services:
  lectio:
    build:
      context: .
      dockerfile: Dockerfile
    image: lectio:latest
    container_name: lectio
    restart: unless-stopped
    # The app mirrors its logs to the console now, so cap the json-file log; the durable record is the
    # rotating file under LECTIO_LOG_DIR (/data/logs), which has its own limits.
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    env_file:
      - .env
    environment:
      TZ: ${TZ:-UTC}
      LECTIO_DATA_DIR: /data
      LECTIO_HTTPS_ONLY: "1"
      LECTIO_LOG_DIR: /data/logs
      LECTIO_PUBLIC_URL: "https://lectio.${BASE_URL}"
    volumes:
      - ./data:/data
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.docker.network=proxy
      - traefik.http.routers.lectio.rule=Host(`lectio.${BASE_URL}`)
      - traefik.http.routers.lectio.service=lectio-svc
      - traefik.http.services.lectio-svc.loadbalancer.server.port=8000
      - traefik.http.routers.lectio.middlewares=lectioCompress,lectioSec
      - traefik.http.middlewares.lectioCompress.compress=true
      - traefik.http.middlewares.lectioSec.headers.browserXssFilter=true
      - traefik.http.middlewares.lectioSec.headers.contentTypeNosniff=true
      - traefik.http.middlewares.lectioSec.headers.frameDeny=true
      - traefik.http.middlewares.lectioSec.headers.referrerPolicy=no-referrer-when-downgrade
      - traefik.http.middlewares.lectioSec.headers.forceSTSHeader=true
      - traefik.http.middlewares.lectioSec.headers.stsSeconds=31536000
      - traefik.http.middlewares.lectioSec.headers.stsIncludeSubdomains=true

networks:
  proxy:
    name: proxy
    external: true