version: "3.7"

services:
  barrel:
    build:
      context: .
      args:
        BARREL_BASE_IMAGE: ${BARREL_BASE_IMAGE}
        OPCACHE_MODE: ${OPCACHE_MODE}
        CONTENT_SECURITY_POLICY: ${CONTENT_SECURITY_POLICY}

    logging:
      driver: none
    
    restart: always
    hostname: ${WISSKI_HOSTNAME}

    # label it with the current slug
    labels:
      - "traefik.enable=True"
      - "eu.wiss-ki.barrel.distillery=${DOCKER_NETWORK_NAME}"

      - "traefik.http.routers.wisski_${SLUG}.rule=${HOST_RULE}"
      - "traefik.http.routers.wisski_${SLUG}.tls=${HTTPS_ENABLED}"
      - "traefik.http.routers.wisski_${SLUG}.tls.certresolver=distillery"
      - "traefik.http.routers.wisski_${SLUG}.middlewares=wisski_${SLUG}_hmid@docker"

      - "traefik.http.services.wisski_${SLUG}.loadbalancer.server.port=8080"

      # Remove all of the custom headers that display which server powers us.
      # Only hackers need to know this.
      - "traefik.http.middlewares.wisski_${SLUG}_hmid.headers.customresponseheaders.x-drupal-cache="
      - "traefik.http.middlewares.wisski_${SLUG}_hmid.headers.customresponseheaders.x-drupal-dynamic-cache="
      - "traefik.http.middlewares.wisski_${SLUG}_hmid.headers.customresponseheaders.x-generator="
      - "traefik.http.middlewares.wisski_${SLUG}_hmid.headers.customresponseheaders.x-powered-by="
      - "traefik.http.middlewares.wisski_${SLUG}_hmid.headers.customresponseheaders.Server="
    
    # volumes that are mounted
    volumes:
      - ${RUNTIME_DIR}:/runtime:ro
      - ${DATA_PATH}/.composer:/var/www/.composer:rw
      - ${DATA_PATH}/data:/var/www/data:rw
      - ${DATA_PATH}/home:/var/www:rw
      - ${DATA_PATH}/hostkeys:/ssh/hostkeys:rw

networks:
  default:
    name: ${DOCKER_NETWORK_NAME}
    external: true
