services:
  hedgedoc2:
    build:
      context: /home/xiteng/src/hedgedoc
      dockerfile: Dockerfile
    image: hedgedoc2:ai-preview
    container_name: hedgedoc2
    restart: unless-stopped
    environment:
      - HD_BACKEND_PORT=3000
      - HD_BACKEND_BIND_IP=0.0.0.0
      - HD_FRONTEND_PORT=3001
      - PORT=3001
      - HD_DATABASE_TYPE=sqlite
      - HD_DATABASE_NAME=/data/hedgedoc.sqlite
      - HD_BASE_URL=https://notes2.xiteng.site
      - HD_RENDERER_BASE_URL=https://notes2.xiteng.site
      - HD_INTERNAL_API_URL=http://localhost:3000/
      # Auth — Authentik OIDC
      - HD_AUTH_SESSION_SECRET=hedgedoc2-experimental-session-secret-min-32-chars!!
      - HD_AUTH_OIDC_SERVERS=AUTHENTIK
      - HD_AUTH_OIDC_AUTHENTIK_ISSUER=https://auth.xiteng.site/application/o/hedgedoc2/
      - HD_AUTH_OIDC_AUTHENTIK_CLIENT_ID=hedgedoc2
      - HD_AUTH_OIDC_AUTHENTIK_CLIENT_SECRET=hedgedoc2-secret-9
      - HD_AUTH_OIDC_AUTHENTIK_PROVIDER_NAME=Authentik
      - HD_AUTH_LOCAL_ENABLE_LOGIN=false
      # Permissions
      - HD_NOTE_PERMISSIONS_DEFAULT_EVERYONE=write
      # Media
      - HD_MEDIA_BACKEND_TYPE=filesystem
      - HD_MEDIA_BACKEND_FILESYSTEM_UPLOAD_PATH=/data/uploads
      # AI assistant config
      - HD_AI_ENABLED=true
      - HD_AI_TIMEOUT_MS=60000
      - HD_AI_MAX_INPUT_CHARS=32000
      - HD_AI_KEY_VAULT_URL=http://ai-gateway:8093
      - HD_AI_KEY_VAULT_TOKEN_FILE=/run/secrets/key_vault_service_token
      - HD_AI_KEY_VAULT_ISSUER=https://auth.xiteng.site
      - HD_AI_KEY_VAULT_OIDC_IDENTIFIER=authentik
    volumes:
      - ./data:/data
      - ../ai-gateway/secrets/portal_gateway_hmac:/run/secrets/key_vault_service_token:ro
    networks:
      - homelab_net
    labels:
      # Traefik routing
      - "traefik.enable=true"
      # Backend routes: API, realtime websocket, uploads, and media
      - "traefik.http.routers.hedgedoc2-api.rule=Host(`notes2.xiteng.site`) && (PathPrefix(`/api`) || PathPrefix(`/realtime`) || PathPrefix(`/uploads`) || PathPrefix(`/media`))"
      - "traefik.http.routers.hedgedoc2-api.entrypoints=websecure"
      - "traefik.http.routers.hedgedoc2-api.tls=true"
      - "traefik.http.routers.hedgedoc2-api.tls.certresolver=cfresolver"
      - "traefik.http.routers.hedgedoc2-api.service=hedgedoc2-api"
      - "traefik.http.services.hedgedoc2-api.loadbalancer.server.port=3000"
      # Backend HTTP entrypoint
      - "traefik.http.routers.hedgedoc2-api-http.rule=Host(`notes2.xiteng.site`) && (PathPrefix(`/api`) || PathPrefix(`/realtime`) || PathPrefix(`/uploads`) || PathPrefix(`/media`))"
      - "traefik.http.routers.hedgedoc2-api-http.entrypoints=web"
      - "traefik.http.routers.hedgedoc2-api-http.service=hedgedoc2-api"
      - "traefik.http.routers.hedgedoc2-api-http.middlewares=force-https"
      - "traefik.http.routers.hedgedoc2-api.middlewares=force-https"
      # Frontend → frontend (3001)
      - "traefik.http.routers.hedgedoc2.rule=Host(`notes2.xiteng.site`)"
      - "traefik.http.routers.hedgedoc2.entrypoints=websecure"
      - "traefik.http.routers.hedgedoc2.tls=true"
      - "traefik.http.routers.hedgedoc2.tls.certresolver=cfresolver"
      - "traefik.http.routers.hedgedoc2.service=hedgedoc2"
      - "traefik.http.services.hedgedoc2.loadbalancer.server.port=3001"
      # HTTP entrypoint (Cloudflare Tunnel)
      - "traefik.http.routers.hedgedoc2-http.rule=Host(`notes2.xiteng.site`)"
      - "traefik.http.routers.hedgedoc2-http.entrypoints=web"
      - "traefik.http.routers.hedgedoc2-http.service=hedgedoc2"
      - "xiteng.site.cache.hedgedoc2.enabled=true"
      - "xiteng.site.cache.hedgedoc2.routers=hedgedoc2,hedgedoc2-http"
      - "xiteng.site.cache.hedgedoc2.paths=/assets/,/static/"
      - "xiteng.site.cache.hedgedoc2.edge-ttl=604800"
      - "xiteng.site.cache.hedgedoc2.stale-while-revalidate=86400"
      # Force X-Forwarded-Proto
      - "traefik.http.routers.hedgedoc2-http.middlewares=force-https"
      - "traefik.http.routers.hedgedoc2.middlewares=force-https"
      - "xiteng.site.component.hedgedoc2.enabled=true"
      - "xiteng.site.component.hedgedoc2.name=HedgeDoc 2 (AI)"
      - "xiteng.site.component.hedgedoc2.description=带本地模型写作助手的 HedgeDoc 2 实验环境。"
      - "xiteng.site.component.hedgedoc2.section=services"
      - "xiteng.site.component.hedgedoc2.category=开发与协作"
      - "xiteng.site.component.hedgedoc2.url=https://notes2.xiteng.site"
      - "xiteng.site.component.hedgedoc2.access=sso"
      - "xiteng.site.component.hedgedoc2.access-label=需要登录"
      - "xiteng.site.component.hedgedoc2.icon=H2"
      - "xiteng.site.component.hedgedoc2.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/hedgedoc.svg"
      - "xiteng.site.component.hedgedoc2.accent=blue"
      - "xiteng.site.component.hedgedoc2.order=120"
      - "xiteng.site.component.hedgedoc2.navigation=new-tab"
      - "xiteng.site.component.hedgedoc2.portal-link=native"
      - "xiteng.site.component.hedgedoc2.monitor.enabled=true"
      - "xiteng.site.component.hedgedoc2.monitor.url=http://hedgedoc2:3001"

networks:
  homelab_net:
    external: true