services:
  # Das Portfolio (Next.js)
  w-make-portfolio:
    build: .
    image: w-make-portfolio:latest
    container_name: w-make-portfolio
    restart: always
    environment:
      - UPDATES_API_URL=http://updates-api:8080
    expose:
      - "3000"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.w-make.rule=Host(`w-make.com`) || Host(`www.w-make.com`)"
      - "traefik.http.routers.w-make.priority=100"
      - "traefik.http.routers.w-make.entrypoints=websecure"
      - "traefik.http.routers.w-make.tls=true"
      - "traefik.http.routers.w-make.tls.certresolver=http_resolver"
      - "traefik.http.routers.w-make.middlewares=default@file,crowdsec-bouncer-plugin@file"
      - "traefik.http.services.w-make.loadbalancer.server.port=3000"
    networks:
      - proxy
      - default

  updates-api:
    build:
      context: ./services/updates-api
    image: w-make-updates-api:latest
    container_name: w-make-updates-api
    restart: unless-stopped
    environment:
      - PORT=8080
      - HOSTNAME=0.0.0.0
      - UPDATES_DB_PATH=/data/updates.sqlite
      - UPDATES_ADMIN_TOKEN=${UPDATES_ADMIN_TOKEN:?UPDATES_ADMIN_TOKEN must be set}
    volumes:
      - updates_data:/data
    expose:
      - "8080"
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:8080/healthz', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
    security_opt:
      - no-new-privileges:true
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.w-make-updates.rule=Host(`updates.w-make.com`)"
      - "traefik.http.routers.w-make-updates.entrypoints=websecure"
      - "traefik.http.routers.w-make-updates.tls=true"
      - "traefik.http.routers.w-make-updates.tls.certresolver=http_resolver"
      - "traefik.http.routers.w-make-updates.middlewares=default@file,crowdsec-bouncer-plugin@file"
      - "traefik.http.services.w-make-updates.loadbalancer.server.port=8080"
    networks:
      - proxy
      - default

volumes:
  updates_data:

networks:
  proxy:
    external: true