services:

  sqldb:
    image: mysql:8.3
    networks:
      - kimai
    volumes:
      - /srv/docker/kimai/mysql:/var/lib/mysql
    environment:
      - MYSQL_DATABASE=kimai
      - MYSQL_USER=kimaiuser
      - MYSQL_PASSWORD=Tremor-Tarot-Badland2
      - MYSQL_ROOT_PASSWORD=Motivator-Pumice-Pancake3
    command: --default-storage-engine innodb
    restart: unless-stopped
    healthcheck:
      test: mysqladmin -uroot -p$$MYSQL_ROOT_PASSWORD ping -h 127.0.0.1 --silent
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s

  kimai:
    image: kimai/kimai2:stable
    networks:
      - traefik-public
      - kimai
    labels:
      - "traefik.docker.network=traefik-public"
      - "traefik.enable=true"
      - "traefik.http.routers.kimai.rule=Host(`time.speerfam.net`)"
      - "traefik.http.routers.kimai.entrypoints=websecure"
      - "traefik.http.routers.kimai.tls.certresolver=myresolver"
      
      # Pulling the security rules dynamically from our file provider setup
      - "traefik.http.routers.kimai.middlewares=geoblock-policy@file,crowdsec-policy@file,secure-headers@file"
      - "traefik.http.services.kimai.loadbalancer.server.port=8001"
    depends_on:
      sqldb:
        condition: service_healthy
        restart: true
    volumes:
      - /srv/docker/kimai/data:/opt/kimai/var/data
      - /srv/docker/kimai/plugins:/opt/kimai/var/plugins
    ports:
      - 8002:8001
    environment:
      - APP_SECRET= MOpjyc5UWVYowgjWR7FhStVc5NCz2D7H
      - TRUSTED_HOSTS=time.speerfam.net,localhost,127.0.0.1 # set this to the domain name you use to access Kimai
      - TRUSTED_PROXIES=traefik # Adjust based on your Docker network or simply use "127.0.0.1,REMOTE_ADDR" / proxy IPs
      - ADMINMAIL=mwspeer@gmail.com
      - ADMINPASS=Grumbling-Evacuate-Brethren5
      - "DATABASE_URL=mysql://kimaiuser:Tremor-Tarot-Badland2@sqldb/kimai?charset=utf8mb4&serverVersion=8.3.0"
    restart: unless-stopped

volumes:
  data:
  mysql:
  plugins:

networks:
  traefik-public:
    external: true
  kimai:
    external: false