services:
  insanitylab:
    build: .
    image: insanitylab-website:latest
    container_name: insanitylab
    restart: always
    env_file:
      - .env
    environment:
      - HOST=0.0.0.0
      - PORT=4321
      - DB_PATH=/app/data/insanitylab.db
      - UPLOADS_DIR=/app/uploads
    volumes:
      - /opt/docker/insanitylab/data:/app/data
      - /opt/docker/insanitylab/uploads:/app/uploads
    labels:
      - traefik.enable=true
      # Router principale: apex ufficiale + vecchio sottodominio (servono entrambi durante
      # la transizione DNS, così non c'è downtime finché insanitylab.it non è propagato).
      - traefik.http.routers.insanitylab.rule=Host(`insanitylab.it`) || Host(`insanitylab.tielogic.xyz`)
      - traefik.http.routers.insanitylab.tls=true
      - traefik.http.routers.insanitylab.entrypoints=websecure
      - traefik.http.routers.insanitylab.tls.certresolver=mytlschallenge
      - traefik.http.services.insanitylab.loadbalancer.server.port=4321
      # Router redirect: www.insanitylab.it → 301 apex (canonico senza www)
      - traefik.http.routers.insanitylab-redir.rule=Host(`www.insanitylab.it`)
      - traefik.http.routers.insanitylab-redir.tls=true
      - traefik.http.routers.insanitylab-redir.entrypoints=websecure
      - traefik.http.routers.insanitylab-redir.tls.certresolver=mytlschallenge
      - traefik.http.routers.insanitylab-redir.service=insanitylab
      - traefik.http.routers.insanitylab-redir.middlewares=insanitylab-tocanon
      - traefik.http.middlewares.insanitylab-tocanon.redirectregex.regex=^https?://[^/]+/(.*)
      - traefik.http.middlewares.insanitylab-tocanon.redirectregex.replacement=https://insanitylab.it/$${1}
      - traefik.http.middlewares.insanitylab-tocanon.redirectregex.permanent=true
    networks:
      - traefik

networks:
  traefik:
    external: true