services:
  maintenant:
    image: ghcr.io/kolapsis/maintenant:1.3.5
    container_name: maintenant
    restart: unless-stopped
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:noexec,nosuid,size=64m
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - maintenant-data:/data
    environment:
      MAINTENANT_ADDR: "0.0.0.0:8080"
      MAINTENANT_DB: /data/maintenant.db
      MAINTENANT_BASE_URL: https://maintenant.opytex.org
    networks:
      - traefik-proxy
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-proxy
      - traefik.http.routers.maintenant_secure.entrypoints=web-secure
      - traefik.http.routers.maintenant_secure.rule=Host(`maintenant.opytex.org`)
      - traefik.http.routers.maintenant_secure.tls.certresolver=letsencrypt
      - traefik.http.routers.maintenant_secure.middlewares=authentik@file
      - traefik.http.services.maintenant.loadbalancer.server.port=8080

volumes:
  maintenant-data:

networks:
  traefik-proxy:
    external: true