services:
  cronicle:
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:rw
      - /volume1/docker/cronicle/data:/opt/cronicle/data:rw
      - /volume1/docker/cronicle/logs:/opt/cronicle/logs:rw
      - /volume1/docker/cronicle/plugins:/opt/cronicle/plugins:rw
      - /volume1/docker/cronicle/app:/opt/cronicle/app:rw
      - /volume1/docker/cronicle/ssh_keys:/opt/cronicle/ssh_keys:rw
    hostname: schedule
    ports:
      - 3012:3012
    image: bluet/cronicle-docker:latest
    environment:
      - CRONICLE_base_app_url=https://schedule.${DOMAIN}
      - CRONICLE_WebServer__http_port=3012
      - CRONICLE_WebServer__https_port=443
      - CRONICLE_web_socket_use_hostnames=1
      - CRONICLE_server_comm_use_hostnames=1
      - CRONICLE_web_direct_connect=0
      - CRONICLE_custom_live_log_socket_url=schedule.${DOMAIN}
    networks:
      traefik_backend:
        aliases:
          - schedule
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.cron.rule=Host(`schedule.${DOMAIN}`)
        - traefik.http.routers.cron.tls=true
        - traefik.http.routers.cron.tls.certresolver=letsencrypt
        - traefik.http.routers.cron.entrypoints=websecure
        - traefik.http.services.cron.loadbalancer.server.port=3012
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.cron.middlewares=forwardAuth-authentik@file, crowdsec@file
        - traefik.http.routers.cron-ip.rule=Host(`schedule.${DOMAIN}`) && ClientIP(`10.0.0.0/8`)
        - traefik.http.routers.cron-ip.tls=true
        - traefik.http.routers.cron-ip.tls.certresolver=letsencrypt
        - traefik.http.routers.cron-ip.entrypoints=websecure
      resources:
        limits:
          cpus: '2' # Limit to 0.5 CPU core
          memory: 512M

  uptime-kuma:
    image: louislam/uptime-kuma:2
    hostname: uptime-kuma
    volumes:
      - /volume1/docker/uptime-kuma/data:/app/data
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - TZ=PST
      - UMASK=0022
    networks:
      - traefik_backend
      - postgresql_db-backend
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001"]
      interval: 30s
      retries: 3
      start_period: 10s
      timeout: 5s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      restart_policy:
        delay: 30s
      labels:
        - traefik.enable=true
        - traefik.http.routers.uptime.rule=Host(`uptime.${DOMAIN}`)
        - traefik.http.routers.uptime.tls=true
        - traefik.http.routers.uptime.tls.certresolver=letsencrypt
        - traefik.http.routers.uptime.entrypoints=websecure
        - traefik.http.services.uptime.loadbalancer.server.port=3001
        - traefik.http.services.uptime.loadbalancer.server.scheme=http
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.uptime.middlewares=forwardAuth-authentik@file, crowdsec@file

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true