x-environment: &app-environment
  DOMAIN: "${DOMAIN:-furyhawk.lol}"
  STREAMLIT_FIN_SERVER_PORT: 8501
  BAI_LOCATION: ""
  STREAMLIT_BAI_SERVER_PORT: 8502
  GROQ_API_KEY: "${GROQ_API_KEY}"

volumes:
  # bai_cache: {}
  jellyfin_config: {}
  jellyfin_cache: {}
  # adminer_data: {}
  # privatebin_data: {}

networks:
  traefik-public:
    external: true

services:

  adminer:
    image: adminer
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD}
      PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
      PYTHONPATH: "/pgadmin4"
      TZ: Asia/Singapore
      DOMAIN: ${DOMAIN}
      ADMINER_DESIGN: pepa-linha-dark
    volumes:
      - /var/data/adminer_data:/var/lib/pgadmin
    restart: unless-stopped
    # depends_on:
    #   - postgres_db
    networks:
      - traefik-public
    deploy:
      # placement:
      #   constraints:
      #     - node.labels.adminer.pgadmin == true
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.adminer.entrypoints=https
        - traefik.http.routers.adminer.rule=Host(`adminer.${DOMAIN}`) || Host(`dbadmin.${DOMAIN}`)
        - traefik.http.routers.adminer.tls.certresolver=le
        - traefik.http.routers.adminer.service=adminer_app
        - traefik.http.routers.adminer-local.entrypoints=https
        - traefik.http.routers.adminer-local.rule=Host(`adminer.${LOCALDOMAIN}`) || Host(`dbadmin.${LOCALDOMAIN}`)
        - traefik.http.routers.adminer-local.tls=true
        - traefik.http.routers.adminer-local.service=adminer_app
        - traefik.http.services.adminer_app.loadbalancer.server.port=8080

  cheatsheets_app:
    image: furyhawk/cheatsheets:${CHEATSHEETSTAG:-latest}
    restart: unless-stopped
    networks:
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.cheatsheets.entrypoints=https
        - traefik.http.routers.cheatsheets.rule=Host(`cheat.${DOMAIN}`)
        - traefik.http.routers.cheatsheets.tls.certresolver=le
        - traefik.http.routers.cheatsheets.service=cheatsheets_app
        - traefik.http.routers.cheatsheets-local.entrypoints=https
        - traefik.http.routers.cheatsheets-local.rule=Host(`cheat.${LOCALDOMAIN}`)
        - traefik.http.routers.cheatsheets-local.tls=true
        - traefik.http.routers.cheatsheets-local.service=cheatsheets_app
        - traefik.http.services.cheatsheets_app.loadbalancer.server.port=80

  heynote_app:
    image: furyhawk/heynote:${HEYNOTETAG:-latest}
    restart: unless-stopped
    environment:
      NODE_ENV: production
      DOMAIN: ${DOMAIN}
    networks:
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.heynote.entrypoints=https
        - traefik.http.routers.heynote.rule=Host(`note.${DOMAIN}`) || Host(`note0.${DOMAIN}`) || Host(`n.${DOMAIN}`) || Host(`pad.${DOMAIN}`)
        # - traefik.http.routers.heynote.rule=HostRegexp(`note[0-9]{0,2}.${DOMAIN}`) || Host(`pad.${DOMAIN}`)
        - traefik.http.routers.heynote.tls.certresolver=le
        - traefik.http.routers.heynote.service=heynote_app
        - traefik.http.routers.heynote-local.entrypoints=https
        - traefik.http.routers.heynote-local.rule=Host(`note.${LOCALDOMAIN}`)
        - traefik.http.routers.heynote-local.tls=true
        - traefik.http.routers.heynote-local.service=heynote_app
        - traefik.http.services.heynote_app.loadbalancer.server.port=5173

  jellyfin:
    image: jellyfin/jellyfin
    restart: 'unless-stopped'
    environment:
      - DOMAIN=${DOMAIN}
      - MEDIADIR=${MEDIADIR}
      - JELLYFIN_PublishedServerUrl=https://media.${DOMAIN}
    # user: "1000:1000"
    volumes:
      - jellyfin_config:/config
      - jellyfin_cache:/cache
      - type: bind
        source: ${MEDIADIR}
        target: /media
        read_only: false
    # Optional - alternative address used for autodiscovery
    networks:
      - traefik-public
    deploy:
      placement:
        constraints:
          - node.labels.jellyfin.jellyfin_config == true
          # - node.labels.jellyfin.jellyfin_cache == true
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.jellyfin.entrypoints=https
        - traefik.http.routers.jellyfin.rule=Host(`media.${DOMAIN}`)
        - traefik.http.routers.jellyfin.tls.certresolver=le
        - traefik.http.routers.jellyfin.service=jellyfin_app
        - traefik.http.services.jellyfin_app.loadbalancer.server.port=8096

