---
version: '3'
services:
  database:
    image: postgres:13-alpine
    environment:
      - POSTGRES_USER={{ hedgedoc.db.user }}
      - POSTGRES_PASSWORD={{ hedgedoc.db.password }}
      - POSTGRES_DB={{ hedgedoc.db.name }}
    volumes:
      - database:/var/lib/postgresql/data
    labels:
      - "com.centurylinklabs.watchtower.scope=update"
    restart: always
    networks:
      - backend

  app:
    # Make sure to use the latest release from https://hedgedoc.org/latest-release
    image: quay.io/hedgedoc/hedgedoc:1.9.3
    environment:
      - CMD_DB_URL=postgres://{{ hedgedoc.db.user }}:{{ hedgedoc.db.password }}@database:5432/{{ hedgedoc.db.name }}
      - CMD_DOMAIN=doc.tobiasmanske.de
      - CMD_ALLOW_ORIGIN=doc.tobiasmanske.de,localhost
      - CMD_CSP_ENABLE=true
      - CMD_PROTOCOL_USESSL=true
      - CMD_PROTOCOL_USE_SSL=true
      - CMD_ALLOW_EMAIL_REGISTER=false
      - CMD_ALLOW_ANONYMOUS=false
      - CMD_ALLOW_ANONYMOUS_EDITS=true
      - CMD_ALLOW_FREEURL=true
      - CMD_DEFAULT_PERMISSION=private
      - CMD_SESSION_SECRET={{ hedgedoc.cmd.session_secret }}
      - CMD_OAUTH2_CLIENT_ID={{ hedgedoc.cmd.client_id }}
      - CMD_OAUTH2_CLIENT_SECRET={{ hedgedoc.cmd.client_secret }}
      - CMD_OAUTH2_AUTHORIZATION_URL={{ hedgedoc.cmd.authorization_url }}
      - CMD_OAUTH2_TOKEN_URL={{ hedgedoc.cmd.token_url }}
      - CMD_OAUTH2_USER_PROFILE_URL={{ hedgedoc.cmd.user_profile_url }}
      - CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR=ocs.data.id
      - CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR=ocs.data.display-name
      - CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR=ocs.data.email
    volumes:
      - uploads:/hedgedoc/public/uploads
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.hedgedoc.rule=Host(`doc.tobiasmanske.de`)"
      - "traefik.http.routers.hedgedoc.entryPoints=websecure"
      - "traefik.http.services.hedgedoc.loadbalancer.server.port=3000"
      - "com.centurylinklabs.watchtower.scope=update"
    depends_on:
      - database
    networks:
      - backend
      - gateway

volumes:
  database:
  uploads:

networks:
  gateway:
    external: true
  backend:
    internal: true
...