version: "3.9"

networks:
  proxy:
    external: true
  net:
    external: false

secrets:
  jwt:
    file: ./secrets/authelia_jwt
  duo:
    file: ./secrets/authelia_duo
  session:
    file: ./secrets/authelia_session
  storage:
    file: ./secrets/authelia_storage
  smtp:
    file: ./secrets/authelia_smtp

services:
  authelia:
    image: authelia/authelia:latest
    container_name: authelia
    restart: always
    secrets:
      - jwt
      - duo
      - session
      - storage
      - smtp
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
      - AUTHELIA_JWT_SECRET_FILE=/run/secrets/jwt
      - AUTHELIA_DUO_API_SECRET_KEY_FILE=/run/secrets/duo
      - AUTHELIA_SESSION_SECRET_FILE=/run/secrets/session
      - AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE=/run/secrets/smtp
      - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/run/secrets/storage
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./authelia:/config
    expose:
      - 9091
    networks:
      - net
    healthcheck:
      disable: true

  swag:
    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    restart: always
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
      - URL=fhoss.de
      - VALIDATION=dns
      - SUBDOMAINS=wildcard
      - DNSPLUGIN=hetzner
      - ONLY_SUBDOMAINS=true
    volumes:
      - ./swag:/config
    ports:
      - "443:443"
      - "80:80"
    networks:
      - net
      - proxy