version: "3.6"
services:
  postgresql:
    stop_grace_period: 60s
    env_file:
      - postgresql.env
    command:
      - postgres
    environment:
      - POSTGRES_PASSWORD_FILE=/run/secrets/postgresql_password
      - POSTGRES_USER=${POSTGRES_USER}
    secrets:
      - postgresql_password
    hostname: db
    image: public.ecr.aws/docker/library/postgres:17
    networks:
      - postgresql_db-backend
#      - traefik_backend
      - authentik_backend
    ports:
      - 5430:5432/tcp
    volumes:
      - /volume1/docker/PostgreSQL/data-17:/var/lib/postgresql/data
    deploy:
      labels:
        - traefik.enable=true
        - traefik.tcp.routers.postgres.entrypoints=postgresql
        - traefik.tcp.routers.postgres.rule=HostSNI(`*`)
        - traefik.tcp.services.postgres.loadbalancer.server.port=5432
        - traefik.tcp.routers.postgres.service=postgres
        - traefik.swarm.network=traefik_backend
#      resources:
#        limits:
#          cpus: '8' # Limit to 0.5 CPU core
#          memory: 2G
      placement:
        constraints:
          - node.labels.block != databases
          - node.hostname == docker-2

  databasus:
    hostname: databasus
    image: databasus/databasus:latest
#    ports:
#      - "4005:4005"
    networks:
      - traefik_backend
      - postgresql_db-backend
    volumes:
      - /volume1/docker/databasus:/databasus-data
#      - /volume1/SMB-docker/tmp:/tmp
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.databasus.rule=Host(`${DATABASUS_HOST}`)
        - traefik.http.routers.databasus.tls=true
        - traefik.http.routers.databasus.tls.certresolver=letsencrypt
        - traefik.http.routers.databasus.entrypoints=websecure
        - traefik.http.services.databasus.loadbalancer.server.port=4005
        - traefik.swarm.network=traefik_backend
#        - traefik.http.routers.databasus.middlewares=forwardAuth-authentik@file, crowdsec@file
#        - traefik.http.routers.databasus.middlewares=auth
#        - traefik.http.middlewares.auth.basicauth.users=test:$$2a$$12$$1sIFlNKcNrEApe2IScpFwukd7l1j/uvfxk0GeuqIk0BBcO9Mk2F2u
#      resources:
#        limits:
#          cpus: '4' # Limit to 0.5 CPU core
#          memory: 2G


  pgadmin:
    env_file:
      - postgresql.env
    image: dpage/pgadmin4:latest
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
      PGADMIN_DEFAULT_PASSWORD_FILE: /run/secrets/postgresql_pgadmin_password
      PGADMIN_LISTEN_PORT: 80
    secrets:
      - postgresql_pgadmin_password
    volumes:
      - "/volume1/docker/PostgreSQL Admin:/var/lib/pgadmin"
#      - "/volume1/docker/PostgreSQL Backups:/var/lib/pgadmin/storage/avb_bryanmail.net"
    ports:
      - 3030:80
    networks:
      - postgresql_db-backend
      - traefik_backend
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.pgadmin.rule=Host(`${PGADMIN_HOST}`)
        - traefik.http.routers.pgadmin.tls=true
        - traefik.http.routers.pgadmin.tls.certresolver=letsencrypt
        - traefik.http.routers.pgadmin.entrypoints=websecure
        - traefik.http.services.pgadmin.loadbalancer.server.port=80
        - traefik.swarm.network=traefik_backend
#        - traefik.http.routers.pgadmin.middlewares=forwardAuth-authentik@file, crowdsec@file
#        - traefik.http.routers.pgadmin.middlewares=auth
#        - traefik.http.middlewares.auth.basicauth.users=test:$$2a$$12$$1sIFlNKcNrEApe2IScpFwukd7l1j/uvfxk0GeuqIk0BBcO9Mk2F2u
      resources:
        limits:
          cpus: '1' # Limit to 0.5 CPU core
          memory: 512M

networks:
  postgresql_db-backend:
    name: postgresql_db-backend
#   external: true
    attachable: true
    driver: overlay
    driver_opts:
      com.docker.network.driver.mtu: "8950" #broke database connections for things like vaultwarden and Immich
  traefik_backend:
    external: true
  authentik_backend:
    external: true

secrets:
  postgresql_password:
    external: true
  postgresql_pgadmin_password:
    external: true