/goauthentik/server:2025.10.2
    restart: unless-stopped
    command: server

    environment:
      - AUTHENTIK_REDIS__HOST=redis
      - AUTHENTIK_POSTGRESQL__HOST=postgresql
      - AUTHENTIK_POSTGRESQL__USER=${DENACCESS_POSTGRES_USER}
      - AUTHENTIK_POSTGRESQL__NAME=${DENACCESS_POSTGRES_DB}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
      - AUTHENTIK_ERROR_REPORTING__ENABLED=true
      - AUTHENTIK_SECRET_KEY=${DENACCESS_AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_HOST=${DENACCESS_AUTHENTIK_HOST}
      - AUTHENTIK_INSECURE=false
      - AUTHENTIK_COOKIE__SECURE=true
      - AUTHENTIK_SESSION__COOKIE_SECURE=true
      - TRUSTED_PROXIES=10.10.0.20
    volumes:
      - /home/docker/DenAccess/media:/media
      - /home/docker/DenAccess/custom-templates:/templates
    env_file:
      - .env
    depends_on:
      - postgresql
      - redis
    networks:
      tan-network:
        ipv4_address: 10.10.0.32
    labels:
      - traefik.enable=true
      # ROUTER
      - traefik.http.routers.authentik-server.rule=Host(`access.luckyden.org`)
      - traefik.http.routers.authentik-server.entrypoints=websecure
      - traefik.http.routers.authentik-server.tls=true
      - traefik.http.routers.authentik-server.priority=10
      # SERVICE (HTTP interne uniquement !)
      - traefik.http.services.authentik-server.loadbalancer.server.port=9000
      # HEADERS IMPORTANT (auth flows)
      - traefik.http.middlewares.authentik-headers.headers.customrequestheaders.X-Forwarded-Proto=https
      - traefik.http.routers.authentik-server.middlewares=authentik-headers

  worker:
    image: ghcr.io/goauthentik/server:2025.10.2
    restart: unless-stopped
    command: worker

    environment:
      - AUTHENTIK_REDIS__HOST=redis
      - AUTHENTIK_POSTGRESQL__HOST=postgresql
      - AUTHENTIK_POSTGRESQL__USER=${DENACCESS_POSTGRES_USER}
      - AUTHENTIK_POSTGRESQL__NAME=${DENACCESS_POSTGRES_DB}
      - AUTHENTIK_POSTGRESQL__PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
      - AUTHENTIK_ERROR_REPORTING__ENABLED=true
      - AUTHENTIK_SECRET_KEY=${DENACCESS_AUTHENTIK_SECRET_KEY}
      - AUTHENTIK_HOST=${DENACCESS_AUTHENTIK_HOST}
      - AUTHENTIK_INSECURE=false

    user: root

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /home/docker/DenAccess/media:/media
      - /home/docker/DenAccess/certs:/certs
      - /home/docker/DenAccess/custom-templates:/templates

    env_file:
      - .env

    depends_on:
      - postgresql
      - redis
      - server

    networks:
      tan-network:
        ipv4_address: 10.10.0.33

  authentik-proxy:
    image: ghcr.io/goauthentik/proxy:2025.10.2
    restart: unless-stopped
    expose:
      - 9000
    environment:
      AUTHENTIK_PROXY_SESSION_STORAGE: filesystem
      AUTHENTIK_PROXY_SESSION_STORAGE_FILESYSTEM_PATH: /sessions
      AUTHENTIK_HOST: http://server:9000
      AUTHENTIK_INSECURE: "false"
      AUTHENTIK_TOKEN: "${AUTHENTIK_TOKEN}"
      AUTHENTIK_HOST_BROWSER: ${AUTHENTIK_HOST_BROWSER}
    labels:
      - traefik.enable=true
      # ROUTE OUTPOST ✅
      - traefik.http.routers.authentik-outpost.rule=Host(`access.luckyden.org`) && PathPrefix(`/outpost.goauthentik.io`)
      - traefik.http.routers.authentik-outpost.entrypoints=websecure
      - traefik.http.routers.authentik-outpost.tls=true
      - traefik.http.services.authentik-outpost.loadbalancer.server.port=9000
      - traefik.http.routers.authentik-outpost.priority=100
      # ✅ LE MIDDLEWARE
      - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
      - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
      - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
    volumes:
      - /home/docker/DenAccess/proxy/sessions:/sessions
    networks:
      tan-network:
        ipv4_address: 10.10.0.34
    shm_size: 512m
    depends_on:
      - server

networks:
  tan-network:
    external: true