services:
  navidrome:
    image: deluan/navidrome:latest
    container_name: navidrome
    networks:
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nd.rule=Host(`music.speerfam.net`)"
      - "traefik.http.routers.nd.entrypoints=websecure"
      - "traefik.http.routers.nd.tls.certresolver=myresolver"
      # Pulling the security rules dynamically from our file provider setup
      - "traefik.http.routers.nd.middlewares=geoblock-policy@file,crowdsec-policy@file,secure-headers@file"
      - "traefik.http.services.nd.loadbalancer.server.port=4533"
#    user: 1000:1000 # should be owner of volumes
    ports:
      - "4533:4533"
    restart: unless-stopped
    environment:
      ND_SCANSCHEDULE: "@every 1h"
      ND_ENABLEDOWNLOADS: "true"
      ND_ENABLELOGREDACTING: "true"
      ND_TRANSCODINGCACHESIZE: "1GB"
      # ND_LOGLEVEL: debug
    volumes:
      - "/srv/docker/nd/data:/data"
      - "/srv/music:/music:ro"

networks:
  traefik-public:
    external: true