networks:
  proxy:
  linkwarden:

services:
  linkwarden-db:
    container_name: linkwarden-db
    image: postgres
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: ["all", "linkwarden"]
    networks:
      - linkwarden
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d linkwarden -U linkwarden || exit 1"]
      interval: 5s
      timeout: 5s
      start_period: 30s
      retries: 10
    environment:
      POSTGRES_HOST_AUTH_METHOD: "trust"
      POSTGRES_USER: linkwarden
      POSTGRES_PASSWORD: Linkwarden123!
      POSTGRES_DB: linkwarden
    volumes:
      - /opt/linkwarden/db:/var/lib/postgresql

  linkwarden-migrate: &linkwarden-service
    image: "linkwarden/linkwarden"
    restart: on-failure
    profiles: ["all", "linkwarden"]
    networks:
      - linkwarden
    build:
      context: https://github.com/linkwarden/linkwarden.git#main
      dockerfile_inline: |
        FROM node:20
        WORKDIR /opt/linkwarden
        COPY . .
        RUN yarn && \
          npx playwright@1.36.2 install-deps && \
          yarn build
        ENTRYPOINT ["yarn"]
        CMD ["start"]
    command: prisma migrate deploy
    environment:
      - DATABASE_URL=postgres://linkwarden:Linkwarden123!@linkwarden-db:5432/linkwarden?sslmode=disable&max_conns=20&max_idle_conns=4
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET:-DR5o8dX6SR5#g*@7z!k2%8#sf5S@RR6F}
      - NEXTAUTH_URL=${NEXTAUTH_URL:-http://localhost:3000}
      - PAGINATION_TAKE_COUNT
      - STORAGE_FOLDER
      - SPACES_KEY
      - SPACES_SECRET
      - SPACES_ENDPOINT
      - SPACES_REGION
      - NEXT_PUBLIC_EMAIL_PROVIDER
      - EMAIL_FROM
      - EMAIL_SERVER
      - NEXT_PUBLIC_DISABLE_REGISTRATION=true
      - DISABLE_NEW_SSO_USERS=true
    depends_on:
      linkwarden-db:
        condition: service_healthy

  linkwarden:
    <<: *linkwarden-service
    restart: unless-stopped
    command: start
    profiles: ["all", "linkwarden"]
    networks:
      - linkwarden
      - proxy
    depends_on:
      linkwarden-migrate:
        condition: service_completed_successfully
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.linkwarden-rtr.entrypoints=https"
      - "traefik.http.routers.linkwarden-rtr.rule=Host(`subdomain.domain.com`)"
      ## Middlewares
      - "traefik.http.routers.linkwarden-rtr.middlewares=chain-no-auth@file"
      ## HTTP Services
      - "traefik.http.routers.linkwarden-rtr.service=linkwarden-svc"
      - "traefik.http.services.linkwarden-svc.loadbalancer.server.port=3000"