version: '3.8'

networks:
  proxy-net:
    driver: bridge
  internal-net:
    driver: bridge

volumes:
  npm_data:
  npm_letsencrypt:
  homepage_config:
  authentik_db:
  authentik_redis:
  authentik_media:
  authentik_certs:
  simplelogin_data:
  simplelogin_postgres:
  simplelogin_redis:
  nextcloud_data:
  nextcloud_db:
  forgejo_data:
  plane_postgres:
  plane_redis:
  plane_minio:
  docmost_data:
  docmost_db:
  paperless_data:
  paperless_media:
  paperless_db:
  paperless_redis:
  calibre_data:
  uptime_kuma:
  freescout_data:
  freescout_db:
  freescout_redis:

services:
  # ==========================================
  # 1. REVERSE PROXY & SSL (Nginx Proxy Manager)
  # ==========================================
  nginx-proxy-manager:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      - '81:81' # Admin Web UI
    networks:
      - proxy-net
      - internal-net
    volumes:
      - npm_data:/data
      - npm_letsencrypt:/etc/letsencrypt

  # ==========================================
  # 2. CENTRAL DASHBOARD (Homepage)
  # ==========================================
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - HOMEPAGE_ALLOWED_HOSTS=*
    networks:
      - proxy-net
      - internal-net
    volumes:
      - homepage_config:/app/config
      - /var/run/docker.sock:/var/run/docker.sock:ro

  # ==========================================
  # 3. AUTHENTICATION / SSO (Authentik)
  # ==========================================
  authentik-db:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_DB=authentik
      - POSTGRES_USER=authentik
      - POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
    networks:
      - internal-net
    volumes:
      - authentik_db:/var/lib/postgresql/data

  authentik-redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - internal-net

  authentik-server:
    image: ghcr.io/goauthentik/server:2024.12.3
    restart: unless-stopped
    command: server
    environment:
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_POSTGRESQL__HOST=authentik-db
      - AUTHENTIK_POSTGRESQL__USER=authentik
      - AUTHENTIK_POSTGRESQL__NAME=authentik
      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-super_secret_key}
    networks:
      - proxy-net
      - internal-net
    volumes:
      - authentik_media:/media
      - authentik_certs:/certs
    depends_on:
      - authentik-db
      - authentik-redis

  authentik-worker:
    image: ghcr.io/goauthentik/server:2024.12.3
    restart: unless-stopped
    command: worker
    environment:
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_POSTGRESQL__HOST=authentik-db
      - AUTHENTIK_POSTGRESQL__USER=authentik
      - AUTHENTIK_POSTGRESQL__NAME=authentik
      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-super_secret_key}
    networks:
      - proxy-net
      - internal-net
    volumes:
      - authentik_media:/media
      - authentik_certs:/certs
    depends_on:
      - authentik-db
      - authentik-redis

  # ==========================================
  # 4. EMAIL ALIAS SERVICE (SimpleLogin)
  # ==========================================
  simplelogin-app:
    image: simplelogin/app:latest
    restart: unless-stopped
    environment:
      - DB_URI=postgresql://sl:${SL_DB_PASSWORD:-secure_password}@simplelogin-db:5432/sl
      - REDIS_URL=redis://simplelogin-redis:6379
      - URL=https://mail.techarmor.pl
      - EMAIL_DOMAIN=${DOMAIN:-techarmor.pl}
      - SUPPORT_EMAIL=gwolaniuk@gmail.com
      - FLASK_SECRET=${SL_FLASK_SECRET:-supersecretflaskkey}
      - COOKIE_SECURE=true
    networks:
      - proxy-net
      - internal-net
    depends_on:
      - simplelogin-db
      - simplelogin-redis

  simplelogin-db:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_DB=sl
      - POSTGRES_USER=sl
      - POSTGRES_PASSWORD=${SL_DB_PASSWORD:-secure_password}
    networks:
      - internal-net
    volumes:
      - simplelogin_postgres:/var/lib/postgresql/data

  simplelogin-redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - internal-net

  # ==========================================
  # 5. CLOUD PLATFORM & OFFICE (Nextcloud + Collabora)
  # ==========================================
  nextcloud:
    image: nextcloud:apache
    restart: unless-stopped
    environment:
      - POSTGRES_HOST=nextcloud-db
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-secure_db_password}
    networks:
      - proxy-net
      - internal-net
    volumes:
      - nextcloud_data:/var/www/html
    depends_on:
      - nextcloud-db

  nextcloud-db:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-secure_db_password}
    networks:
      - internal-net
    volumes:
      - nextcloud_db:/var/lib/postgresql/data

  collabora:
    image: collabora/code:latest
    restart: unless-stopped
    environment:
      - 'domain=cloud\.techarmor\.pl'
      - 'server_name=office.techarmor.pl'
      - 'extra_params=--o:ssl.enable=false --o:ssl.termination=true'
    networks:
      - proxy-net
      - internal-net
    cap_add:
      - MKNOD

