services:
  postgres:
    image: postgres:15-alpine
    container_name: logto_postgres
    restart: always
    environment:
      POSTGRES_DB: logto
      POSTGRES_USER: logto
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - web
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U logto"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    container_name: logto_redis
    restart: always
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - web
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  logto:
    image: ghcr.io/logto-io/logto:latest
    container_name: logto
    restart: always
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      - TRUST_PROXY_HEADER=1
      - ENDPOINT=https://id.my-domain.de
      - ADMIN_ENDPOINT=https://id.my-domain.de
      - DB_URL=postgresql://logto:${POSTGRES_PASSWORD:-changeme}@postgres:5432/logto
      - REDIS_URL=redis://redis:6379
      - PORT=3001
      - ADMIN_PORT=3002
      - TZ=Europe/Berlin
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    init: true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.logto.tls=true"
      - "traefik.http.routers.logto.rule=Host(`id.my-domain.de`)"
      - "traefik.http.routers.logto.entrypoints=websecure"
      - "traefik.http.services.logto.loadbalancer.server.port=3001"
      - "traefik.http.routers.logto.service=logto"
      - "traefik.http.routers.logto.tls.certresolver=le"
      - "traefik.http.routers.logto.middlewares=logto-headers"
      - "traefik.http.middlewares.logto-headers.headers.sslredirect=true"
      - "traefik.http.middlewares.logto-headers.headers.forceSTSHeader=true"
      - "traefik.http.middlewares.logto-headers.headers.STSSeconds=31536000"
      - "traefik.http.middlewares.logto-headers.headers.customFrameOptionsValue=SAMEORIGIN"
      - "traefik.http.middlewares.logto-headers.headers.customRequestHeaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.logto-headers.headers.customRequestHeaders.X-Forwarded-Host=id.my-domain.de"
    networks:
      - web

networks:
  web:
    external: true

volumes:
  postgres_data:
  redis_data: