version: '3'

services:
  nc_db:
    image: mariadb:11.3
    networks:
      - nc_internal
    container_name: nc_db
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1 --skip-innodb-read-only-compressed
    restart: always
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    volumes:
      - nc_db_v2:/var/lib/mysql:Z
    env_file:
      - stack.env

  nc_redis:
    image: redis:alpine
    networks:
      - nc_internal
    hostname: redis
    container_name: nc_redis
    restart: always

  nc_app:
    image: nextcloud:28-fpm-alpine
    networks:
      - nc_internal
    restart: always
    hostname: nc_app
    container_name: nc_app
    volumes:
      - nextcloud_v2:/var/www/html:z
      - /dev/shm/nextcloud/ramdisk:/ramdisk
    env_file:
      - stack.env
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    depends_on:
      - nc_db
      - nc_redis

  nc_web:
    image: nginx:alpine
    hostname: nc_web
    container_name: nc_web
    restart: always
    networks:
      - proxy
      - nc_internal
    volumes:
      - nextcloud_v2:/var/www/html:z,ro
      - /opt/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - /dev/shm/nginx:/dev/shm/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nextcloud.rule=Host(`example.com`)"
      - "traefik.http.routers.nextcloud.service=nextcloud"
      - "traefik.http.routers.nextcloud.entrypoints=websecure"
      - "traefik.http.services.nextcloud.loadbalancer.server.port=80"
      - "traefik.http.routers.nextcloud.tls=true"
      - "traefik.http.routers.nextcloud.tls.certresolver=cloudflare"
      - "traefik.http.services.nextcloud.loadbalancer.passhostheader=true"
      - "traefik.http.routers.nextcloud.middlewares=compresstraefik,redirect-to-https,nextcloud-redirectregex1,nextcloud-redirectregex2"
      - "traefik.http.middlewares.compresstraefik.compress=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
      - "traefik.http.routers.redir-to-https.entrypoints=web"
      - "traefik.http.routers.redir-to-https.rule=Host(`example.com`)"
      - "traefik.http.middlewares.nextcloud-redirectregex1.redirectregex.permanent=true"
      - "traefik.http.middlewares.nextcloud-redirectregex1.redirectregex.regex=https?://([^/]*)/.well-known/(card|cal)dav"
      - "traefik.http.middlewares.nextcloud-redirectregex1.redirectregex.replacement=https://$${1}/remote.php/dav/"
      - "traefik.http.middlewares.nextcloud-redirectregex2.redirectregex.permanent=true"
      - "traefik.http.middlewares.nextcloud-redirectregex2.redirectregex.regex=https?://([^/]*)(/.well-known[^#]*)"
      - "traefik.http.middlewares.nextcloud-redirectregex2.redirectregex.replacement=https://$${1}/index.php$${2}"
    depends_on:
      - nc_app
    
  nc_cron:
    image: nextcloud:28-fpm-alpine
    networks:
      - nc_internal
    container_name: nc_cron
    restart: always
    volumes:
      - nextcloud_v2:/var/www/html:z
    entrypoint: /cron.sh
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    depends_on:
      - nc_db
      - nc_redis


volumes:
  nc_db_v2:
  nextcloud_v2:

networks:
  proxy:
    external: true
  nc_internal:
    enable_ipv6: true
    ipam:
      config:
        - subnet: 2001:0DB9::/112