version: '3'

secrets:
  mysql_root_password:
    file: ./mysql_root_password.txt
  mysql_password:
    file: ./mysql_password.txt
  nextcloud_admin_password:
    file: ./nextcloud_admin_password.txt
  nextcloud_admin_user:
    file: ./nextcloud_admin_user.txt

services:
  db:
    image: mariadb:10.5
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - db:/var/lib/mysql
    environment:
      - MARIADB_AUTO_UPGRADE=1
      - MARIADB_DISABLE_UPGRADE_BACKUP=1
      - MYSQL_DATABASE=nextcloud
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/mysql_root_password
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_password
    healthcheck:
      test: "mysqladmin ping -h localhost -u$${MYSQL_USER} --password=$$(cat $${MYSQL_PASSWORD_FILE})"
      interval: 10s
      timeout: 5s
      retries: 100
      start_period: 40s
    secrets:
      - mysql_root_password
      - mysql_password

  redis:
    image: redis:alpine
    restart: always

  app:
    image: nextcloud:apache
    restart: always
    volumes:
      - nextcloud:/var/www/html
    environment:
      - NEXTCLOUD_TRUSTED_DOMAINS=mydomain.com
      - VIRTUAL_HOST=mydomain.com
      - LETSENCRYPT_HOST=mydomain.com
      - [email protected]
      - MYSQL_HOST=db
      - REDIS_HOST=redis
      - MYSQL_DATABASE=nextcloud
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_password
      - MYSQL_USER=nextcloud
      - NEXTCLOUD_ADMIN_USER_FILE=/run/secrets/nextcloud_admin_user
      - NEXTCLOUD_ADMIN_PASSWORD_FILE=/run/secrets/nextcloud_admin_password
    secrets:
      - mysql_root_password
      - mysql_password
      - nextcloud_admin_user
      - nextcloud_admin_password
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    networks:
      - proxy-tier
      - default

  cron:
    image: nextcloud:apache
    restart: always
    volumes:
      - nextcloud:/var/www/html
    entrypoint: /cron.sh
    depends_on:
      - db
      - redis

  proxy:
    build: ./proxy
    restart: always
    ports:
      - 80:80
      - 443:443
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
    volumes:
      - certs:/etc/nginx/certs:ro
      - vhost.d:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
        #      - /var/run/docker.sock:/tmp/docker.sock:ro
      - /run/user/1000/podman/podman.sock:/tmp/docker.sock:ro
    networks:
      - proxy-tier

  letsencrypt-companion:
    image: nginxproxy/acme-companion
    restart: always
    volumes:
      - certs:/etc/nginx/certs
      - acme:/etc/acme.sh
      - vhost.d:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
        #      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /run/user/1000/podman/podman.sock:/var/run/docker.sock:ro
    networks:
      - proxy-tier
    depends_on:
      - proxy

volumes:
  db:
  nextcloud:
  certs:
  acme:
  vhost.d:
  html:

networks:
  proxy-tier: