version: "3"
services:
  watchtower:
    image: containrrr/watchtower
    restart: always
    command: --label-enable
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
  nginx:
    image: nginx:bookworm
    restart: always
    volumes:
      - ./nginx_templates:/etc/nginx/templates:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - /var/www/.well-known/acme-challenge:/var/www/.well-known/acme-challenge:ro
      - /var/www/html:/var/www/html:ro
      - /etc/ssl/certs:/etc/ssl/certs:ro
      - /usr/local/share/ca-certificates:/usr/local/share/ca-certificates:ro
      - /var/discourse/shared/standalone/:/forum
    ports:
      - "80:80"
      - "443:443"
    environment:
      - BASE_DOMAIN_NAME=${BASE_DOMAIN_NAME}
      - ALT_BASE_DOMAIN_NAME=${ALT_BASE_DOMAIN_NAME}
      - NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx
      - NGINX_ENVSUBST_FILTER=^(BASE_DOMAIN_NAME|ALT_BASE_DOMAIN_NAME)$$
    links:
      - forgejo
      - mail
    networks:
      - net_with_ipv6
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
  forgejo:
    image: codeberg.org/forgejo/forgejo:7
    restart: always
    environment:
      - USER_UID=1000
      - USER_GID=1000
    volumes:
      - /var/lib/forgejo/:/data/git
      - /var/lib/forgejo-data/:/data/
      - /etc/forgejo/:/data/gitea/conf
      - /var/www/html:/var/www/html
      - /etc/ssl/certs:/etc/ssl/certs:ro
      - /usr/local/share/ca-certificates:/usr/local/share/ca-certificates:ro
    expose:
      - '3000'
    ports:
      - "127.0.0.1:2222:22"
    links:
      - mail:mail.${BASE_DOMAIN_NAME}
    networks:
      - net_with_ipv6
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
  mail:
    image: stalwartlabs/mail-server:v0.8.5
    # build:
    #   context: https://github.com/programmerjake/mail-server.git#fix-567
    restart: always
    expose:
      - '80'
    ports:
      - '25:25'
      - '465:465'
      - '587:587'
      - '993:993'
      - '995:995'
    volumes:
      - /var/lib/stalwart-mail:/opt/stalwart-mail
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - /etc/ssl/certs:/etc/ssl/certs:ro
      - /usr/local/share/ca-certificates:/usr/local/share/ca-certificates:ro
    networks:
      - net_with_ipv6
    # labels:
    #   - "com.centurylinklabs.watchtower.enable=true"

networks:
  net_with_ipv6:
    attachable: true
    enable_ipv6: true