networks:
  reverse-proxy:
    external: true

services:
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    restart: unless-stopped
    networks:
      - reverse-proxy
    environment:
      HOMEPAGE_ALLOWED_HOSTS: home.lucascott.com
      HOMEPAGE_AUTH_ENABLED: true # via OIDC
      HOMEPAGE_EXTERNAL_URL: https://home.lucascott.com
      LOG_TARGETS: stdout
      PUID: 1000
      PGID: 1001
    env_file: ./HOMEPAGE_AUTH_CONFIG.secret
    volumes:
      - ./config:/app/config
      - /mnt/ssd/.empty:/mnt/ssd:ro
    labels:
      - traefik.enable=true
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.rule=Host(`home.lucascott.com`)
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.entrypoints=websecure
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls=true
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt-dns
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls.domains[0].sans=*.lucascott.com
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.middlewares=internalOnly@file
      - traefik.http.services.${COMPOSE_PROJECT_NAME}.loadbalancer.server.port=3000
      - wud.link.template=https://github.com/gethomepage/homepage/releases
      - wud.trigger.include=telegram.report,docker.autoupdate