services:
  pocket-id:
    image: ghcr.io/pocket-id/pocket-id:v1
    restart: unless-stopped
    env_file: .env
    volumes:
      - "./data:/app/data"
    healthcheck:
      test: [ "CMD", "/app/pocket-id", "healthcheck" ]
      interval: 1m30s
      timeout: 5s
      retries: 2
      start_period: 10s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pocketid.rule=Host(`auth.${LOCAL_DOMAIN}`)"
      - "traefik.http.routers.pocketid.entrypoints=https"
      - "traefik.http.routers.pocketid.tls=true"
      - "traefik.http.services.pocketid.loadbalancer.server.port=1411"
      # - "traefik.http.middlewares.pocketid.forwardAuth.address='http://pocket_id:3000/api/authz/forward-auth'"
      # - "traefik.http.middlewares.pocketid.forwardAuth.trustForwardHeader=true"
      # - "traefik.http.middlewares.pocketid.forwardAuth.authResponseHeaders='Remote-User,Remote-Name,Remote-Email,Remote-Groups'"
    networks:
      - proxy

networks:
  proxy:
    external: true