services:
  Unifi-Controller:
    env_file:
      - unifi.env
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=PST
      - RUNAS_UID0=false
      - LOTSOFDEVICES=true
#      - MEM_LIMIT=1024 #optional
#      - MEM_STARTUP=1024 #optional
    hostname: unifi
    image: jacobalberty/unifi:latest
#    restart: always
    networks:
      - traefik_backend
    ports:
      - target: 8443
        published: 8443
        protocol: tcp
        mode: host
      - target: 3478
        published: 3478
        protocol: udp
        mode: host
      - target: 10001
        published: 10001
        protocol: udp
        mode: host
      - target: 8080
        published: 8080
        protocol: tcp
        mode: host
      - target: 1900
        published: 1900
        protocol: udp
        mode: host
      - target: 8843
        published: 8843
        protocol: tcp
        mode: host
      - target: 8880
        published: 8880
        protocol: tcp
        mode: host
      - target: 6789
        published: 6789
        protocol: tcp
        mode: host
      - target: 5514
        published: 5514
        protocol: udp
        mode: host
    volumes:
      - "/volume1/docker/Unifi:/unifi"
#    working_dir: "/unifi"
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.unifi-network.entrypoints=websecure
        - traefik.http.routers.unifi-network.rule=${UNIFI_RULE}
        - traefik.http.routers.unifi-network.tls=true
        - traefik.http.routers.unifi-network.tls.certresolver=letsencrypt
        - traefik.http.services.unifi-network.loadbalancer.server.port=8443
#        - traefik.http.services.unifi-network.loadbalancer.serversTransport=ignorecert
        - traefik.http.services.unifi-network.loadbalancer.server.scheme=https
        - traefik.http.routers.unifi-network.service=unifi-network
        - traefik.http.routers.unifi-network.middlewares=crowdsec@file #forwardAuth-authentik@file
#        - traefik.http.routers.unifi-http.entrypoints=unifi-http
#        - traefik.http.routers.unifi-http.rule=Host(`unifi.${DOMAIN}`, `unifi.${ALT_DOMAIN}`)
#        - traefik.http.routers.unifi-http.tls=false
#        - traefik.http.routers.unifi-http.tls.certresolver=letsencrypt
#        - traefik.http.services.unifi-http.loadbalancer.server.port=8080
#        - traefik.http.routers.unifi-http.service=unifi-http
#        - traefik.tcp.routers.unifi-http.entrypoints=unifi-http
#        - traefik.tcp.routers.unifi-http.rule=HostSNI(`*`)
#        - traefik.http.routers.unifi-http.tls=true
#        - traefik.http.routers.unifi-http.tls.certresolver=letsencrypt
#        - traefik.tcp.services.unifi-http.loadbalancer.server.port=8080
#        - traefik.tcp.routers.unifi-http.service=unifi-http    
#        - traefik.tcp.routers.unifi-stun.entrypoints=unifi-stun
#        - traefik.tcp.routers.unifi-stun.rule=HostSNI(`*`)
#        - traefik.tcp.services.unifi-stun.loadbalancer.server.port=3478
#        - traefik.tcp.routers.unifi-stun.service=unifi-stun    
        - traefik.swarm.network=backend
        - autoheal=true
      resources:
        limits:
          cpus: '4'
          memory: 2G
      placement:
        constraints:
           - node.hostname==docker-2
networks:
  traefik_backend:
    external: true