services:
  traefik:
    container_name: traefik
    image: traefik:v3.3
    command:
      - "--api.insecure=true"  # Development only
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"  # Traefik dashboard
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - traefik-public
      - internal
    restart: unless-stopped

  byom-web:
    env_file:
      - .env
    container_name: byom-web
    build:
      context: ./byom-web
      dockerfile: Dockerfile
    #image: byom/byom-web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web.rule=Host(`${DOMAIN:-localhost}`)"
      - "traefik.http.services.web.loadbalancer.server.port=3000"
      # HTTPS redirect
      - "traefik.http.middlewares.https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.web.middlewares=https-redirect"
      # Secure router
      - "traefik.http.routers.web-secure.rule=Host(`${DOMAIN:-localhost}`)"
      - "traefik.http.routers.web-secure.entrypoints=websecure"
      - "traefik.http.routers.web-secure.tls=true"
    networks:
      - internal
    restart: unless-stopped

  byom-core:
    env_file:
      - .env
    container_name: byom-core
    build:
      context: ./byom-core
      dockerfile: Dockerfile
    #image: byom/byom-core
    volumes:
      - ./byom-core/data:/app/data  # Persist SQLite database
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`${DOMAIN:-localhost}`) && PathPrefix(`/api/v1/core`)"
      - "traefik.http.services.api.loadbalancer.server.port=8443"
      # HTTPS redirect
      - "traefik.http.middlewares.https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.api.middlewares=https-redirect"
      # Secure router
      - "traefik.http.routers.api-secure.rule=Host(`${DOMAIN:-localhost}`) && PathPrefix(`/api/v1/core`)"
      - "traefik.http.routers.api-secure.entrypoints=websecure"
      - "traefik.http.routers.api-secure.tls=true"
    networks:
      - internal
    restart: unless-stopped

networks:
  traefik-public:
    external: true
  internal:
    internal: true  # This network is not accessible from outside