version: '3.8'

services:
  seguidor-lotes:
    image: gitea.nucleoriofrio.com/nucleo000/seguidor-lotes:latest
    container_name: seguidor-lotes
    restart: unless-stopped
    environment:
      # OAuth Authentik
      - NUXT_OAUTH_AUTHENTIK_CLIENT_ID=${NUXT_OAUTH_AUTHENTIK_CLIENT_ID}
      - NUXT_OAUTH_AUTHENTIK_CLIENT_SECRET=${NUXT_OAUTH_AUTHENTIK_CLIENT_SECRET}
      - NUXT_OAUTH_AUTHENTIK_SERVER_URL=${NUXT_OAUTH_AUTHENTIK_SERVER_URL}
      - NUXT_OAUTH_AUTHENTIK_SERVER_URL_INTERNAL=${NUXT_OAUTH_AUTHENTIK_SERVER_URL_INTERNAL}
      - NUXT_OAUTH_AUTHENTIK_REDIRECT_URL=${NUXT_OAUTH_AUTHENTIK_REDIRECT_URL}
      # Public URL
      - NUXT_PUBLIC_APP_URL=${NUXT_PUBLIC_APP_URL}
      # Session Secret
      - NUXT_SESSION_PASSWORD=${NUXT_SESSION_PASSWORD}
      # Node Environment
      - NODE_ENV=production
    networks:
      - principal
    labels:
      # Traefik labels
      - "traefik.enable=true"
      - "traefik.docker.network=principal"

      # HTTP Router
      - "traefik.http.routers.seguidor-lotes.rule=Host(`${APP_DOMAIN}`)"
      - "traefik.http.routers.seguidor-lotes.entrypoints=websecure"
      - "traefik.http.routers.seguidor-lotes.tls.certresolver=letsencrypt"

      # Service
      - "traefik.http.services.seguidor-lotes.loadbalancer.server.port=3000"

      # Router público para recursos PWA (sin autenticación)
      - "traefik.http.routers.seguidor-lotes-public.rule=Host(`${APP_DOMAIN}`) && (PathPrefix(`/.well-known`) || Path(`/manifest.webmanifest`) || Path(`/sw.js`) || PathPrefix(`/workbox-`) || PathPrefix(`/icon-`) || Path(`/favicon.ico`))"
      - "traefik.http.routers.seguidor-lotes-public.entrypoints=websecure"
      - "traefik.http.routers.seguidor-lotes-public.tls.certresolver=letsencrypt"
      - "traefik.http.routers.seguidor-lotes-public.priority=100"
      - "traefik.http.routers.seguidor-lotes-public.service=seguidor-lotes"

      # Middleware (opcional: puedes añadir rate limiting, compression, etc.)
      - "traefik.http.routers.seguidor-lotes.middlewares=seguidor-lotes-headers"
      - "traefik.http.middlewares.seguidor-lotes-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.seguidor-lotes-headers.headers.customrequestheaders.X-Forwarded-For=$${REMOTE_ADDR}"

networks:
  principal:
    external: true