# Compose-Service für eldov.win.
# Host: free-warez.win (gleicher VPS-Cluster wie w-make.com).
# Traefik routet eldov.win per Docker-Labels zum Container.
#
# Auf dem VPS muss liegen:
#   - Traefik-Netzwerk 'proxy' (vom traefik3-crowdsec-stack Container erstellt)
#   - .env.local mit ADMIN_PASSWORD + SESSION_SECRET
#   - Volume 'eldov_data' für die SQLite-DB

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-https://eldov.win}
        NEXT_PUBLIC_BUILD_HASH: ${NEXT_PUBLIC_BUILD_HASH:-dev}
        NEXT_PUBLIC_BUILD_DATE: ${NEXT_PUBLIC_BUILD_DATE:-1970-01-01}
    image: eldov-portfolio:1.0.0
    container_name: eldov-portfolio
    mem_limit: 512m
    restart: unless-stopped
    env_file:
      - .env.local
    environment:
      - NODE_ENV=production
      - NEXT_TELEMETRY_DISABLED=1
      - DB_PATH=/app/data/eldov.db
      # Hinter Traefik: X-Forwarded-For für Rate-Limiting vertrauen
      - TRUST_PROXY_HEADERS=true
    volumes:
      - eldov_data:/app/data
    expose:
      - "3000"
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/').then(r=>process.exit(r.ok||r.status===307?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - default
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.eldov-win.rule=Host(`eldov.win`) || Host(`www.eldov.win`)"
      - "traefik.http.routers.eldov-win.priority=100"
      - "traefik.http.routers.eldov-win.entrypoints=websecure"
      - "traefik.http.routers.eldov-win.tls=true"
      - "traefik.http.routers.eldov-win.tls.certresolver=http_resolver"
      - "traefik.http.routers.eldov-win.middlewares=my-get-real-ip@file,default@file,crowdsec-bouncer-plugin@file"
      - "traefik.http.routers.eldov-win.service=eldov-win"
      - "traefik.http.services.eldov-win.loadbalancer.server.port=3000"
      - "com.centurylinklabs.watchtower.enable=false"
      # HTTP→HTTPS-Redirect für die unverschlüsselte Variante (Traefik
      # bringt dafür eine eingebaute redirectScheme-Middleware mit).
      - "traefik.http.routers.eldov-win-http.rule=Host(`eldov.win`) || Host(`www.eldov.win`)"
      - "traefik.http.routers.eldov-win-http.entrypoints=web"
      - "traefik.http.routers.eldov-win-http.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"

volumes:
  eldov_data:
    name: eldov_data

networks:
  proxy:
    name: proxy
    external: true