compose.yaml

networks:
  reverse-proxy:
    name: reverse-proxy
    driver: bridge

  database:
    driver: bridge

configs:
  reverse-proxy:
    content: |
      global:
        sendAnonymousUsage: false
        checkNewVersion: false

      log:
        level: WARN

      providers:
        docker:
          network: reverse-proxy
          exposedByDefault: false
          watch: true

        file:
          filename: /etc/traefik/dynamic.yaml
          watch: true

      api:
        dashboard: false

      ping: {}

      x-encoded-characters: &encoded-characters
        encodedCharacters:
          allowEncodedSlash: true
          allowEncodedSemicolon: true
          allowEncodedPercent: true
          allowEncodedQuestionMark: true

      x-http: &http
        http:
          middlewares:
            - compress@file
          <<: *encoded-characters

      entryPoints:
        http:
          address: :80/tcp
          asDefault: true
          forwardedHeaders:
            trustedIPs:
              - "127.0.0.1/32"
              - "172.16.0.0/12"
          <<: *http

  reverse-proxy-dynamic:
    content: |
      http:
        middlewares:
          compress:
            compress: {}

        routers:
          unknown:
            rule: HostRegexp(`.+`) && !Host(`x.y`)
            service: noop@internal
            priority: -9999

services:
  reverse-proxy:
    restart: unless-stopped
    image: ${REVERSE_PROXY_IMAGE}
    healthcheck:
      test: traefik healthcheck
      interval: 10s
      timeout: 10s
      retries: 10
    configs:
      - source: reverse-proxy
        target: /etc/traefik/traefik.yaml
      - source: reverse-proxy-dynamic
        target: /etc/traefik/dynamic.yaml
    command: >
      --configFile /etc/traefik/traefik.yaml
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "${REVERSE_PROXY_PORT}:80/tcp"
    networks:
      - reverse-proxy

  p-stream:
    restart: unless-stopped
    image: ${FRONTEND_IMAGE}
    healthcheck:
      test: curl -f http://localhost:80
      interval: 10s
      timeout: 10s
      retries: 10
    environment:
      APP_DOMAIN: http://localhost:80
      OPENSEARCH_ENABLED: false
      NORMAL_ROUTER: true
      HAS_ONBOARDING: false
      HIDE_PROXY_ONBOARDING: true
      ALLOW_AUTOPLAY: false
      DISABLE_INTRODB: true
      BACKEND_URL: ${REVERSE_PROXY_HOST_SCHEME}://${REVERSE_PROXY_HOST}:${REVERSE_PROXY_PORT}${BACKEND_PATH}
      AIO_PROXY_URL: ${REVERSE_PROXY_HOST_SCHEME}://${REVERSE_PROXY_HOST}:${REVERSE_PROXY_PORT}${AIO_PROXY_PATH}
      TMDB_READ_API_KEY: ${SECRET_FRONTEND_TMDB_READ_ACCESS_TOKEN}
    labels:
      traefik.enable: true
      traefik.http.middlewares.frontend.errors.status: 404
      traefik.http.middlewares.frontend.errors.service: frontend
      traefik.http.middlewares.frontend.errors.query: /
      traefik.http.routers.frontend.rule: Host(`${REVERSE_PROXY_HOST}`) && PathPrefix(`${FRONTEND_PATH}`)
      traefik.http.routers.frontend.service: frontend
      traefik.http.routers.frontend.entrypoints: http
      traefik.http.routers.frontend.middlewares: frontend@docker
      traefik.http.routers.frontend.priority: 1
      traefik.http.services.frontend.loadbalancer.server.port: 80
    networks:
      - reverse-proxy
    depends_on:
      reverse-proxy:
        condition: service_healthy
      p-stream-backend:
        condition: service_healthy
      aio-proxy:
        condition: service_healthy

  p-stream-backend:
    restart: unless-stopped
    image: ${BACKEND_IMAGE}
    healthcheck:
      test: curl -f http://localhost:3000
      interval: 10s
      timeout: 10s
      retries: 10
    environment:
      DATABASE_URL: "postgresql://${BACKEND_DATABASE_USER}:${SECRET_BACKEND_DATABASE_PASSWORD}@p-stream-backend-database:5432/${BACKEND_DATABASE_NAME}"
      META_NAME: Backend
      CAPTCHA: false
      CRYPTO_SECRET: "${SECRET_BACKEND_CRYPTO_SECRET}"
      TMDB_API_KEY: ${SECRET_BACKEND_TMDB_API_KEY}
    labels:
      traefik.enable: true
      traefik.http.middlewares.backend.stripprefix.prefixes: ${BACKEND_PATH}
      traefik.http.routers.backend.rule: Host(`${REVERSE_PROXY_HOST}`) && PathPrefix(`${BACKEND_PATH}`)
      traefik.http.routers.backend.service: backend
      traefik.http.routers.backend.entrypoints: http
      traefik.http.routers.backend.middlewares: backend@docker
      traefik.http.routers.backend.priority: 2
      traefik.http.services.backend.loadbalancer.server.port: 3000
    networks:
      - reverse-proxy
      - database
    depends_on:
      reverse-proxy:
        condition: service_healthy
      p-stream-backend-database:
        condition: service_healthy

  p-stream-backend-database:
    image: ${DATABASE_IMAGE}
    restart: unless-stopped
    healthcheck:
      test: pg_isready -d ${BACKEND_DATABASE_NAME} -U ${BACKEND_DATABASE_USER}
      interval: 10s
      timeout: 10s
      retries: 10
    networks:
      - database
    volumes:
      - ./data/backend/database:/var/lib/postgresql
    environment:
      PGDATA: /var/lib/postgresql/data
      POSTGRES_DB: ${BACKEND_DATABASE_NAME}
      POSTGRES_USER: ${BACKEND_DATABASE_USER}
      POSTGRES_PASSWORD: "${SECRET_BACKEND_DATABASE_PASSWORD}"

  aio-proxy:
    restart: unless-stopped
    image: ${AIO_PROXY_IMAGE}
    healthcheck:
      test: curl -f http://localhost:80
      interval: 10s
      timeout: 10s
      retries: 10
    environment:
      PORT: 80
      BASE_URL: ${REVERSE_PROXY_HOST_SCHEME}://${REVERSE_PROXY_HOST}:${REVERSE_PROXY_PORT}${AIO_PROXY_PATH}
      CORS_ORIGINS: ${REVERSE_PROXY_HOST_SCHEME}://${REVERSE_PROXY_HOST}:${REVERSE_PROXY_PORT}
      LOG_LEVEL: warn
      TRUSTED_PROXIES: 127.0.0.1/32,172.16.0.0/12
      MAX_BANDWIDTH_PER_IP: 20M
      MAX_STREAMS_PER_IP: 4
      MAX_TRANSCODE_PER_IP: 4
      API_RATE_LIMIT: 240
      HTTP_TIMEOUT: 30
      MAX_REQUEST_BODY_SIZE: 5M
      ENABLE_YTDLP: false
      HW_ACCEL: off
    labels:
      traefik.enable: true
      traefik.http.middlewares.aio-proxy.stripprefix.prefixes: ${AIO_PROXY_PATH}
      traefik.http.routers.aio-proxy.rule: Host(`${REVERSE_PROXY_HOST}`) && PathPrefix(`${AIO_PROXY_PATH}`)
      traefik.http.routers.aio-proxy.service: aio-proxy
      traefik.http.routers.aio-proxy.entrypoints: http
      traefik.http.routers.aio-proxy.middlewares: aio-proxy@docker
      traefik.http.routers.aio-proxy.priority: 2
      traefik.http.services.aio-proxy.loadbalancer.server.port: 80
    networks:
      - reverse-proxy
    depends_on:
      reverse-proxy:
        condition: service_healthy