services:
  redlib:
    image: quay.io/redlib/redlib:latest
    container_name: redlib
    restart: unless-stopped
    expose:
      - 8080
    user: nobody
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    env_file: 
     - .env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.redlib.rule=Host(`${REDLIB_HOSTNAME?}`)"
      - "traefik.http.routers.redlib.entrypoints=websecure"
      - "traefik.http.routers.redlib.tls.certresolver=letsencrypt"
      - "traefik.http.routers.redlib.middlewares=authelia@docker"
      - "traefik.http.services.redlib.loadbalancer.server.port=8080"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
      interval: 15s
      timeout: 3s
    profiles:
      - redlib
      - all