services:
  thelounge:
    image: thelounge/thelounge:latest
    container_name: thelounge
    restart: unless-stopped

    # The Lounge listens on 9000 internally
    ports:
      - "9000:9000"

    volumes:
      - /opt/proxy_stack/apps/thelounge/data:/var/opt/thelounge

    # Attach to the same network Traefik uses
    networks:
      - proxy

    environment:
      - TZ=America/Toronto

    # If at some point you run Traefik *on this same Docker host*
    # you can uncomment and adapt these labels.
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"

      # Use the same external network as Traefik
      - "traefik.docker.network=proxy"

      # Router: HTTPS
      - "traefik.http.routers.thelounge.rule=Host(`irc.digitalvoid.ca`)"
      - "traefik.http.routers.thelounge.entrypoints=websecure"
      - "traefik.http.routers.thelounge.tls=true"

      # Use your existing DNS-challenge resolver
      - "traefik.http.routers.thelounge.tls.certresolver=luadns"

      # Internal port of the app
      - "traefik.http.services.thelounge.loadbalancer.server.port=9000"
      
      # Optional: protect with CrowdSec bouncer
      - "traefik.http.routers.homepage.middlewares=crowdsec-security@docker"

volumes:
  thelounge_data:

networks:
  proxy:
    external: true