version: "3.8"

services:
  rongorongo:
    image: registry.hobbs.farm/rongorongo:latest
    networks:
      - traefik-public
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 3
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"

        # HTTP → HTTPS redirect
        - "traefik.http.routers.rongorongo-http.rule=Host(`rongorongo.hobbs.farm`)"
        - "traefik.http.routers.rongorongo-http.entrypoints=web"
        - "traefik.http.routers.rongorongo-http.middlewares=redirect-to-https"

        # HTTPS router
        - "traefik.http.routers.rongorongo.rule=Host(`rongorongo.hobbs.farm`)"
        - "traefik.http.routers.rongorongo.entrypoints=websecure"
        - "traefik.http.routers.rongorongo.tls=true"
        - "traefik.http.routers.rongorongo.tls.certresolver=cloudflare"

        # Service
        - "traefik.http.services.rongorongo.loadbalancer.server.port=80"

        # Middlewares
        - "traefik.http.routers.rongorongo.middlewares=rongorongo-headers"
        - "traefik.http.middlewares.rongorongo-headers.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

networks:
  traefik-public:
    external: true