name: infisical

services:
  backend:
    image: infisical/infisical:latest
    container_name: infisical-backend
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    env_file: .env
    environment:
      - NODE_ENV=production
    networks:
      - traefik_proxy
      - infisical
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.http.routers.infisical.rule=Host(`secrets.kzbrd.ru`)"
      - "traefik.http.routers.infisical.entrypoints=websecure"
      - "traefik.http.routers.infisical.tls=true"
      - "traefik.http.routers.infisical.tls.certresolver=myresolver"
      - "traefik.http.routers.infisical.middlewares=local-ip-whitelist"
      - "traefik.http.services.infisical.loadbalancer.server.port=8080"
      # IP whitelist middleware — same Docker provider as router (no @file needed)
      - "traefik.http.middlewares.local-ip-whitelist.ipwhitelist.sourcerange=192.168.1.0/24, 127.0.0.1/32, 172.19.0.0/16"

  redis:
    image: redis:7-alpine
    container_name: infisical-dev-redis
    env_file: .env
    restart: always
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
    networks:
      - infisical
    volumes:
      - redis_data:/data

  db:
    image: postgres:14-alpine
    container_name: infisical-db
    restart: always
    env_file: .env
    volumes:
      - pg_data:/var/lib/postgresql/data
    networks:
      - infisical
    healthcheck:
      test: "pg_isready --username=infisical && psql --username=infisical --list"
      interval: 5s
      timeout: 10s
      retries: 10

volumes:
  pg_data:
    driver: local
  redis_data:
    driver: local

networks:
  traefik_proxy:
    external: true
  infisical:
    driver: bridge