services:
  pocketid:
    image: ghcr.io/pocket-id/pocket-id:v2
    container_name: pocket-id
    restart: unless-stopped
    environment:
      - APP_URL=https://pocket-id.coreos.home
      - ENCRYPTION_KEY_FILE=/keys/key
    volumes:
      - "./data/keys:/keys"
      - "./data/app_data:/app/data"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pocket-id.entrypoints=websecure"
      - "traefik.http.routers.pocket-id.rule=Host(`pocket-id.coreos.home`)"
      - "traefik.http.routers.pocket-id.tls=true"
      - "traefik.http.routers.pocket-id.service=pocket-id"
      - "traefik.http.services.pocket-id.loadbalancer.server.port=1411"
      - "traefik.docker.network=proxy"
    ports:
      - 1411:1411
    networks:
      - proxy
    # Optional healthcheck
    healthcheck:
      test: [ "CMD", "/app/pocket-id", "healthcheck" ]
      interval: 1m30s
      timeout: 5s
      retries: 2
      start_period: 10s
networks:
  proxy:
    external: true