services:
  web:
    image: quay.atyg.org/library/custom-nas-web:latest
    restart: unless-stopped
    env_file: stack.env
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-net"
      - "traefik.http.routers.nas-builder.rule=Host(`${SYSTEM_DOMAIN:-nas-builder.atyg.org}`)"
      - "traefik.http.routers.nas-builder.entrypoints=websecure"
      - "traefik.http.routers.nas-builder.tls=true"
      - "traefik.http.routers.nas-builder.middlewares=nas-auth"
      - "traefik.http.middlewares.nas-auth.basicauth.users=user:$$apr1$$QYYsT3Xb$$wQU3n/Mw8o3M/GiczXl/z."
      - "traefik.http.services.nas-builder.loadbalancer.server.port=80"
    expose:
      - "80"
    depends_on:
      - db
    networks:
      - default
      - traefik-net
    volumes:
      - spire-socket:/var/run/spire:ro

  db:
    image: acr.atyg.org/library/postgres:16-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-nasadmin}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-nas_builder}
    volumes:
      - db-data:/var/lib/postgresql/data
    networks:
      - default

volumes:
  db-data:
    driver: local
    driver_opts:
      type: none
      device: ${DB_DATA_PATH:-/volume1/docker/nas-builder/data}
      o: bind
  spire-socket:
    name: spire-socket
    external: true

networks:
  default:
    name: nas-builder-net
  traefik-net:
    external: true