version: "3"

services:
  flask-app:
    image: python:3.11-slim
    container_name: bethaus-app
    restart: always
    working_dir: /app
    volumes:
      - ./:/app
      - ./filecache:/app/filecache
      - ./templates:/app/templates
      - /mnt/app.bethaus:/mp3_root:ro
    environment:
      - FLASK_APP=app.py
      - FLASK_RUN_HOST=0.0.0.0
      - FLASK_ENV=production
      - MP3_ROOT=/mp3_root
    networks:
      - traefik
    labels:
      - "traefik.enable=true"

      # ----------------------------------------------------
      #    HTTP router: Listen on entrypoint "web" (port 80)
      #    and apply a middleware to force redirect to HTTPS
      # ----------------------------------------------------
      - "traefik.http.routers.bethaus-app.rule=Host(`app.bethaus-speyer.de`)"
      - "traefik.http.routers.bethaus-app.entrypoints=web"
      - "traefik.http.routers.bethaus-app.middlewares=redirect-to-https"

      # This is the "redirect-to-https" middleware definition
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

      # -----------------------------------------------------
      #    HTTPS router: Listen on entrypoint "websecure" 
      #    using TLS via your ACME (Let's Encrypt) resolver
      # -----------------------------------------------------
      - "traefik.http.routers.bethaus-app-secure.rule=Host(`app.bethaus-speyer.de`)"
      - "traefik.http.routers.bethaus-app-secure.entrypoints=websecure"
      - "traefik.http.routers.bethaus-app-secure.tls=true"
      - "traefik.http.routers.bethaus-app-secure.tls.certresolver=myresolver"

      # The service’s internal port
      - "traefik.http.services.bethaus-app.loadbalancer.server.port=5000"

    command: >
      sh -c "pip install -r requirements.txt && flask run"

networks:
  traefik:
    external: true