services:
  pds:
    image: ghcr.io/bluesky-social/pds:latest
    container_name: pds
    restart: unless-stopped
    env_file:
      - pds.env
    volumes:
      - pds_data:/var/lib/pds
      - pds_blocks:/var/lib/pds/blocks
    networks:
      - traefik_traffic
    labels:
      - "traefik.enable=true"

      # This mess is required *only* if you are doing other stuff with the domain
      - "traefik.http.routers.pds.rule=(Host(`example.com`) || HostRegexp(`^.+\\.example\\.com$`)) && (PathPrefix(`/xrpc`) || PathPrefix(`/.well-known/atproto-did`))"

      - "traefik.http.routers.pds.entrypoints=websecure"
      - "traefik.http.routers.pds.tls=true"
      - "traefik.http.routers.pds.tls.certresolver=letsencrypt"
      - "traefik.http.routers.pds.service=pds-service"

      - "traefik.http.services.pds-service.loadbalancer.server.port=3000"
      - "traefik.http.services.pds-service.loadbalancer.healthcheck.path=/xrpc/_health"

volumes:
  pds_data:
  pds_blocks:

networks:
  traefik_traffic:
    external: true