services:
  seaweedfs:
    image: chrislusf/seaweedfs:latest
    container_name: seaweedfs
    restart: unless-stopped
    command: "server -s3 -s3.port=8333 -master.port=9333 -volume.port=8080 -filer -filer.port=8888 -dir=/data -s3.domainName=file.xiteng.site"
    environment:
      - WEED_SECURITY_CONFIG=/etc/seaweedfs/security.toml
    volumes:
      - ./data:/data
      - ./security.toml:/etc/seaweedfs/security.toml:ro
    ports:
      - "9333:9333"   # master
      - "8081:8080"   # volume
      - "8888:8888"   # filer
      - "8333:8333"   # s3
    labels:
      - "traefik.enable=true"
      # --- Traefik: S3 Console (带 Authentik ForwardAuth) ---
      - "traefik.http.routers.minio.rule=Host(`file.xiteng.site`)"
      - "traefik.http.services.minio.loadbalancer.server.port=8888"
      - "traefik.http.routers.minio.entrypoints=websecure"
      - "traefik.http.routers.minio.tls=true"
      - "traefik.http.routers.minio.tls.certresolver=cfresolver"
      - "traefik.http.routers.minio-http.rule=Host(`file.xiteng.site`)"
      - "traefik.http.routers.minio-http.service=minio"
      - "traefik.http.routers.minio-http.entrypoints=web"
      # --- ForwardAuth：显式转发 Cookie 头给 outpost ---
      - "traefik.http.middlewares.minio-scheme.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.minio-auth.forwardauth.address=http://authentik-outpost-seaweedfs:9000/outpost.goauthentik.io/auth/traefik"
      - "traefik.http.middlewares.minio-auth.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.minio-auth.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name"
      - "traefik.http.routers.minio.middlewares=minio-scheme,minio-auth"
      - "traefik.http.routers.minio-http.middlewares=minio-scheme,minio-auth"
      # --- Traefik: S3 API (8333) ---
      - "traefik.http.routers.minio-api.rule=Host(`minio-api.xiteng.site`)"
      - "traefik.http.services.minio-api.loadbalancer.server.port=8333"
      - "traefik.http.routers.minio-api.entrypoints=websecure"
      - "traefik.http.routers.minio-api.tls=true"
      - "traefik.http.routers.minio-api.tls.certresolver=cfresolver"
      - "traefik.http.routers.minio-api-http.rule=Host(`minio-api.xiteng.site`)"
      - "traefik.http.routers.minio-api-http.service=minio-api"
      - "traefik.http.routers.minio-api-http.entrypoints=web"
      # --- Homepage ---
      - "homepage.group=我的服务"
      - "homepage.name=SeaweedFS"
      - "homepage.icon=/icons/seaweedfs-local.png"
      - "homepage.href=https://file.xiteng.site"
      - "homepage.description=对象存储"
      # --- AutoKuma ---
      - "kuma.minio.http.name=SeaweedFS"
      - "kuma.minio.http.url=http://seaweedfs:8888"
      - "kuma.minio.http.interval=60"
      - "kuma.minio.http.max_retries=3"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true