services:
  actual_server:
    image: docker.io/actualbudget/actual-server:latest
    networks:
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.actual.rule=Host(`finance.speerfam.net`)"
      - "traefik.http.routers.actual.entrypoints=websecure"
      - "traefik.http.routers.actual.tls.certresolver=myresolver"
      # Pulling the security rules dynamically from our file provider setup
      - "traefik.http.routers.actual.middlewares=geoblock-policy@file,crowdsec-policy@file,secure-headers@file"
      - "traefik.http.services.actual.loadbalancer.server.port=5006"
    ports:
      - '5006:5006'
#    environment:
      # Uncomment any of the lines below to set configuration options.
      # - ACTUAL_HTTPS_KEY=/data/selfhost.key
      # - ACTUAL_HTTPS_CERT=/data/selfhost.crt
      # - ACTUAL_PORT=5006
      # - ACTUAL_UPLOAD_FILE_SYNC_SIZE_LIMIT_MB=20
      # - ACTUAL_UPLOAD_SYNC_ENCRYPTED_FILE_SYNC_SIZE_LIMIT_MB=50
      # - ACTUAL_UPLOAD_FILE_SIZE_LIMIT_MB=20
      # See all options and more details at https://actualbudget.org/docs/config/
      # !! If you are not using any of these options, remove the 'environment:' tag entirely.
    volumes:
      - /srv/docker/actual-budget/data:/data
    healthcheck:
      # Enable health check for the instance
      test: ['CMD-SHELL', 'node scripts/health-check.js']
      # health check using self signed certs
      # test: ['CMD-SHELL', 'NODE_EXTRA_CA_CERTS=/data/selfhost.crt node scripts/health-check.js']
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 20s
    restart: unless-stopped
networks:
    traefik-public:
        external: true