services:
  postgres:
    image: postgres:17
    container_name: n8n-postgres
    restart: unless-stopped
    env_file:
      - .env
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - ./postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5

  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy

    env_file:
      - .env

    environment:
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_PORT: 5432
      DB_POSTGRESDB_DATABASE: ${POSTGRES_DB}
      DB_POSTGRESDB_USER: ${POSTGRES_USER}
      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}

      NPM_ADMIN_EMAIL: ${NPM_ADMIN_EMAIL}
      NPM_ADMIN_PASSWORD: ${NPM_ADMIN_PASSWORD}
      PIHOLE_PASSWORD: ${PIHOLE_PASSWORD}

      N8N_BASIC_AUTH_ACTIVE: true
      N8N_BLOCK_ENV_ACCESS_IN_NODE: false
      N8N_BASIC_AUTH_USER: ${N8N_BASIC_AUTH_USER}
      N8N_BASIC_AUTH_PASSWORD: ${N8N_BASIC_AUTH_PASSWORD}

      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}

      N8N_SECURE_COOKIE: false
      N8N_HOST: n8n.home.server
      N8N_PROTOCOL: https
      N8N_PORT: 5678
      WEBHOOK_URL: https://n8n.home.server/

      TZ: ${TZ}
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web_net"

      # HTTPS router
      - "traefik.http.routers.n8n.rule=Host(`n8n.home.server`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
      - "traefik.http.routers.n8n.tls=true"
      - "traefik.http.routers.n8n.service=n8n"
      - "traefik.http.routers.n8n.middlewares=security-headers@file"

      # HTTP → HTTPS redirect
      - "traefik.http.routers.n8n-http.rule=Host(`n8n.home.server`)"
      - "traefik.http.routers.n8n-http.entrypoints=web"
      - "traefik.http.routers.n8n-http.middlewares=redirect-to-https@file"

      # Internal container port
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"

    ports:
      - "5678:5678"

    networks:
      - default          # keep the existing n8n_default (for postgres)
      - web_net          # new

    volumes:
      - ./n8n-data:/home/node/.n8n
      - /mnt/storage:/mnt/storage
      - /mnt/windows-video:/mnt/windows-video
networks:
  web_net:
    external: true