name: passbolt
services:
  passbolt-db:
    image: mariadb:10.11
    container_name: ${CONTAINER_NAME}-db
    restart: ${RESTART_POLICY}
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      timeout: 5s
      retries: 10
      start_period: 30s
    environment:
      - MYSQL_ROOT_PASSWORD=${DB_MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=${DB_DATABASE}
      - MYSQL_USER=${DB_USER}
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - type: bind
        source: ${DB_PATH}
        target: /var/lib/mysql
        bind:
          create_host_path: true
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      internal_net:
        aliases:
          - passbolt-db

  passbolt:
    image: passbolt/passbolt:latest-ce
    container_name: ${CONTAINER_NAME}
    restart: ${RESTART_POLICY}
    depends_on:
      passbolt-db:
        condition: service_healthy
    environment:
      - APP_FULL_BASE_URL=https://${SUBDOMAIN}.${DOMAIN}
      - DATASOURCES_DEFAULT_HOST=passbolt-db
      - DATASOURCES_DEFAULT_PORT=3306
      - DATASOURCES_DEFAULT_DATABASE=${DB_DATABASE}
      - DATASOURCES_DEFAULT_USERNAME=${DB_USER}
      - DATASOURCES_DEFAULT_PASSWORD=${DB_PASSWORD}

      - PASSBOLT_SSL_FORCE=false
      - PASSBOLT_SECURITY_SSL_PROXY=HTTP_X_FORWARDED_PROTO
      # GPG settings
      - PASSBOLT_GPG_SERVER_KEY_FINGERPRINT=${GPG_FINGERPRINT}

      - PASSBOLT_KEY_EMAIL=markus.tabler@tutanota.com

      #- EMAIL_DEFAULT_TRANSPORT=${EMAIL_TRANSPORT}
      #- EMAIL_TRANSPORT_DEFAULT_HOST=smtp.example.com
      #- EMAIL_TRANSPORT_DEFAULT_PORT=587
      #- EMAIL_TRANSPORT_DEFAULT_USERNAME=user
      #- EMAIL_TRANSPORT_DEFAULT_PASSWORD=password
      #- EMAIL_TRANSPORT_DEFAULT_TLS=true
    extra_hosts:
      - "passwords.bybenji.de:172.17.0.1"
    volumes:
      - type: bind
        source: ${GPG_PATH}
        target: /etc/passbolt/gpg
        bind:
          create_host_path: true
      - type: bind
        source: ${JWT_PATH}
        target: /etc/passbolt/jwt
        bind:
          create_host_path: true
      #- type: bind
      #  source: ${GPG_DOT_PATH}
      #  target: /var/lib/passbolt/.gnupg
      #  bind:
      #    create_host_path: true
      #    selinux: z
      - passbolt_gnupg:/var/lib/passbolt/.gnupg
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - traefik
      - internal_net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${ROUTER_NAME}.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.${ROUTER_NAME}.entrypoints=websecure"
      - "traefik.http.routers.${ROUTER_NAME}.tls=true"
      - "traefik.http.routers.${ROUTER_NAME}.tls.certresolver=${CERTIFICATE_RESOLVER}"
      - "traefik.http.services.${ROUTER_NAME}.loadbalancer.server.port=80"
      - "traefik.docker.network=${TRAEFIK_NETWORK}"

      # Define the middleware that adds the header
      - "traefik.http.middlewares.passbolt-proxy.headers.customrequestheaders.X-Forwarded-Proto=https"
      # Apply that middleware to your router
      - "traefik.http.routers.${ROUTER_NAME}.middlewares=passbolt-proxy@docker"
networks:
  traefik:
    external: true
  internal_net:
    driver: bridge
volumes:
  passbolt_gnupg: