---
version: "3.8"

x-configs:
  &default-configs
  - source: config_json
    target: /web/config.json
  - source: alertad_conf
    target: /app/alertad.conf
  - source: alerta_conf
    target: /app/alerta.conf
  - source: email_tmpl
    target: /app/email.tmpl

x-secrets:
  &default-secrets
  - cli_api_key
  - db_root_password
  - mailer_api_key
  - oauth_client_secret
  - rocket_chat_webhook_url
  - secret_key
  - smtp_password

x-environment:
  &default-env
  - ADMIN_USERS=${ADMIN_USERS}
  - DEBUG=${DEBUG}
  - DOMAIN=${DOMAIN}
  - KEYCLOAK_REALM=${KEYCLOAK_REALM}
  - KEYCLOAK_ROLE=${KEYCLOAK_ROLE}
  - KEYCLOAK_URL=${KEYCLOAK_URL}
  - MAIL_FROM=${MAIL_FROM}
  - MAIL_TO=${MAIL_TO}
  - MONGODB_ADDR="db:27017"
  - MONGODB_NAME=alerta
  - MONGODB_TYPE=mongodb
  - MONGODB_USER=alerta
  - OAUTH2_CLIENT_ID=${OAUTH2_CLIENT_ID}
  - ROCKET_CHAT_ALERTA_USERNAME=${ROCKET_CHAT_ALERTA_USERNAME}
  - ROCKET_CHAT_CHANNEL=${ROCKET_CHAT_CHANNEL}
  - ROCKET_CHAT_ICON_EMOJI=${ROCKET_CHAT_ICON_EMOJI}
  - SMTP_HOST=${SMTP_HOST}
  - SMTP_PORT=${SMTP_PORT}
  - SMTP_STARTTLS=${SMTP_STARTTLS}
  - SMTP_USERNAME=${SMTP_USERNAME}

services:
  api:
    image: "decentral1se/alerta:8.3.3"
    configs: *default-configs
    environment: *default-env
    secrets: *default-secrets
    deploy:
      update_config:
        failure_action: rollback
        order: start-first
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.gitea.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.gitea.entrypoints=web-secure"
        - "traefik.http.services.gitea.loadbalancer.server.port=8080"
        - "traefik.http.routers.gitea.tls.certresolver=${LETS_ENCRYPT_ENV}"
    networks:
      - proxy
      - internal

  api:
    image: "decentral1se/alerta:8.3.3"
    command: alerta-mailer
    configs: *default-configs
    environment: *default-env
    secrets: *default-secrets
    networks:
      - internal

  db:
    image: "mongo:bionic"
    secrets:
      - db_root_password
    volumes:
      - "db:/data/db"
    environment:
      - MONGO_INITDB_ROOT_USERNAME=alerta
      - MONGO_INITDB_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
    networks:
      - internal

networks:
  internal:
  proxy:
    external: true

volumes:
  db:

configs:
  config_json:
    name: ${STACK_NAME}_config_json_${CONFIG_JSON_VERSION}
    file: config.json
  alertad_conf:
    name: ${STACK_NAME}_alertad_conf_${ALERTAD_CONF_VERSION}
    file: alertad.conf.tmpl
    template_driver: golang
  alerta_conf:
    name: ${STACK_NAME}_alerta_conf_${ALERTA_CONF_VERSION}
    file: alerta.conf.tmpl
    template_driver: golang
  email_tmpl:
    name: ${STACK_NAME}_email_tmpl_${EMAIL_TMPL_VERSION}
    file: email.tmpl
    template_driver: golang

secrets:
  db_root_password:
    name: ${STACK_NAME}_db_root_password_${SECRET_DB_ROOT_PASSWORD_VERSION}
    external: true
  cli_api_key:
    name: ${STACK_NAME}_cli_api_key_${SECRET_CLI_API_KEY_VERSION}
    external: true
  mailer_api_key:
    name: ${STACK_NAME}_mailer_api_key_${SECRET_MAILER_API_KEY_VERSION}
    external: true
  smtp_password:
    name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}
    external: true
  secret_key:
    name: ${STACK_NAME}_secret_key_${SECRET_SECRET_KEY_VERSION}
    external: true
  oauth_client_secret:
    name: ${STACK_NAME}_oauth_client_secret_${SECRET_OAUTH_CLIENT_SECRET_VERSION}
    external: true
  rocket_chat_webhook_url:
    name: ${STACK_NAME}_rocket_chat_webhook_url_${SECRET_ROCKET_CHAT_WEBHOOK_URL}
    external: true