version: "3.9"

networks:
  public:
    external: true

services:
  freshrss:
    image: freshrss/freshrss${IS_ARM}
    container_name: freshrss
    restart: always
    logging:
      options:
        max-size: 10m
    volumes:
      - "./freshrss-data:/var/www/FreshRSS/data"
      - "./freshrss-extensions-data:/var/www/FreshRSS/extensions"
    environment:
      TZ: Asia/Singapore
      CRON_MIN: '${CRON_MIN}'
      FRESHRSS_INSTALL: |-
        --api_enabled
        --default_user ${ADMIN_USERNAME}
        --language en
      FRESHRSS_USER: |-
        --api_password ${ADMIN_API_PASSWORD}
        --email ${ADMIN_EMAIL}
        --language en
        --password ${ADMIN_PASSWORD}
        --user ${ADMIN_USERNAME}
    # ports:
    #   - "80:80"
    networks:
      - public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.freshrss.rule=Host(`${FRESHRSS_DOMAIN}`)"
      - "traefik.http.routers.freshrss.service=freshrss-service"
      - "traefik.http.services.freshrss-service.loadbalancer.server.port=80"
      - "traefik.http.routers.freshrss.tls=true"
      - "traefik.http.routers.freshrss.tls.certresolver=le"
      - traefik.http.middlewares.freshrssM1.compress=true
      - traefik.http.middlewares.freshrssM2.headers.browserXssFilter=true
      - traefik.http.middlewares.freshrssM2.headers.forceSTSHeader=true
      - traefik.http.middlewares.freshrssM2.headers.frameDeny=true
      - traefik.http.middlewares.freshrssM2.headers.referrerPolicy=no-referrer-when-downgrade
      - traefik.http.middlewares.freshrssM2.headers.stsSeconds=31536000
      - traefik.http.routers.freshrss.middlewares=freshrssM1,freshrssM2