services:
  app:
    image: ${FOODSTER_REPO:?set FOODSTER_REPO in .env}:${FOODSTER_TAG:-latest}
    restart: unless-stopped

    # The database is a bind mount, not a named volume: it sits in ./data on
    # the host where it can be listed, copied and opened with any sqlite
    # client. The image runs as UID 65534, so the container has to be told
    # which host user owns that directory.
    user: "${FOODSTER_UID:-1000}:${FOODSTER_GID:-1000}"
    volumes:
      - ./data:/data

    environment:
      FOODSTER_PASSWORD: ${FOODSTER_PASSWORD:?set FOODSTER_PASSWORD in .env}
      FOODSTER_DB: /data/foodster.db
      TZ: ${TZ:-Europe/Helsinki}

    # No published ports: Traefik reaches the container over the shared
    # network. Publishing 8080 as well would put an unencrypted copy of the
    # app on the host, bypassing TLS.
    labels:
      - traefik.enable=true
      - traefik.http.routers.foodster.entrypoints=websecure
      - traefik.http.routers.foodster.rule=Host(`${FOODSTER_HOST:?set FOODSTER_HOST in .env}`)
      - traefik.http.routers.foodster.tls=true
      - traefik.http.services.foodster.loadbalancer.server.port=8080
      - traefik.docker.network=traefik
    networks:
      - traefik

networks:
  traefik:
    external: true