  # ==========================================
  # 6. GIT & CI/CD (Forgejo)
  # ==========================================
  forgejo:
    image: codeberg.org/forgejo/forgejo:10
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
    networks:
      - proxy-net
      - internal-net
    volumes:
      - forgejo_data:/data
    ports:
      - "222:22" # SSH port mapping

  # ==========================================
  # 7. KNOWLEDGE BASE & WIKI (Docmost)
  # ==========================================
  docmost:
    image: docmost/docmost:latest
    restart: unless-stopped
    environment:
      - DATABASE_URL=postgresql://docmost:${DOCMOST_DB_PASSWORD:-secure_password}@docmost-db:5432/docmost?sslmode=disable
      - APP_URL=https://wiki.techarmor.pl
      - APP_SECRET=${DOCMOST_SECRET:-supersecretkey}
      - REDIS_URL=redis://docmost-redis:6379
    networks:
      - proxy-net
      - internal-net
    volumes:
      - docmost_data:/app/data
    depends_on:
      - docmost-db
      - docmost-redis

  docmost-db:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_DB=docmost
      - POSTGRES_USER=docmost
      - POSTGRES_PASSWORD=${DOCMOST_DB_PASSWORD:-secure_password}
    networks:
      - internal-net
    volumes:
      - docmost_db:/var/lib/postgresql/data

  docmost-redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - internal-net

  # ==========================================
  # 8. DOCUMENT ARCHIVING (Paperless-ngx)
  # ==========================================
  paperless-webserver:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    restart: unless-stopped
    environment:
      - PAPERLESS_REDIS=redis://paperless-redis:6379
      - PAPERLESS_DBHOST=paperless-db
      - PAPERLESS_DBNAME=paperless
      - PAPERLESS_DBUSER=paperless
      - PAPERLESS_DBPASS=${PAPERLESS_DB_PASSWORD:-secure_password}
      - PAPERLESS_SECRET_KEY=${PAPERLESS_SECRET:-supersecretkey}
      - PAPERLESS_URL=https://docs.techarmor.pl
    networks:
      - proxy-net
      - internal-net
    volumes:
      - paperless_data:/usr/src/paperless/data
      - paperless_media:/usr/src/paperless/media
    depends_on:
      - paperless-db
      - paperless-redis

  paperless-db:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_DB=paperless
      - POSTGRES_USER=paperless
      - POSTGRES_PASSWORD=${PAPERLESS_DB_PASSWORD:-secure_password}
    networks:
      - internal-net
    volumes:
      - paperless_db:/var/lib/postgresql/data

  paperless-redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - internal-net

  # ==========================================
  # 9. E-BOOK LIBRARY (Calibre-Web)
  # ==========================================
  calibre-web:
    image: lscr.io/linuxserver/calibre-web:latest
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - HOMEPAGE_ALLOWED_HOSTS=*
      - TZ=UTC
    networks:
      - proxy-net
      - internal-net
    volumes:
      - calibre_data:/config
      - /srv/company/books:/books

  # ==========================================
  # 11. HELP DESK (FreeScout)
  # ==========================================
  freescout:
    image: tiredofit/freescout:latest
    restart: unless-stopped
    environment:
      - DB_TYPE=mysql
      - DB_HOST=freescout-db
      - DB_NAME=freescout
      - DB_USER=freescout
      - DB_PASSWORD=${FREESCOUT_DB_PASSWORD:-secure_password}
      - SITE_URL=https://support.techarmor.pl
      - APP_ENV=production
    networks:
      - proxy-net
      - internal-net
    volumes:
      - freescout_data:/data
    depends_on:
      - freescout-db
      - freescout-redis

  freescout-db:
    image: mariadb:10.11
    restart: unless-stopped
    environment:
      - MYSQL_DATABASE=freescout
      - MYSQL_USER=freescout
      - MYSQL_PASSWORD=${FREESCOUT_DB_PASSWORD:-secure_password}
      - MYSQL_ROOT_PASSWORD=${FREESCOUT_ROOT_PASSWORD:-root_password}
    networks:
      - internal-net
    volumes:
      - freescout_db:/var/lib/mysql

  freescout-redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - internal-net