services:
  db:
    image: mariadb:10.6
    restart: always
    hostname: maria-db
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    networks:
      - internal
    volumes:
      - ./data/db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD={{ nextcloud.db_password }}
      - MYSQL_PASSWORD={{ nextcloud.db_password }}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud

  redis:
    image: redis:latest
    restart: always
    networks:
      - internal
    command: >
      --appendonly yes
      --tcp-backlog 511 --databases 16
      --save 900 1 --save 300 10 --save 60 10000
      --maxclients 512
    volumes:
      - "./data/redis:/data"
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 10s
      timeout: 5s
      retries: 5

  nextcloud:
    image: nextcloud:32.0.5
    hostname: nextcloud
    restart: always
    networks:
      - proxy
      - internal
    volumes:
      - {{ nextcloud.data_path }}:/var/www/html
      - ./config/hooks:/docker-entrypoint-hooks.d
      - "./config/nextcloud-importconfig.json:/tmp/importconfig.json:ro"
      - /etc/localtime:/etc/localtime:ro
    environment:
      - MYSQL_PASSWORD={{ nextcloud.db_password }}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=maria-db
      - PHP_MEMORY_LIMIT=4096M
      - PHP_UPLOAD_LIMIT=5120M
    labels:
      traefik.enable: true
      traefik.http.routers.nextcloud.rule: "Host(`{{ nextcloud.url }}`)"
      traefik.http.routers.nextcloud.tls: true
      traefik.http.routers.nextcloud.tls.certResolver: hetzner
      traefik.http.services.nextcloud-https.loadbalancer.server.port: 80
      traefik.http.services.nextcloud-https.loadbalancer.passHostHeader: true

      traefik.http.routers.nextcloud.middlewares: nextcloud-dav,nextcloud-header
      traefik.http.middlewares.nextcloud-dav.redirectRegex.regex: https://(.*)/.well-known/(card|cal)dav
      traefik.http.middlewares.nextcloud-dav.redirectRegex.replacement: https://$${1}/remote.php/dav/
      traefik.http.middlewares.nextcloud-dav.redirectRegex.permanent: true
      traefik.http.middlewares.nextcloud-header.headers.stsSeconds: "15552000"

{% if nextcloud.collabora.url %}
  collabora:
    image: collabora/code:25.04.8.1.1
    hostname: collabora
    restart: unless-stopped
    networks:
      - proxy

    environment:
      aliasgroup1: "{{ nextcloud.url | replace('.', '\\\\.') }}"
      username: admin
      password: "{{ nextcloud.collabora.password }}"
      DONT_GEN_SSL_CERT: "true"
      extra_params: >-
        --o:ssl.enable=false
        --o:ssl.termination=true
        --o:server_name={{ nextcloud.collabora.url }}

    cap_add:
      - MKNOD

    healthcheck:
      test:
        - CMD
        - curl
        - -f
        - http://localhost:9980/hosting/discovery
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 30s

    labels:
      traefik.enable: "true"
      traefik.http.routers.collabora.rule: "Host(`{{ nextcloud.collabora.url }}`)"
      traefik.http.routers.collabora.tls: true
      traefik.http.routers.collabora.tls.certResolver: hetzner
      traefik.http.services.collabora-https.loadbalancer.server.port: 9980
      traefik.http.services.collabora-https.loadbalancer.passHostHeader: true
{% endif %}

{% if nextcloud.drawio.url %}
  drawio:
    image: jgraph/drawio:29.3.5
    hostname: drawio
    networks:
      - proxy
    labels:
      traefik.enable: true
      traefik.http.routers.drawio.rule: "Host(`{{ nextcloud.drawio.url }}`)"
      traefik.http.routers.drawio.tls: true
      traefik.http.routers.drawio.tls.certResolver: hetzner
      traefik.http.services.drawio-https.loadbalancer.server.port: 8080
{% endif %}

networks:
  proxy:
    name: traefik_exposed
    external: true
  internal:
    internal: true