services:
  relay:
    build:
      context: .
      dockerfile: Dockerfile
    image: eks-relay:local
    container_name: eks-relay
    restart: always
    env_file: .env
    environment:
      - NODE_ENV=production
      - PORT=3000
      # Absolute path: Prisma resolves relative file: URLs against prisma/.
      - DATABASE_URL=file:/app/data/eks_relay.db
    volumes:
      # The whole repository is bind-mounted, so `git pull` + restart is enough
      # to ship a code change. node_modules stays in a named volume so the
      # container's Linux binaries are not shadowed by the host's.
      - .:/app
      - relay_node_modules:/app/node_modules
      - ./data:/app/data
    networks:
      - web
    labels:
      - traefik.enable=true
      - traefik.docker.network=web
      - traefik.http.routers.eksrelay.rule=Host(`eks-relay.easyklima.com`)
      - traefik.http.routers.eksrelay.entrypoints=https
      - traefik.http.routers.eksrelay.tls=true
      - traefik.http.routers.eksrelay.tls.certresolver=letsencrypt
      - traefik.http.services.eksrelay.loadbalancer.server.port=3000
      - traefik.http.routers.eksrelay.middlewares=eksrelay-headers
      - traefik.http.middlewares.eksrelay-headers.headers.sslredirect=true
      - traefik.http.middlewares.eksrelay-headers.headers.stsseconds=63072000
      - traefik.http.middlewares.eksrelay-headers.headers.stsincludesubdomains=true
      - traefik.http.middlewares.eksrelay-headers.headers.referrerpolicy=no-referrer
      # HTTP router only exists so Let's Encrypt can answer the ACME challenge.
      - traefik.http.routers.eksrelay-http.rule=Host(`eks-relay.easyklima.com`)
      - traefik.http.routers.eksrelay-http.entrypoints=http
      - traefik.http.routers.eksrelay-http.middlewares=eksrelay-to-https
      - traefik.http.middlewares.eksrelay-to-https.redirectscheme.scheme=https

volumes:
  relay_node_modules:

networks:
  web:
    external: true