services:
  some-guacamole:
    image: "guacamole/guacamole:latest"
    environment:
      - "GUACAMOLE_HOME=/opt/guacamole"
      # Guacd connection
      - "GUACD_HOSTNAME=some-guacd"
      - "GUACD_PORT=4822"
      # LDAP
      - "LDAP_CONFIG_BASE_DN=OU=AAD Sync,OU=House Members,OU=Topside Pinnacle,DC=bryanmail,DC=net"
      - "LDAP_HOSTNAME=${LDAP_HOST}"
      - "LDAP_USERNAME_ATTRIBUTE=userPrincipalName"
      - "LDAP_USER_BASE_DN=OU=AAD Sync,OU=House Members,OU=Topside Pinnacle,DC=bryanmail,DC=net"
      - "LDAP_ENCRYPTION_METHOD=ssl"
      - "LDAP_PORT=636"
      - "LDAP_CONNECTION_TIMEOUT=60000"
      - "LDAP_SEARCH_BIND_DN=${GUACAMOLE_LDAP_SEARCH_BIND_DN}"
      - "LDAP_SEARCH_BIND_PASSWORD=${GUACAMOLE_LDAP_BIND_PASSWORD}"
      # OpenID Connect
      - "OPENID_ENABLED=true"
      - "OPENID_AUTHORIZATION_ENDPOINT=${GUACAMOLE_OIDC_AUTHORIZATION_ENDPOINT}"
      - "OPENID_JWKS_ENDPOINT=${GUACAMOLE_OIDC_JWKS_ENDPOINT}"
      - "OPENID_ISSUER=${GUACAMOLE_OIDC_ISSUER}"
      - "OPENID_CLIENT_ID=${GUACAMOLE_OIDC_CLIENT_ID}"
      - "OPENID_CLIENT_SECRET=${GUACAMOLE_OIDC_CLIENT_SECRET}"
      - "OPENID_REDIRECT_URI=${GUACAMOLE_OIDC_REDIRECT_URI}"
      - "OPENID_USERNAME_CLAIM_TYPE=email"
      # PostgreSQL
      - "POSTGRESQL_ENABLED=true"
      - "POSTGRESQL_HOSTNAME=db.postgresql_db-backend"
      - "POSTGRESQL_PORT=5432"
      - "POSTGRESQL_SSL_MODE=allow"
      - "POSTGRESQL_DATABASE=guacamole_db"
      - "POSTGRESQL_USER=guacamole"
      - "POSTGRESQL_PASSWORD=${GUACAMOLE_DB_PASSWORD}"
      - "REMOTE_IP_VALVE_ENABLED=true"
    networks:
      - traefik_backend
      - postgresql_db-backend
    volumes:
      - /volume1/docker/guacamole/extensions:/opt/guacamole/extensions
      - /volume1/docker/guacamole/usr/local/openjdk-8/jre/lib/security:/usr/local/openjdk-8/jre/lib/security
      - /volume1/docker/guacamole/opt/guacamole/bin:/opt/guacamole/bin/initdb.sql
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.guacamole.rule=Host(`remote.${DOMAIN}`)
        - traefik.http.routers.guacamole.tls=true
        - traefik.http.routers.guacamole.tls.certresolver=letsencrypt
        - traefik.http.routers.guacamole.entrypoints=websecure
        - traefik.http.services.guacamole.loadbalancer.server.port=8080
        - traefik.http.routers.guacamole.middlewares=crowdsec@file, guacamole-add-path
        - traefik.http.services.guacamole.loadbalancer.responseForwarding.flushInterval=-1
        - traefik.http.services.guacamole.loadbalancer.passhostheader=true
        - traefik.http.middlewares.guacamole-add-path.redirectregex.regex=^https://remote.${DOMAIN}/?$$
        - traefik.http.middlewares.guacamole-add-path.redirectregex.replacement=https://remote.${DOMAIN}/guacamole
        - traefik.http.middlewares.guacamole-add-path.redirectregex.permanent=true
        - traefik.http.services.guacamole.loadbalancer.sticky.cookie=true
        - traefik.http.services.guacamole.loadbalancer.sticky.cookie.name=GUAC_AFFINITY
        - traefik.http.services.guacamole.loadbalancer.sticky.cookie.httponly=true
        - traefik.http.services.guacamole.loadbalancer.sticky.cookie.secure=true
        - traefik.http.services.guacamole.loadbalancer.sticky.cookie.samesite=strict
        - traefik.swarm.network=traefik_backend
      resources:
        limits:
          cpus: '2'
          memory: 2G

  some-guacd:
    image: "guacamole/guacd:latest"
    hostname: "some-guacd"
    networks:
      - traefik_backend
    healthcheck:
      disable: true
    deploy:
      labels:
        - traefik.enable=false
      resources:
        limits:
          cpus: '2'
          memory: 512M

networks:
  traefik_backend:
    external: true
  postgresql_db-backend:
    external: true