---
services:
  << service_name or 'infisical' >>:
    image: infisical/infisical:v0.158.0
    restart: << restart_policy >>
    <%- if container_name %>
    container_name: << container_name >>
    <%- endif %>
    environment:
      - NODE_ENV=production
      - SITE_URL=${SITE_URL}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - AUTH_SECRET=${AUTH_SECRET}
      - DB_CONNECTION_URI=${DB_CONNECTION_URI}
      - REDIS_URL=${REDIS_URL}
      <%- if email_enabled %>
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS}
      - SMTP_FROM_NAME=${SMTP_FROM_NAME}
      - SMTP_USERNAME=${SMTP_USERNAME}
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - SMTP_SECURE=${SMTP_SECURE}
      - SMTP_REQUIRE_TLS=${SMTP_REQUIRE_TLS}
      - SMTP_IGNORE_TLS=${SMTP_IGNORE_TLS}
      <%- endif %>
    <%- if (not database_external) or (not redis_external) %>
    depends_on:
      <%- if not database_external %>
      << service_name or 'infisical' >>_postgres:
        condition: service_healthy
      <%- endif %>
      <%- if not redis_external %>
      << service_name or 'infisical' >>_redis:
        condition: service_started
      <%- endif %>
    <%- endif %>
    networks:
      - << service_name or 'infisical' >>_backend
      <%- if traefik_enabled %>
      - << traefik_network >>
      <%- endif %>
    <%- if not traefik_enabled %>
    ports:
      - "<< ports_http >>:8080"
    <%- endif %>
    <%- if traefik_enabled %>
    labels:
      - traefik.enable=true
      - traefik.docker.network=<< traefik_network >>
      - traefik.http.services.<< service_name or 'infisical' >>.loadBalancer.server.port=8080
      - traefik.http.routers.<< service_name or 'infisical' >>_http.service=<< service_name or 'infisical' >>
      - traefik.http.routers.<< service_name or 'infisical' >>_http.rule=Host(`<< traefik_host >>.<< traefik_domain >>`)
      - traefik.http.routers.<< service_name or 'infisical' >>_http.entrypoints=<< traefik_entrypoint >>
      <%- if traefik_tls_enabled %>
      - traefik.http.routers.<< service_name or 'infisical' >>_https.service=<< service_name or 'infisical' >>
      - traefik.http.routers.<< service_name or 'infisical' >>_https.rule=Host(`<< traefik_host >>.<< traefik_domain >>`)
      - traefik.http.routers.<< service_name or 'infisical' >>_https.entrypoints=<< traefik_tls_entrypoint >>
      - traefik.http.routers.<< service_name or 'infisical' >>_https.tls=true
      - traefik.http.routers.<< service_name or 'infisical' >>_https.tls.certresolver=<< traefik_tls_certresolver >>
      <%- endif %>
    <%- endif %>

  <%- if not database_external %>
  << service_name or 'infisical' >>_postgres:
    image: docker.io/library/postgres:14-alpine
    restart: << restart_policy >>
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready --username=$${POSTGRES_USER} --dbname=$${POSTGRES_DB}"]
      interval: 5s
      timeout: 10s
      retries: 10
    networks:
      - << service_name or 'infisical' >>_backend
    volumes:
      <%- if volume_mode == 'mount' %>
      - << volume_mount_path >>/postgres:/var/lib/postgresql/data
      <%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
      - << service_name or 'infisical' >>_postgres:/var/lib/postgresql/data
      <%- endif %>
  <%- endif %>

  <%- if not redis_external %>
  << service_name or 'infisical' >>_redis:
    image: docker.io/library/redis:7-alpine
    restart: << restart_policy >>
    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]
    networks:
      - << service_name or 'infisical' >>_backend
    volumes:
      <%- if volume_mode == 'mount' %>
      - << volume_mount_path >>/redis:/data
      <%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
      - << service_name or 'infisical' >>_redis:/data
      <%- endif %>
  <%- endif %>

networks:
  << service_name or 'infisical' >>_backend:
    driver: bridge
  <%- if traefik_enabled %>
  << traefik_network >>:
    external: true
  <%- endif %>

<%- if volume_mode == 'local' and ((not database_external) or (not redis_external)) %>
volumes:
  <%- if not database_external %>
  << service_name or 'infisical' >>_postgres:
    driver: local
  <%- endif %>
  <%- if not redis_external %>
  << service_name or 'infisical' >>_redis:
    driver: local
  <%- endif %>
<%- elif volume_mode == 'nfs' and ((not database_external) or (not redis_external)) %>
volumes:
  <%- if not database_external %>
  << service_name or 'infisical' >>_postgres:
    driver: local
    driver_opts:
      type: nfs
      o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
      device: ":<< volume_nfs_path >>/postgres"
  <%- endif %>
  <%- if not redis_external %>
  << service_name or 'infisical' >>_redis:
    driver: local
    driver_opts:
      type: nfs
      o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
      device: ":<< volume_nfs_path >>/redis"
  <%- endif %>
<%- endif %>