services:
  app:
    image: ${APP_IMAGE_NAME:-website-starter:local}
    build:
      context: .
      args:
        APP_NAME: ${APP_NAME:-Example Website}
        APP_URL: ${APP_URL:-https://example.com}
        COMPANY_NAME: ${COMPANY_NAME:-Example Company}
        CONTACT_EMAIL: ${CONTACT_EMAIL:-info@example.com}
        CONTACT_PHONE: ${CONTACT_PHONE:-+49 000 000000}
        CONTACT_ADDRESS: ${CONTACT_ADDRESS:-Example Street 1, 12345 Example City}
    environment:
      CALENDAR_URL: ${CALENDAR_URL}
      APP_NAME: ${APP_NAME:-Example Website}
      APP_URL: ${APP_URL:-https://example.com}
      COMPANY_NAME: ${COMPANY_NAME:-Example Company}
      CONTACT_EMAIL: ${CONTACT_EMAIL:-info@example.com}
      CONTACT_PHONE: ${CONTACT_PHONE:-+49 000 000000}
      CONTACT_ADDRESS: ${CONTACT_ADDRESS:-Example Street 1, 12345 Example City}
      CORS_ORIGIN: ${CORS_ORIGIN:-}
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-["172.16.0.0/12"]}
      HOSTNAME: 0.0.0.0
      PORT: 3000
    expose:
      - "3000"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:size=64m,mode=1777
    networks:
      - traefik-external
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.docker.network=${TRAEFIK_NETWORK_NAME:-traefik-external}
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}.rule=Host(`${PRIMARY_DOMAIN:-example.com}`)
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}.entrypoints=websecure
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}.service=${TRAEFIK_STACK_NAME:-website-starter}
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}-api.rule=Host(`${PRIMARY_DOMAIN:-example.com}`) && PathPrefix(`/api`)
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}-api.entrypoints=websecure
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}-api.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}-api.priority=100
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}-api.service=${TRAEFIK_STACK_NAME:-website-starter}
      - traefik.http.routers.${TRAEFIK_STACK_NAME:-website-starter}-api.middlewares=${TRAEFIK_STACK_NAME:-website-starter}-api-ratelimit
      - traefik.http.middlewares.${TRAEFIK_STACK_NAME:-website-starter}-api-ratelimit.ratelimit.average=60
      - traefik.http.middlewares.${TRAEFIK_STACK_NAME:-website-starter}-api-ratelimit.ratelimit.period=1m
      - traefik.http.middlewares.${TRAEFIK_STACK_NAME:-website-starter}-api-ratelimit.ratelimit.burst=60
      - traefik.http.services.${TRAEFIK_STACK_NAME:-website-starter}.loadbalancer.server.port=3000
      - traefik.http.services.${TRAEFIK_STACK_NAME:-website-starter}.loadbalancer.passHostHeader=true
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "4"
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health/live').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.75"

networks:
  traefik-external:
    external: true
    name: ${TRAEFIK_NETWORK_NAME:-traefik-external}