services:
  db:
    image: postgres:11.6-alpine
    env_file:
      - ../.env
    container_name: hedgedoc_db
    restart: unless-stopped
    volumes:
      - ./data:/var/lib/postgresql/data
    networks:
      - homelab_net

  hedgedoc:
    image: quay.io/hedgedoc/hedgedoc:latest
    container_name: hedgedoc
    restart: unless-stopped
    env_file:
      - ../.env
    environment:
      - CMD_DOMAIN=notes.xiteng.site
      - CMD_URL_ADDPORT=false
      - CMD_ALLOW_ORIGIN=localhost,notes.xiteng.site
      - CMD_PROTOCOL_USESSL=true
    volumes:
      - ./uploads:/hedgedoc/public/uploads
    depends_on:
      - db
    ports:
      - "3000:3000"
    labels:
      # --- 1. Traefik 路由设置 ---
      - "traefik.enable=true"
      - "traefik.http.routers.hedgedoc.rule=Host(`notes.xiteng.site`)"
      - "traefik.http.services.hedgedoc.loadbalancer.server.port=3000"
      # 强制使用 websecure (443端口) 入口
      - "traefik.http.routers.hedgedoc.entrypoints=websecure"
      # --- HTTP 入口（来自 cloudflared tunnel）---
      - "traefik.http.routers.hedgedoc-http.rule=Host(`notes.xiteng.site`)"
      - "traefik.http.routers.hedgedoc-http.service=hedgedoc"
      - "traefik.http.routers.hedgedoc-http.entrypoints=web"
      # --- 中间件：强制 X-Forwarded-Proto（Cloudflare Tunnel 用 HTTP 连 Traefik，但用户端是 HTTPS）---
      - "traefik.http.middlewares.force-https.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.hedgedoc-http.middlewares=force-https"
      - "traefik.http.routers.hedgedoc.middlewares=force-https"
      # --- 新增：开启 TLS 并指定解析器 ---
      - "traefik.http.routers.hedgedoc.tls=true"
      - "traefik.http.routers.hedgedoc.tls.certresolver=cfresolver"
      # --- 2. Homepage 自动发现设置 ---
      - "homepage.group=我的服务"             # 分组名称
      - "homepage.name=HedgeDoc"               # 显示名称
      - "homepage.icon=si-hedgedoc"               # 图标 (支持 si, mdi 等前缀)
      - "homepage.href=https://notes.xiteng.site" # 点击跳转的链接
      - "homepage.description=实时 Markdown 协作" # 副标题描述
      # --- 3. AutoKuma 自动发现设置 ---
      # 格式: kuma.<自定义ID>.<监控类型>.<属性>
      - "kuma.hedgedoc.http.name=HedgeDoc"               # 监控项名称
      - "kuma.hedgedoc.http.url=http://hedgedoc:3000"  # 内网直连
      # (可选) 每 60 秒检查一次，重试 3 次
      - "kuma.hedgedoc.http.interval=60"
      - "kuma.hedgedoc.http.max_retries=3"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true