services:
  seaweedfs:
    image: chrislusf/seaweedfs:4.41
    container_name: seaweedfs
    restart: unless-stopped
    command: "server -s3 -s3.port=8333 -master.port=9333 -volume.port=8080 -filer -filer.port=8888 -dir=/data -s3.domainName=file.xiteng.site"
    environment:
      - WEED_SECURITY_CONFIG=/etc/seaweedfs/security.toml
    volumes:
      - ./data:/data
      - ./security.toml:/etc/seaweedfs/security.toml:ro
    ports:
      - "9333:9333"   # master
      - "8081:8080"   # volume
      - "8888:8888"   # filer
      - "8333:8333"   # s3
    labels:
      - "traefik.enable=true"
      # --- Traefik: S3 Console (带 Authentik ForwardAuth) ---
      - "traefik.http.routers.minio.rule=Host(`file.xiteng.site`)"
      - "traefik.http.services.minio.loadbalancer.server.port=8888"
      - "traefik.http.routers.minio.entrypoints=websecure"
      - "traefik.http.routers.minio.tls=true"
      - "traefik.http.routers.minio.tls.certresolver=cfresolver"
      - "traefik.http.routers.minio.service=minio"
      - "traefik.http.routers.minio-http.rule=Host(`file.xiteng.site`)"
      - "traefik.http.routers.minio-http.service=minio"
      - "traefik.http.routers.minio-http.entrypoints=web"
      # --- ForwardAuth：显式转发 Cookie 头给 outpost ---
      - "traefik.http.middlewares.minio-scheme.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.minio-auth.forwardauth.address=http://authentik-outpost-seaweedfs:9000/outpost.goauthentik.io/auth/traefik"
      - "traefik.http.middlewares.minio-auth.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.minio-auth.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name"
      - "traefik.http.routers.minio.middlewares=minio-scheme,minio-auth"
      - "traefik.http.routers.minio-http.middlewares=minio-scheme,minio-auth"
      # --- Traefik: S3 API (8333) ---
      - "traefik.http.routers.s3.rule=Host(`s3.xiteng.site`)"
      - "traefik.http.services.s3.loadbalancer.server.port=8333"
      - "traefik.http.routers.s3.entrypoints=websecure"
      - "traefik.http.routers.s3.tls=true"
      - "traefik.http.routers.s3.tls.certresolver=cfresolver"
      - "traefik.http.routers.s3-http.rule=Host(`s3.xiteng.site`)"
      - "traefik.http.routers.s3-http.service=s3"
      - "traefik.http.routers.s3-http.entrypoints=web"
      - "xiteng.site.cache.seaweedfs-minio.enabled=true"
      - "xiteng.site.cache.seaweedfs-minio.routers=minio,minio-http"
      - "xiteng.site.cache.seaweedfs-minio.paths=/assets/,/static/,/ui/"
      - "xiteng.site.cache.seaweedfs-minio.edge-ttl=604800"
      - "xiteng.site.cache.seaweedfs-minio.stale-while-revalidate=86400"
      # --- Xiteng Site dynamic catalog: one container, two public components ---
      - "xiteng.site.component.seaweedfs.enabled=true"
      - "xiteng.site.component.seaweedfs.name=SeaweedFS"
      - "xiteng.site.component.seaweedfs.description=分布式文件、Filer Web 与对象存储核心。"
      - "xiteng.site.component.seaweedfs.section=services"
      - "xiteng.site.component.seaweedfs.category=存储"
      - "xiteng.site.component.seaweedfs.url=https://file.xiteng.site"
      - "xiteng.site.component.seaweedfs.access=sso"
      - "xiteng.site.component.seaweedfs.access-label=需要 Authentik"
      - "xiteng.site.component.seaweedfs.icon=SW"
      - "xiteng.site.component.seaweedfs.accent=green"
      - "xiteng.site.component.seaweedfs.order=500"
      - "xiteng.site.component.seaweedfs.monitor.enabled=true"
      - "xiteng.site.component.seaweedfs.monitor.url=http://seaweedfs:8888"
      - "xiteng.site.component.s3-api.enabled=true"
      - "xiteng.site.component.s3-api.name=SeaweedFS S3 API"
      - "xiteng.site.component.s3-api.description=S3 兼容对象存储协议入口。"
      - "xiteng.site.component.s3-api.section=services"
      - "xiteng.site.component.s3-api.category=存储"
      - "xiteng.site.component.s3-api.url=https://s3.xiteng.site"
      - "xiteng.site.component.s3-api.endpoint=s3.xiteng.site:443"
      - "xiteng.site.component.s3-api.access=access-key"
      - "xiteng.site.component.s3-api.access-label=需要 Access Key"
      - "xiteng.site.component.s3-api.icon=S3"
      - "xiteng.site.component.s3-api.accent=blue"
      - "xiteng.site.component.s3-api.order=510"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true