version: '3.5'

volumes:
  wordpress:
  nextcloud:

networks:
  traefik:
    name: traefik

services:
  traefik:
    image: traefik:${TRAEFIK_VERSION:-latest}
    restart: always
    command:
      - --api.dashboard=${TRAEFIK_DASHBOARD:-true}
      - --api.debug=${TRAEFIK_DEBUG:-false}
      - --log.level=${TRAEFIK_LOG_LEVEL:-ERROR}
      - --providers.docker=true
      - --providers.docker.exposedbydefault=${TRAEFIK_EXPOSED_DEFAULT:-false}
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.local.address=:8443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/etc/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=${TRAEFIK_ACME_PROVIDER:-manual}
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=0
      - --certificatesresolvers.letsencrypt.acme.caserver=${TRAEFIK_ACME_CASERVER:-https://acme-staging-v02.api.letsencrypt.org/directory}
    environment:
      DREAMHOST_API_KEY: ${TRAEFIK_DREAMHOST_APIKEY}
    ports:
      - 80:80
      - 443:443
      - "127.0.0.1:8443:8443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./.acme:/etc/letsencrypt
    labels:
      traefik.http.routers.api.rule: Host(`${TRAEFIK_DOMAIN:-traefik.local.freeitathens.org}`)
      traefik.http.routers.api.entrypoints: local
      traefik.http.routers.api.service: api@internal
      traefik.http.routers.api.tls: true
      traefik.http.routers.api.tls.certresolver: letsencrypt
      traefik.http.routers.api.tls.domains[0].main: ${TRAEFIK_ACME_DOMAIN_MAIN:-local.freeitathens.org}
      traefik.http.routers.api.tls.domains[0].sans: "${TRAEFIK_ACME_DOMAIN_SANS:-*.local.freeitathens.org}"
      traefik.enable: ${TRAEFIK_WEB_ENABLED:-true}
    networks:
      - traefik

  wordpress:
    image: wordpress:${WORDPRESS_VERSION:-latest}
    restart: always
    environment:
      WORDPRESS_DB_HOST: ${WORDPRESS_DB_HOST:-host.docker.internal}
      WORDPRESS_DB_NAME: ${WORDPRESS_DB_NAME-wordpress}
      WORDPRESS_DB_USER: ${WORDPRESS_DB_USER:-wordpress}
      WORDPRESS_DB_PASSWORD: ${WORDPRESS_DB_PASSWORD}
    labels:
      traefik.http.routers.wordpress.rule: Host(`${WORDPRESS_DOMAIN:-www.local.freeitathens.org}`,`${TRAEFIK_ACME_DOMAIN_MAIN:-local.freeitathens.org}`)
      traefik.http.routers.wordpress.entrypoints: websecure
      traefik.http.routers.wordpress.middlewares: "wwwredirect"
      traefik.http.routers.wordpress.tls: true
      traefik.http.routers.wordpress.tls.certresolver: letsencrypt
      traefik.http.routers.wordpress.tls.domains[0].main: ${TRAEFIK_ACME_DOMAIN_MAIN:-local.freeitathens.org}
      traefik.http.routers.wordpress.tls.domains[0].sans: "${TRAEFIK_ACME_DOMAIN_SANS:-*.local.freeitathens.org}"
      traefik.http.middlewares.wwwredirect.redirectregex.regex: "^https://${TRAEFIK_ACME_DOMAIN_MAIN:-local.freeitathens.org}/(.*)"
      traefik.http.middlewares.wwwredirect.redirectregex.replacement: "https://${WORDPRESS_DOMAIN:-www.local.freeitathens.org}/$${1}"
      traefik.http.middlewares.wwwredirect.redirectregex.permanent: true
      traefik.http.services.wordpress.loadbalancer.server.port: 80
      traefik.docker.network: traefik
      traefik.enable: ${WORDPRESS_WEB_ENABLED:-true}
    volumes:
      - wordpress:/var/www/html
    networks:
      - traefik
    extra_hosts:
      - host.docker.internal:host-gateway

  nextcloud:
    image: nextcloud:${NEXTCLOUD_VERSION:-stable}
    restart: always
    environment:
      MYSQL_HOST: ${NEXTCLOUD_MYSQL_HOST:-host.docker.internal:3306}
      MYSQL_DATABASE: ${NEXTCLOUD_MYSQL_DATABASE-nextcloud}
      MYSQL_USER: ${NEXTCLOUD_MYSQL_USER:-nextcloud}
      MYSQL_PASSWORD: ${NEXTCLOUD_MYSQL_PASSWORD}
    labels:
      traefik.http.routers.nextcloud.rule: "Host(`${NEXTCLOUD_DOMAIN:-cloud.local.freeitathens.org}`)"
      traefik.http.routers.nextcloud.entrypoints: websecure
      traefik.http.routers.nextcloud.tls: true
      traefik.http.routers.nextcloud.tls.certresolver: letsencrypt
      traefik.http.routers.nextcloud.tls.domains[0].main: ${TRAEFIK_ACME_DOMAIN_MAIN:-local.freeitathens.org}
      traefik.http.routers.nextcloud.tls.domains[0].sans: "${TRAEFIK_ACME_DOMAIN_SANS:-*.local.freeitathens.org}"
      traefik.http.services.nextcloud.loadbalancer.server.port: 80
      traefik.http.middlewares.nextcloud-webdav.redirectregex.regex: "https://(.*)/.well-known/(card|cal)dav"
      traefik.http.middlewares.nextcloud-webdav.redirectregex.replacement: "https://$${1}/remote.php/dav/"
      traefik.http.middlewares.nextcloud-webdav.redirectregex.permanent: true
      traefik.http.routers.nextcloud.middlewares: nextcloud-webdav
      traefik.docker.network: traefik
      traefik.enable: ${NEXTCLOUD_WEB_ENABLED:-true}
    volumes:
      - nextcloud:/var/www/html
    networks:
      - traefik
    extra_hosts:
      - host.docker.internal:host-gateway