services:
  mealie-v1:
    image: ghcr.io/mealie-recipes/mealie:latest # 
#    container_name: mealie-v1
    hostname: food
#    ports:
#        - "9925:9000" # 
    networks:
      - traefik_backend
      - postgresql_db-backend
    volumes:
      - /volume1/docker/Mealie/app/data:/app/data/
     # - /volume1/docker/letsencrypt/certs/certs/homehub.bryanmail.net.crt:/app/cert/homehub.bryanmail.net.crt
    environment:
    # Set Backend ENV Variables Here
      - ALLOW_SIGNUP=true
      - PUID=1000
      - PGID=1000
      - TZ=America/Anchorage
      - MAX_WORKERS=1
      - WEB_CONCURRENCY=1
      - BASE_URL=https://mealie.bryanmail.net

    # Database Settings
      - DB_ENGINE=postgres
      - POSTGRES_USER=mealie
      - POSTGRES_PASSWORD_FILE=/run/secrets/mealie_db_password
      - POSTGRES_SERVER=postgresql
      - POSTGRES_PORT=5432
      - POSTGRES_DB=mealie-v1

    #LDAP Settings
      - LDAP_AUTH_ENABLED=TRUE
      - LDAP_SERVER_URL=ldap://homehub.bryanmail.net
      - LDAP_TLS_INSECURE=TRUE
     # - LDAP_TLS_CACERTFILE=/app/cert/homehub.bryanmail.net.crt
      - LDAP_ENABLE_STARTTLS=TRUE
      - LDAP_BASE_DN=DC=bryanmail,DC=net
      - LDAP_QUERY_BIND=CN=AVB,OU=AAD Sync,OU=House Members,OU=Topside Pinnacle,DC=bryanmail,DC=net
      - LDAP_QUERY_PASSWORD_FILE=/run/secrets/mealie_ldap_query_password
     # - LDAP_USER_FILTER=(memberOf=OU=AAD Sync,OU=House Members,OU=Topside Pinnacle,DC=bryanmail,DC=net)
      - LDAP_ADMIN_FILTER=(memberOf=OU=AAD Sync,OU=House Members,OU=Topside Pinnacle,DC=bryanmail,DC=net)
      - LDAP_ID_ATTRIBUTE=sAMAccountName
      - LDAP_NAME_ATTRIBUTE=displayName
      - LDAP_MAIL_ATTRIBUTE=mail

    secrets:
      - mealie_db_password
      - mealie_ldap_query_password
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.mealie.rule=Host(`food.bryanmail.net`)
        - traefik.http.routers.mealie.tls=true
        - traefik.http.routers.mealie.tls.certresolver=letsencrypt
        - traefik.http.routers.mealie.entrypoints=websecure
        - traefik.http.services.mealie.loadbalancer.server.port=9000
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.mealie.middlewares=crowdsec@file  #auth
#        - traefik.http.middlewares.auth.basicauth.users=test:$$2a$$12$$1sIFlNKcNrEApe2IScpFwukd7l1j/uvfxk0GeuqIk0BBcO9Mk2F2u
        - autoheal=true
      resources:
        limits:
          cpus: '2' # Limit to 0.5 CPU core
          memory: 512M

secrets:
  mealie_db_password:
    external: true
  mealie_ldap_query_password:
    external: true

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true
# migrated: env_file removed, secrets via _FILE convention