services:
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    container_name: homepage
    restart: unless-stopped
    networks:
      - proxy
    # No need to map 3000: Traefik will talk to it internally
    expose:
      - "3000"
    volumes:
      - ./config:/app/config            # repo-local config dir
      - /var/run/docker.sock:/var/run/docker.sock:ro   # optional, for docker integrations 
    environment:
      HOMEPAGE_ALLOWED_HOSTS: ${HOMEPAGE_HOST}
      PUID: ${PUID:-1000}
      PGID: ${PGID:-1000}

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.homepage.rule=Host(`${HOMEPAGE_HOST}`)"
      - "traefik.http.routers.homepage.entrypoints=websecure"
      - "traefik.http.routers.homepage.tls=true"
      - "traefik.http.routers.homepage.tls.certresolver=luadns"
      - "traefik.http.services.homepage.loadbalancer.server.port=3000"

      # Optional: protect with CrowdSec bouncer
      - "traefik.http.routers.homepage.middlewares=crowdsec-security@docker"

networks:
  proxy:
    external: true