version: "3.8"

services:
  postgres:
    image: postgres:15.2-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: ztnet
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - app-network
      - traefik_default

  zerotier:
    image: zyclonite/zerotier:1.14.2
    container_name: zerotier
    hostname: zerotier
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - zerotier:/var/lib/zerotier-one
    environment:
      - ZT_OVERRIDE_LOCAL_CONF=true
      - ZT_ALLOW_MANAGEMENT_FROM=172.31.255.0/29
    networks:
      - app-network
    ports:
      - "9994:9993/udp"

  ztnet:
    image: sinamics/ztnet:latest
    container_name: ztnet
    working_dir: /app
    restart: unless-stopped
    volumes:
      - zerotier:/var/lib/zerotier-one
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: ztnet
      NEXTAUTH_URL: "https://ztnet.rozic-dev.com"
      NEXTAUTH_SECRET: "random_secret"
      NEXTAUTH_URL_INTERNAL: "http://ztnet:3000"
      HOST: "0.0.0.0"
      PORT: "3000"
    networks:
      - app-network
      - traefik_default
    depends_on:
      - postgres
      - zerotier
    labels:
      - "traefik.enable=true"

      # HTTPS router (unchanged – perfect)
      - "traefik.http.routers.ztnet.rule=Host(`ztnet.rozic-dev.com`)"
      - "traefik.http.routers.ztnet.entrypoints=websecure"
      - "traefik.http.routers.ztnet.tls=true"
      - "traefik.http.routers.ztnet.tls.certresolver=letsencrypt"

      # HTTP router – ONLY for ACME challenge + built-in redirect
      - "traefik.http.routers.ztnet-http.rule=Host(`ztnet.rozic-dev.com`)"
      - "traefik.http.routers.ztnet-http.entrypoints=web"
      # ← REMOVE the two lines below completely:
      # - "traefik.http.routers.ztnet-http.middlewares=redirect-to-https"
      # - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

      # Service
      - "traefik.http.services.ztnet.loadbalancer.server.port=3000"
      - "traefik.docker.network=traefik_default"

volumes:
  zerotier:
  postgres-data:

networks:
  app-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.31.255.0/29

  traefik_default:
    external: true