services:
  rackula:
    image: ghcr.io/rackulalives/rackula:persist
    restart: unless-stopped

    environment:
      #- API_HOST=rackula-api
      #- API_PORT=${RACKULA_API_PORT}
      - RACKULA_LISTEN_PORT=${RACKULA_LISTEN_PORT}
      - API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN:-}
      - RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE}
      - TRUST_PROXY=true

    depends_on:
      - rackula-api

    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    read_only: false

    tmpfs:
      - /var/cache/nginx:size=10M
      - /var/run:size=1M
      - /tmp:size=5M
      - /etc/nginx/conf.d:size=1M,uid=101,gid=101

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

    networks:
      tan-network:
        ipv4_address: 10.10.0.190

    labels:
      - traefik.enable=true
      - traefik.http.routers.rackula.rule=Host(`rackula.luckyden.org`)
      - traefik.http.routers.rackula.entrypoints=websecure
      - traefik.http.routers.rackula.tls.certresolver=cloudflare
      - traefik.http.services.rackula.loadbalancer.server.port=80
      - traefik.http.middlewares.rackula.headers.customrequestheaders.X-Forwarded-Proto=https
      - traefik.http.middlewares.rackula.headers.customrequestheaders.X-Forwarded-Port=443
      - traefik.http.routers.rackula.middlewares=rackula

  rackula-api:
    image: ghcr.io/rackulalives/rackula-api:latest
    restart: unless-stopped

    volumes:
      - /home/docker/RackuDen/api/data:/data

    environment:
      - DATA_DIR=/data
      - RACKULA_API_PORT=${RACKULA_API_PORT}
      - CORS_ORIGIN=${CORS_ORIGIN}
      - RACKULA_API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN}
      - RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE}
      - RACKULA_LOCAL_USERNAME=${RACKULA_LOCAL_USERNAME}
      - RACKULA_LOCAL_PASSWORD=${RACKULA_LOCAL_PASSWORD}
      - ALLOW_INSECURE_CORS=false
      - RACKULA_AUTH_SESSION_SECRET=${RACKULA_AUTH_SESSION_SECRET}
      - RACKULA_AUTH_SESSION_COOKIE_SECURE=${RACKULA_AUTH_SESSION_COOKIE_SECURE}
      - RACKULA_AUTH_CSRF_PROTECTION=${RACKULA_AUTH_CSRF_PROTECTION}

    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    read_only: false

    tmpfs:
      - /tmp:size=5M

    logging:
      driver: json-file
      options:
        max-size: "5m"
        max-file: "2"

    networks:
      tan-network:
        ipv4_address: 10.10.0.191

networks:
  tan-network:
    external: true