services:
  authelia:
    image: authelia/authelia:4.39
    container_name: authelia
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    volumes:
      - ./secrets:/secrets:ro
      - ./config:/config
    networks:
      - traefik
      - internal
    environment:
      TZ: ${TZ:-Europe/Berlin}
      X_AUTHELIA_CONFIG_FILTERS: template
      AUTHELIA_LOG_LEVEL: ${AUTHELIA_LOG_LEVEL:-info}
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.authelia.rule=Host(`auth.schwenk.online`)
      - traefik.http.routers.authelia.entrypoints=websecure
      - traefik.http.routers.authelia.tls.certresolver=myresolver
      - traefik.http.routers.authelia.service=authelia
      - traefik.http.services.authelia.loadbalancer.server.port=9091
      - traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth
      - traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true
      - traefik.http.middlewares.authelia.forwardAuth.maxResponseBodySize=8192
      - traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email
    depends_on:
      - redis

  redis:
    image: redis:7-alpine
    container_name: authelia-redis
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    command: redis-server --save 60 1 --loglevel warning
    volumes:
      - redis-data:/data
    networks:
      - internal

  whoami:
    image: traefik/whoami:v1.10
    container_name: whoami-auth
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    networks:
      - traefik
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.whoami-auth.rule=Host(`whoami-auth.schwenk.online`)
      - traefik.http.routers.whoami-auth.entrypoints=websecure
      - traefik.http.routers.whoami-auth.tls.certresolver=myresolver
      - traefik.http.routers.whoami-auth.middlewares=authelia@docker
      - traefik.http.services.whoami-auth.loadbalancer.server.port=80

networks:
  traefik:
    external: true
  internal:
    driver: bridge

volumes:
  redis-data: