services:
    reverse_proxy:
        image: caddy:latest
        container_name: reverse_proxy
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - ./service_data/reverse_proxy:/etc/caddy
            - caddy-data:/data
        environment:
            - CADDY_TLS=${CADDY_TLS}
            - DOMAIN_NAME=${DOMAIN_NAME}
            - MAIL_SUBDOMAIN=${MAIL_SUBDOMAIN}
            - WEBMAIL_SUBDOMAIN=${WEBMAIL_SUBDOMAIN}
        networks:
            - proxy-net

    email_backend:
        image: stalwartlabs/stalwart:latest
        container_name: email_backend
        restart: unless-stopped
        volumes:
            - stalwart-etc:/etc/stalwart
            - stalwart-data:/var/lib/stalwart
        environment:
            - STALWART_PUBLIC_URL=https://${MAIL_SUBDOMAIN}.${DOMAIN_NAME}
        ports:
            - "25:25"
            - "587:587"
            - "465:465"
            - "143:143"
            - "993:993"
            - "110:110"
            - "995:995"
            - "4190:4190"
        networks:
            - proxy-net

    email_frontend:
        image: ghcr.io/bulwarkmail/webmail:latest
        container_name: email_frontend
        restart: unless-stopped
        environment:
            - JMAP_SERVER_URL=https://${MAIL_SUBDOMAIN}.${DOMAIN_NAME}
            - NODE_TLS_REJECT_UNAUTHORIZED=0 # DEFINITELY REMOVE AFTER TESTING
            - OAUTH_ALLOW_PRIVATE_ENDPOINTS=true # ALSO DEFINITELY REMOVE THIS
            - SESSION_SECRET=${BULWARK_SECRET}
            - OAUTH_ENABLED=true
            - OAUTH_ONLY=true
            - OAUTH_CLIENT_ID=bulwark-webmail
            - OAUTH_CLIENT_SECRET=${OAUTH_SECRET}
            - AUTO_SSO_ENABLED=true
        volumes:
            - bulwark-config:/app/data/admin
            - bulwark-state:/app/data/admin-state
        networks:
            - proxy-net

volumes:
    stalwart-etc:
    stalwart-data:
    caddy-data:
    bulwark-config:
    bulwark-state:

networks:
    proxy-net:
        external: true