  meshtastic_web:
    image: ghcr.io/meshtastic/web
    restart: unless-stopped
    expose:
      - 8080
      - 8443
    networks:
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.meshtastic.entrypoints=https
        - traefik.http.routers.meshtastic.rule=Host(`mesh.${DOMAIN}`)
        - traefik.http.routers.meshtastic.tls.certresolver=le
        - traefik.http.routers.meshtastic.service=meshtastic_app
        - traefik.http.services.meshtastic_app.loadbalancer.server.port=8080

  privatebin:
    image: privatebin/nginx-fpm-alpine:latest
    read_only: true
    volumes:
      - /var/data/privatebin_data:/srv/data # data volume for pastes allows pastes
      # to persist after container stop or restart
      - "/var/data/config/conf.php:/srv/cfg/conf.php:ro" # second volume for custom configuration file
    restart: unless-stopped
    networks:
      - traefik-public
    deploy:
      # placement:
      #   constraints:
      #     - node.labels.privatebin.privatebin_data == true
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.privatebin.entrypoints=https
        - traefik.http.routers.privatebin.rule=Host(`bin.${DOMAIN}`) || Host(`paste.${DOMAIN}`)
        - traefik.http.routers.privatebin.tls.certresolver=le
        - traefik.http.routers.privatebin.service=privatebin_app
        - traefik.http.services.privatebin_app.loadbalancer.server.port=8080

  streamlit-bai:
    environment:
      <<: *app-environment
    image: furyhawk/beyondallinfo:latest
    restart: unless-stopped
    command: streamlit run --server.port=$STREAMLIT_BAI_SERVER_PORT --server.address=0.0.0.0 --server.baseUrlPath=$BAI_LOCATION src/app.py
    volumes:
      - /var/data/bai_cache:/app/cache
    networks:
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.streamlit-bai.entrypoints=https
        - traefik.http.routers.streamlit-bai.rule=Host(`bai.${DOMAIN}`)
        - traefik.http.routers.streamlit-bai.tls.certresolver=le
        - traefik.http.routers.streamlit-bai.service=streamlit_bai_app
        - traefik.http.services.streamlit_bai_app.loadbalancer.server.port=${STREAMLIT_BAI_SERVER_PORT}

  streamlit-fin:
    environment:
      <<: *app-environment
    image: furyhawk/llama3toolsfin:main
    restart: unless-stopped
    networks:
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.streamlit-fin.entrypoints=https
        - traefik.http.routers.streamlit-fin.rule=Host(`fin.${DOMAIN}`)
        - traefik.http.routers.streamlit-fin.tls.certresolver=le
        - traefik.http.routers.streamlit-fin.service=streamlit_fin_app
        - traefik.http.services.streamlit_fin_app.loadbalancer.server.port=${STREAMLIT_FIN_SERVER_PORT}

  site_server:
    image: nginx:alpine
    restart: unless-stopped
    volumes:
      - /var/data/site:/usr/share/nginx/html:ro
    networks:
      - traefik-public
    deploy:
      # placement:
      #   constraints:
      #     - node.labels.site.site_server == true
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.site_server.entrypoints=https
        - traefik.http.routers.site_server.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`) || Host(`info.${DOMAIN}`) || Host(`124c41.${DOMAIN}`)
        - traefik.http.routers.site_server.middlewares=no-www
        - traefik.http.routers.site_server.tls.certresolver=le
        - traefik.http.routers.site_server.service=site_server_app
        - traefik.http.services.site_server_app.loadbalancer.server.port=80
        - "traefik.http.routers.resume_router.entrypoints=https"
        - "traefik.http.routers.resume_router.rule=Host(`resume.${DOMAIN}`)"
        - "traefik.http.routers.resume_router.middlewares=redirect-resume"
        - "traefik.http.routers.resume_router.tls.certresolver=le"
        - "traefik.http.routers.resume_router.service=resume_server"
        - "traefik.http.services.resume_server.loadbalancer.server.port=80"
        - "traefik.http.routers.blog_router.entrypoints=https"
        - "traefik.http.routers.blog_router.rule=Host(`blog.${DOMAIN}`)"
        - "traefik.http.routers.blog_router.middlewares=redirect-blog"
        - "traefik.http.routers.blog_router.tls.certresolver=le"
        - "traefik.http.routers.blog_router.service=blog_server"
        - "traefik.http.services.blog_server.loadbalancer.server.port=80"