services:
  traefik-init:
    image: docker.io/alpine:latest
    entrypoint: sh
    environment:
      ROCKETCHAT_BACKEND_SERVERS: ${ROCKETCHAT_BACKEND_SERVERS:-rocketchat:3000}
    command:
      - -c
      - |-
        set -e
        # quote 'eof' to prevent variable expansion
        rm -rf /traefik_config/* || true
        mkdir -p /traefik_config/http /traefik_config/https
        # this should be idented so it works inside the heredoc concatenation later
        cat <<'EOF' > /traefik_config/services.tpl
          services:
            grafana:
              loadBalancer:
                servers:
                  - url: "http://grafana:3000"
            rocketchat:
              loadBalancer:
                healthCheck:
                  path: /health
                  interval: 10s
                  timeout: 3s
                servers:
        EOF

        echo "ROCKETCHAT_BACKEND_SERVERS $$ROCKETCHAT_BACKEND_SERVERS"
        # append the server list to the services template
        for server in $(echo $$ROCKETCHAT_BACKEND_SERVERS | tr "," "\n" | tr -d " "); do
          echo "          - url: \"http://$$server\"" >> /traefik_config/services.tpl
        done


        cat <<'EOF' > /traefik_config/http/dynamic.yml
        http:
          routers:
            rocketchat:
              entryPoints:
                - http
              service: rocketchat
              rule: Host(`{{ env "DOMAIN" }}`) && PathPrefix(`/`)
            grafana:
              entryPoints:
                - http
              service: grafana
              rule: |-
                {{ if eq (env "GRAFANA_DOMAIN") "" }}
                  Host(`{{ env "DOMAIN" }}`) && PathPrefix(`{{ env "GRAFANA_PATH" }}`)
                {{ else }}
                  Host(`{{ env "GRAFANA_DOMAIN" }}`)
                {{ end }}
        EOF

        cat <<'EOF' > /traefik_config/https/dynamic.yml
        https:
          address: ":443"
          http:
            redirections:
              entryPoint:
                to: "http"
                scheme: "https"
        http:
          routers:
            rocketchat:
              entryPoints:
                - https
              service: rocketchat
              rule: Host(`{{ env "DOMAIN" }}`)
              tls:
                certResolver: le
            grafana:
              entryPoints:
                - https
              rule: |
                {{ if eq (env "GRAFANA_DOMAIN") "" }}
                  Host(`{{ env "DOMAIN" }}`) && PathPrefix(`{{ env "GRAFANA_PATH" }}`)
                {{ else }}
                  Host(`{{ env "GRAFANA_DOMAIN" }}`)
                {{ end }}
              service: grafana
              tls:
                certResolver: le
        EOF

        cat /traefik_config/services.tpl >> /traefik_config/http/dynamic.yml
        cat /traefik_config/services.tpl >> /traefik_config/https/dynamic.yml
        cat /traefik_config/http/dynamic.yml
        echo "-------------------------"
        cat /traefik_config/https/dynamic.yml

        echo "files generated, keeping container alive to podman-compose detect it"
        tail -f /dev/null
    volumes:
      - traefik_config:/traefik_config:Z
    restart: "no"

  traefik:
    image: docker.io/traefik:${TRAEFIK_RELEASE:-v3.4}
    restart: always
    depends_on:
      - traefik-init
    environment:
      DOMAIN: "${DOMAIN:-localhost}"
      GRAFANA_DOMAIN: "${GRAFANA_DOMAIN-}"
      GRAFANA_PATH: "${GRAFANA_PATH-/}"
      TRAEFIK_PROTOCOL: "${TRAEFIK_PROTOCOL-}"
    command:
      - --api.insecure=${TRAEFIK_API_INSECURE:-false}
      - --providers.docker=false
      - --providers.docker.exposedbydefault=false
      - --entrypoints.http.address=:${TRAEFIK_HTTP_PORT:-80}
      - --entrypoints.https.address=:${TRAEFIK_HTTPS_PORT:-443}
      - --entrypoints.metrics.address=:9096
      - --metrics.prometheus=true
      # ssl
      - --certificatesresolvers.le.acme.tlschallenge=${LETSENCRYPT_ENABLED:-false}
      - --certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL?need email for cert expiry notifications}
      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
      # ssl
      - --metrics.prometheus.entryPoint=metrics # Associate metrics with the 'metrics' entry point
      - --metrics.prometheus.addEntryPointsLabels=true
      - --metrics.prometheus.addRoutersLabels=true
      - --metrics.prometheus.addServicesLabels=true
      - --providers.file.filename=/traefik_config/${TRAEFIK_PROTOCOL}/dynamic.yml
      - --providers.file.watch=true
    ports:
      - ${TRAEFIK_HTTP_PORT:-80}:${TRAEFIK_HTTP_PORT:-80}
      - ${TRAEFIK_DASHBOARD_PORT:-8080}:8080
      - ${TRAEFIK_HTTPS_PORT:-443}:${TRAEFIK_HTTPS_PORT:-443}
    expose:
      - 9096
      - ${TRAEFIK_HTTP_PORT:-80}
      - ${TRAEFIK_DASHBOARD_PORT:-8080}
      - ${TRAEFIK_HTTPS_PORT:-443}
    volumes:
      - traefik_ssl:/letsencrypt:Z
      - traefik_config:/traefik_config:Z
      # healthcheck:
      #   test: ["CMD", "traefik", "healthcheck"]
      #   interval: 30s
      #   timeout: 30s
      #   retries: 5
      #   start_period: 30s
    logging:
      driver: "json-file"
    labels:
      container_tag: "${COMPOSE_PROJECT_NAME:-rocketchat}#traefik"

volumes:
  # this is for ssl shennanigans, users usually won't need to bother with it
  traefik_ssl: {driver: local}
  traefik_config: {driver: local}