services:
  ghost-db:
    image: ${GHOST_DB_IMAGE}
    container_name: ghost-db
    restart: unless-stopped
    labels:
      prune.protect: "true"
    environment:
      MYSQL_ROOT_PASSWORD: ${GHOST_DB_ROOT_PASSWORD}
      MYSQL_DATABASE: ${GHOST_DB_NAME}
      MYSQL_USER: ${GHOST_DB_USER}
      MYSQL_PASSWORD: ${GHOST_DB_PASSWORD}
      TZ: ${TZ}
    volumes:
      - ${GHOST_DB_DATA_PATH}:/var/lib/mysql:Z
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -u${GHOST_DB_USER} -p${GHOST_DB_PASSWORD} --silent"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 30s
    networks:
      - ghost_internal

  ghost:
    image: ${GHOST_IMAGE}
    container_name: ghost
    restart: unless-stopped
    depends_on:
      ghost-db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      TZ: ${TZ}
      url: https://${GHOST_DOMAIN}
      database__client: mysql
      database__connection__host: ghost-db
      database__connection__user: ${GHOST_DB_USER}
      database__connection__password: ${GHOST_DB_PASSWORD}
      database__connection__database: ${GHOST_DB_NAME}
      mail__transport: SMTP
      mail__from: ${GHOST_MAIL_FROM}
      mail__options__host: mail-relay
      mail__options__port: 587
      mail__options__secure: "false"
      mail__options__ignoreTLS: "true"
    volumes:
      - ${GHOST_CONTENT_PATH}:/var/lib/ghost/content:Z
    networks:
      - ghost_internal
      - proxy
      - mail_internal
    labels:
      prune.protect: "true"
      traefik.enable: "true"
      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
      traefik.http.routers.ghost.rule: "Host(`${GHOST_DOMAIN}`)"
      traefik.http.routers.ghost.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
      traefik.http.routers.ghost.tls: "true"
      traefik.http.routers.ghost.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
      traefik.http.routers.ghost.service: "ghost"
      traefik.http.routers.ghost.middlewares: "crowdsec-bouncer@file"
      traefik.http.services.ghost.loadbalancer.server.port: "2368"
      homepage.group: "Productividad"
      homepage.name: "News"
      homepage.icon: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/ghost.svg"
      homepage.description: "Briefing diario y archivo de informes"
      homepage.href: "https://${GHOST_DOMAIN}/"
      homepage.siteMonitor: "http://ghost:2368/"
      homepage.weight: "570"

  ghost-ops-gate:
    image: python:3.12-alpine
    container_name: ghost-ops-gate
    restart: unless-stopped
    depends_on:
      - ghost
    environment:
      OPS_ALLOWED_EMAIL: ${GHOST_OPS_ALLOWED_EMAIL}
      GHOST_CONTENT_API_KEY: ${GHOST_CONTENT_API_KEY}
    command: ["python", "/app/ops_gate.py"]
    volumes:
      - ./ops-gate:/app:ro,Z
    networks:
      - ghost_internal
      - proxy
    labels:
      prune.protect: "true"
      traefik.enable: "true"
      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
      traefik.http.routers.ghost-ops-gate.rule: "Host(`${GHOST_DOMAIN}`) && (Path(`/ops`) || Path(`/ops/`))"
      traefik.http.routers.ghost-ops-gate.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
      traefik.http.routers.ghost-ops-gate.tls: "true"
      traefik.http.routers.ghost-ops-gate.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
      traefik.http.routers.ghost-ops-gate.priority: "100"
      traefik.http.routers.ghost-ops-gate.middlewares: "crowdsec-bouncer@file"
      traefik.http.routers.ghost-ops-gate.service: "ghost-ops-gate"
      traefik.http.services.ghost-ops-gate.loadbalancer.server.port: "8080"

networks:
  ghost_internal:
    driver: bridge
    labels:
      prune.protect: "true"
  mail_internal:
    external: true
  proxy:
    external: true