services:
  hedgedoc-db:
    image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
    environment:
      - POSTGRES_USER=$POSTGRES_USER
      - POSTGRES_PASSWORD=$POSTGRES_PASSWORD
      - POSTGRES_DB=$POSTGRES_DB
    container_name: hedgedoc_db
    restart: unless-stopped
    labels:
      - "xiteng.site.component.hedgedoc-db.enabled=true"
      - "xiteng.site.component.hedgedoc-db.name=HedgeDoc PostgreSQL"
      - "xiteng.site.component.hedgedoc-db.description=保存笔记、修订记录、会话与权限元数据。"
      - "xiteng.site.component.hedgedoc-db.section=infrastructure"
      - "xiteng.site.component.hedgedoc-db.category=数据层"
      - "xiteng.site.component.hedgedoc-db.access=internal"
      - "xiteng.site.component.hedgedoc-db.access-label=仅容器网络"
      - "xiteng.site.component.hedgedoc-db.icon=PG"
      - "xiteng.site.component.hedgedoc-db.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg"
      - "xiteng.site.component.hedgedoc-db.accent=blue"
      - "xiteng.site.component.hedgedoc-db.order=540"
    volumes:
      - ./data:/var/lib/postgresql/data
    networks:
      - homelab_net

  hedgedoc:
    image: quay.io/hedgedoc/hedgedoc:1.11.1
    container_name: hedgedoc
    restart: unless-stopped
    environment:
      - CMD_DB_HOST=hedgedoc_db
      - CMD_DB_PORT=5432
      - CMD_DB_DATABASE=$POSTGRES_DB
      - CMD_DB_USERNAME=$POSTGRES_USER
      - CMD_DB_PASSWORD=$POSTGRES_PASSWORD
      - CMD_DB_DIALECT=postgres
      - CMD_DOMAIN=notes.xiteng.site
      - CMD_URL_ADDPORT=false
      - CMD_ALLOW_ORIGIN=localhost,notes.xiteng.site
      - CMD_PROTOCOL_USESSL=true
      - CMD_OAUTH2_PROVIDERNAME=Authentik
      - CMD_OAUTH2_CLIENT_ID=hedgedoc-280baa8d
      - CMD_OAUTH2_CLIENT_SECRET=0630f01b111d4ad68ff9b2d174028994decb5b55b51a4556bda24768d11b4586
      - CMD_OAUTH2_AUTHORIZATION_URL=https://auth.xiteng.site/application/o/authorize/
      - CMD_OAUTH2_TOKEN_URL=https://auth.xiteng.site/application/o/token/
      - CMD_OAUTH2_USER_PROFILE_URL=https://auth.xiteng.site/application/o/userinfo/
      - CMD_OAUTH2_SCOPE=openid profile email
      - CMD_OAUTH2_ISSUER=https://auth.xiteng.site/application/o/hedgedoc/
      - CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR=preferred_username
      - CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR=name
      - CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR=email
    volumes:
      - ./uploads:/hedgedoc/public/uploads
      - ./custom/index-body.ejs:/hedgedoc/public/views/index/body.ejs:ro
    depends_on:
      - hedgedoc-db
    ports:
      - "3000:3000"
    labels:
      # --- 1. Traefik 路由设置 ---
      - "traefik.enable=true"
      - "traefik.http.routers.hedgedoc.rule=Host(`notes.xiteng.site`)"
      - "traefik.http.services.hedgedoc.loadbalancer.server.port=3000"
      # 强制使用 websecure (443端口) 入口
      - "traefik.http.routers.hedgedoc.entrypoints=websecure"
      # --- HTTP 入口（来自 cloudflared tunnel）---
      - "traefik.http.routers.hedgedoc-http.rule=Host(`notes.xiteng.site`)"
      - "traefik.http.routers.hedgedoc-http.service=hedgedoc"
      - "traefik.http.routers.hedgedoc-http.entrypoints=web"
      # --- 中间件：强制 X-Forwarded-Proto（Cloudflare Tunnel 用 HTTP 连 Traefik，但用户端是 HTTPS）---
      - "traefik.http.middlewares.force-https.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.hedgedoc-http.middlewares=force-https"
      - "traefik.http.routers.hedgedoc.middlewares=force-https"
      # --- 新增：开启 TLS 并指定解析器 ---
      - "traefik.http.routers.hedgedoc.tls=true"
      - "traefik.http.routers.hedgedoc.tls.certresolver=cfresolver"
      - "xiteng.site.cache.hedgedoc.enabled=true"
      - "xiteng.site.cache.hedgedoc.routers=hedgedoc,hedgedoc-http"
      - "xiteng.site.cache.hedgedoc.paths=/assets/,/static/"
      - "xiteng.site.cache.hedgedoc.edge-ttl=604800"
      - "xiteng.site.cache.hedgedoc.stale-while-revalidate=86400"
      # --- Xiteng Site dynamic catalog ---
      - "xiteng.site.component.hedgedoc.enabled=true"
      - "xiteng.site.component.hedgedoc.name=HedgeDoc"
      - "xiteng.site.component.hedgedoc.description=实时 Markdown 协作、分享与技术笔记。"
      - "xiteng.site.component.hedgedoc.section=services"
      - "xiteng.site.component.hedgedoc.category=开发与协作"
      - "xiteng.site.component.hedgedoc.url=https://notes.xiteng.site"
      - "xiteng.site.component.hedgedoc.access=mixed"
      - "xiteng.site.component.hedgedoc.access-label=公开入口 · 内容按笔记授权"
      - "xiteng.site.component.hedgedoc.icon=HD"
      - "xiteng.site.component.hedgedoc.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/hedgedoc.svg"
      - "xiteng.site.component.hedgedoc.accent=yellow"
      - "xiteng.site.component.hedgedoc.order=110"
      - "xiteng.site.component.hedgedoc.navigation=new-tab"
      - "xiteng.site.component.hedgedoc.portal-link=native"
      - "xiteng.site.component.hedgedoc.monitor.enabled=true"
      - "xiteng.site.component.hedgedoc.monitor.url=http://hedgedoc:3000"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true