services:
  ntfy:
    container_name: ntfy
    networks:
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ntfy.rule=Host(`ntfy.speerfam.net`)"
      - "traefik.http.routers.ntfy.entrypoints=websecure"
      - "traefik.http.routers.ntfy.tls.certresolver=myresolver"
      
      # Pulling the security rules dynamically from our file provider setup
      - "traefik.http.routers.ntfy.middlewares=geoblock-policy@file,crowdsec-policy@file,secure-headers@file"
      - "traefik.http.services.ntfy.loadbalancer.server.port=80"
    image: binwiederhier/ntfy
    restart: always
    environment:
      NTFY_BASE_URL: https://ntfy.speerfam.net
      NTFY_CACHE_FILE: /var/lib/ntfy/cache.db
      NTFY_AUTH_FILE: /var/lib/ntfy/auth.db
      NTFY_AUTH_DEFAULT_ACCESS: deny-all
      NTFY_BEHIND_PROXY: true
      NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
      NTFY_ENABLE_LOGIN: true
      NTFY_UPSTREAM_BASE_URL: https://ntfy.sh
      NTFY_WEB_PUSH_FILE: /var/lib/ntfy/webpush.db
      NTFY_WEB_PUSH_EMAIL_ADDRESS: <email>
      TZ: America/Chicago
      PID: 1000
      GID: 1000
    volumes:
      - /home/mattspeer/docker/ntfy:/var/lib/ntfy
      - /home/mattspeer/docker/ntfy/cache:/var/cache/ntfy
      - /home/mattspeer/docker/ntfy/config:/etc/ntfy
    ports:
      - 8085:80
    command: serve

networks:
  traefik-public:
    external: true