version: "3.9"

volumes:
  nextcloud:
    name: nextcloud
  nextcloud-data:
    name: nextcloud-data
  nextcloud-config:
    name: nextcloud-config
  nextcloud-db:
    name: nextcloud-db
  nextcloud-redis:
    name: nextcloud-redis

networks:
  proxy:
    external: true
  nextcloud:
    name: nextcloud
    external: false

services:
  nextcloud:
    image: nextcloud:stable-fpm-alpine
    container_name: nextcloud
    hostname: nextcloud-web
    restart: unless-stopped
    volumes:
      - nextcloud:/var/www/html
      - nextcloud-data:/var/www/html/data
      - nextcloud-config:/var/www/html/config
    depends_on:
      - nextcloud-db
      - nextcloud-redis
    networks:
      - nextcloud
    environment:
      POSTGRES_PASSWORD: ${DB_PASS}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_HOST: nextcloud-db:5432
      REDIS_HOST: nextcloud-redis
      NEXTCLOUD_ADMIN_USER: ${NEXTCLOUD_ADMIN_USER}
      NEXTCLOUD_ADMIN_PASSWORD: ${NEXTCLOUD_ADMIN_PASS}
      NEXTCLOUD_TRUSTED_DOMAINS: cs-nextcloud.ddnss.de nextcloud.lan
      VIRTUAL_HOST: nextcloud

  nextcloud-web:
    image: nginx:alpine
    container_name: nextcloud-web
    hostname: nextcloud-web
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nextcloud.entrypoints=web"
      - "traefik.http.routers.nextcloud.rule=Host(`cs-nextcloud.ddnss.de`)"
      - "traefik.http.routers.nextcloud.middlewares=nextcloud"
      - "traefik.http.middlewares.nextcloud.redirectscheme.scheme=https"
      - "traefik.http.routers.nextcloud-secure.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-secure.rule=Host(`cs-nextcloud.ddnss.de`)"
      - "traefik.http.routers.nextcloud-secure.service=nextcloud-secure"
      - "traefik.http.routers.nextcloud-secure.tls=true"
      - "traefik.http.routers.nextcloud-secure.tls.certresolver=myresolver"
      - "traefik.http.services.nextcloud-secure.loadbalancer.server.port=80"
      - "traefik.http.routers.nextcloud-secure.middlewares=nextcloud-secure,nextcloud-redirect"
      - "traefik.http.middlewares.nextcloud-secure.headers.stsSeconds=15552000"
      - "traefik.http.middlewares.nextcloud-secure.headers.stsPreload=true"
      - "traefik.http.middlewares.nextcloud-redirect.redirectregex.permanent=true"
      - "traefik.http.middlewares.nextcloud-redirect.redirectregex.regex=^https://(.*)/.well-known/(card|cal)dav"
      - "traefik.http.middlewares.nextcloud-redirect.redirectregex.replacement=https://$${1}/remote.php/dav/"
    depends_on:
      - nextcloud
    networks:
      - proxy
      - nextcloud
    volumes:
      - nextcloud:/var/www/html
      - ${PWD}/nextcloud.conf:/etc/nginx/conf.d/default.conf

  nextcloud-db:
    image: postgres:17-alpine
    container_name: nextcloud-db
    hostname: naextcloud-db
    restart: unless-stopped
    volumes:
      - nextcloud-db:/var/lib/postgresql/data
    networks:
      - nextcloud
    environment:
      POSTGRES_PASSWORD: ${DB_PASS}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_DB: ${DB_NAME}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $DB_USER"]

  nextcloud-redis:
    image: redis:alpine
    container_name: nextcloud-redis
    hostname: nextcloud-redis
    restart: unless-stopped
    volumes:
      - nextcloud-redis:/data
    networks:
      - nextcloud
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping"]