services:
  ntfy:
    image: binwiederhier/ntfy:v2.20
    container_name: ntfy
    restart: unless-stopped
    command: serve
    security_opt:
      - no-new-privileges:true
    env_file:
      - env_file
    volumes:
      - ./config/server.yml:/etc/ntfy/server.yml:ro
      - ntfy-cache:/var/cache/ntfy
      - ntfy-auth:/var/lib/ntfy
    networks:
      - traefik-proxy
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-proxy
      - traefik.http.routers.ntfy.entrypoints=web-secure
      - traefik.http.routers.ntfy.rule=Host(`ntfy.opytex.org`)
      - traefik.http.routers.ntfy.tls.certresolver=letsencrypt
      - traefik.http.services.ntfy.loadbalancer.server.port=80
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1",
        ]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 40s

volumes:
  ntfy-cache:
    labels:
      - backup.enable=true
  ntfy-auth:
    labels:
      - backup.enable=true

networks:
  traefik-proxy:
    external: true