services:
  portfolio:
    image: rezayaghobi-site:${TAG:?set TAG}
    container_name: portfolio
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/"]
      interval: 10s
      timeout: 3s
      retries: 3
    networks: [web_net]
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web_net"

      # rezayaghobi.ir
      - "traefik.http.routers.portfolio.rule=Host(`rezayaghobi.ir`)"
      - "traefik.http.routers.portfolio.entrypoints=websecure"
      - "traefik.http.routers.portfolio.tls.certresolver=le"
      - "traefik.http.routers.portfolio.middlewares=portfolio-hsts"
      - "traefik.http.routers.portfolio.service=portfolio"
      - "traefik.http.services.portfolio.loadbalancer.server.port=8080"

      # www -> bare domain
      - "traefik.http.routers.portfolio-www.rule=Host(`www.rezayaghobi.ir`)"
      - "traefik.http.routers.portfolio-www.entrypoints=websecure"
      - "traefik.http.routers.portfolio-www.tls.certresolver=le"
      - "traefik.http.routers.portfolio-www.middlewares=portfolio-www-redirect"
      - "traefik.http.routers.portfolio-www.service=noop@internal"
      - 'traefik.http.middlewares.portfolio-www-redirect.redirectregex.regex=^https://www\.rezayaghobi\.ir/(.*)'
      - 'traefik.http.middlewares.portfolio-www-redirect.redirectregex.replacement=https://rezayaghobi.ir/$${1}'
      - "traefik.http.middlewares.portfolio-www-redirect.redirectregex.permanent=true"

      # HSTS for this site only
      - "traefik.http.middlewares.portfolio-hsts.headers.stsseconds=86400"

networks:
  web_net:
    external: true