services:
  app:
    build:
      context: .
      args:
        NEXT_PUBLIC_BASE_URL: ${NEXT_PUBLIC_BASE_URL}
        NEXT_PUBLIC_TARGET: ${TARGET:-development}
    image: registry.infra.mintel.me/mintel/mintel.me:${IMAGE_TAG:-latest}
    restart: always
    networks:
      - infra
    env_file:
      - ${ENV_FILE:-.env}
    labels:
      - "traefik.enable=false"

  varnish:
    image: varnish:7
    restart: always
    networks:
      - infra
    volumes:
      - ./varnish/default.vcl:/etc/varnish/default.vcl:ro
    tmpfs:
      - /var/lib/varnish:exec
    environment:
      VARNISH_SIZE: ${VARNISH_CACHE_SIZE:-256M}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.rule=Host(`${TRAEFIK_HOST}`) && !PathPrefix(`/.well-known/acme-challenge/`)"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.entrypoints=web"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.middlewares=redirect-https"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.rule=Host(`${TRAEFIK_HOST}`)"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.entrypoints=websecure"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls.certresolver=le"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls=true"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.service=${PROJECT_NAME:-mintel-me}"
      - "traefik.http.services.${PROJECT_NAME:-mintel-me}.loadbalancer.server.port=80"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.middlewares=${PROJECT_NAME:-mintel-me}-ratelimit,${AUTH_MIDDLEWARE:-compress}"

      # Gatekeeper
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.rule=Host(`${TRAEFIK_HOST}`) && PathPrefix(`/gatekeeper`)"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.entrypoints=websecure"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls.certresolver=le"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls=true"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.service=${PROJECT_NAME:-mintel-me}-gatekeeper"

      # Middleware Definitions
      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-ratelimit.ratelimit.average=100"
      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-ratelimit.ratelimit.burst=50"
      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/verify"
      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.authResponseHeaders=X-Auth-User"

  gatekeeper:
    image: registry.infra.mintel.me/mintel/gatekeeper:latest
    container_name: ${PROJECT_NAME:-mintel-me}-gatekeeper
    restart: always
    networks:
      - infra
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      PORT: 3000
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.${PROJECT_NAME:-mintel-me}-gatekeeper.loadbalancer.server.port=3000"

  directus:
    image: registry.infra.mintel.me/mintel/directus:latest
    restart: always
    networks:
      - infra
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      KEY: ${DIRECTUS_KEY}
      SECRET: ${DIRECTUS_SECRET}
      DB_CLIENT: 'pg'
      DB_HOST: 'directus-db'
      DB_PORT: '5432'
      DB_DATABASE: ${DIRECTUS_DB_NAME:-directus}
      DB_USER: ${DIRECTUS_DB_USER:-directus}
      DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-directus}
      PUBLIC_URL: ${DIRECTUS_URL:-https://cms.mintel.me}
    volumes:
      - ./directus/uploads:/directus/uploads
      - ./directus/extensions:/directus/extensions
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.rule=Host(`${DIRECTUS_HOST}`)"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.entrypoints=websecure"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls.certresolver=le"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls=true"
      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.middlewares=${AUTH_MIDDLEWARE:-compress}"
      - "traefik.http.services.${PROJECT_NAME:-mintel-me}-directus.loadbalancer.server.port=8055"

  directus-db:
    image: postgres:15-alpine
    restart: always
    networks:
      - infra
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      POSTGRES_DB: ${DIRECTUS_DB_NAME:-directus}
      POSTGRES_USER: ${DIRECTUS_DB_USER:-directus}
      POSTGRES_PASSWORD: ${DIRECTUS_DB_PASSWORD:-directus}
    volumes:
      - directus-db-data:/var/lib/postgresql/data

networks:
  infra:
    external: true

volumes:
  directus-db-data: