version: '3.8'

services:
  app:
    image: ${REG}/${APP_NAME}:latest
    container_name: ${APP_NAME}
    restart: unless-stopped
    environment:
      # Node Environment
      - NODE_ENV=production
      - NUXT_HOST=0.0.0.0
      - NUXT_PORT=3000
      # Public URL
      - NUXT_PUBLIC_APP_URL=${NUXT_PUBLIC_APP_URL}
    networks:
      - principal
    labels:
      # Traefik labels
      - "traefik.enable=true"
      - "traefik.docker.network=principal"

      # HTTP Router
      - "traefik.http.routers.${APP_NAME}.rule=Host(`${APP_DOMAIN}`)"
      - "traefik.http.routers.${APP_NAME}.entrypoints=websecure"
      - "traefik.http.routers.${APP_NAME}.tls.certresolver=letsencrypt"

      # Service
      - "traefik.http.services.${APP_NAME}.loadbalancer.server.port=3000"

      # Middleware chain: Authentik Proxy Outpost + Headers
      # IMPORTANTE: Reemplaza 'authentik-outpost@docker' con el nombre de tu proxy outpost
      - "traefik.http.routers.${APP_NAME}.middlewares=authentik-outpost@docker,${APP_NAME}-headers"

      # Custom headers middleware
      - "traefik.http.middlewares.${APP_NAME}-headers.headers.customrequestheaders.X-Forwarded-Proto=https"

networks:
  principal:
    external: true