version: '3'

services:
  ncdb:
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    container_name: ncdb
    environment:
      - MARIADB_ROOT_PASSWORD=<password>
      - MARIADB_DATABASE=nextcloud
      - MARIADB_USER=nextcloud
      - MARIADB_PASSWORD=<password>
    hostname: ncdb
    networks:
      - nextcloud
    image: mariadb/server:10.3
    restart: always
    volumes:
      - /srv/db/nextcloud:/var/lib/mysql

  nextcloud:
    container_name: nextcloud
    depends_on:
      - ncdb
    environment:
      - VIRTUAL_HOST=nextcloud.domain.tld
    image: nextcloud:16
    hostname: nextcloud
    labels:
      - "traefik.enable=true"
      - "traefik.backend=nextcloud"
      - "traefik.frontend.rule=Host:nextcloud.domain.tld"
      - "traefik.port=80"
      - "traefik.protocol=http"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=domain.tld"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      - "traefik.frontend.headers.frameDeny=true"
    links:
      - ncdb
    networks:
      - traefik_proxy
      - nextcloud
    ports:
      - 8080:80
    restart: always
    volumes:
      - /srv/appdata/nextcloud:/var/www/html
      - /srv/userdata/nextcloud:/var/www/html/data

networks:
  traefik_proxy:
    external: true
  nextcloud:
    external: true