services:
  mysql:
    image: mysql:9.4
    volumes:
      - ${MYSQL_DATA_DIR:-db_data}:/var/lib/mysql
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=leantime
      - MYSQL_USER=lean
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    command: --character-set-server=UTF8MB4 --collation-server=UTF8MB4_unicode_ci
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 30s
      timeout: 10s
      retries: 3

  leantime:
    image: leantime/leantime:3.5.12
    restart: unless-stopped
    # security_opt:
      # - no-new-privileges:true
    # cap_add:
      # - CAP_NET_BIND_SERVICE
      # - CAP_CHOWN
      # - CAP_SETGID
      # - CAP_SETUID
    environment:
      - LEAN_DB_HOST=mysql
      - LEAN_DB_DATABASE=leantime  
      - LEAN_DB_USER=lean 
      - LEAN_DB_PASSWORD=${MYSQL_PASSWORD}
      - LEAN_SESSION_PASSWORD=${LEAN_SESSION_PASSWORD}
      - LEAN_DEBUG=0
      - LEAN_LANGUAGE=fr-FR
      - LEAN_DEFAULT_TIMEZONE=Europe/Paris
      - LEAN_DISABLE_LOGIN_FORM=true
      - LEAN_OIDC_ENABLE=true
      - LEAN_OIDC_PROVIDER_URL=${LEAN_OIDC_PROVIDER_URL}
      - LEAN_OIDC_CLIENT_ID=${LEAN_OIDC_CLIENT_ID}
      - LEAN_OIDC_CLIENT_SECRET=${LEAN_OIDC_CLIENT_SECRET}
      - LEAN_OIDC_CREATE_USER=false
      - LEAN_OIDC_DEFAULT_ROLE=20
    volumes:
      - ${LEAN_PUBLIC_USERFILES_DIR:-public_userfiles}:/var/www/html/public/userfiles     # Volume to store public files, logo etc
      - ${LEAN_USERFILES_DIR:-userfiles}:/var/www/html/userfiles                          # Original volume name for compatibility
      - ${LEAN_PLUGINS_DIR:-plugins}:/var/www/html/app/Plugins                            # Plugin storage
      - ${LEAN_LOGS_DIR:-logs}:/var/www/html/storage/logs                                 # Log storage
    depends_on:
      mysql:
        condition: service_healthy
    labels:
      - traefik.enable=true
      - traefik.http.routers.leantime.entryPoints=https
      - traefik.http.routers.leantime.rule=Host(`${HOST}`)
      - traefik.http.routers.leantime.tls.certresolver=le-ssl
      - traefik.http.services.leantime.loadbalancer.server.port=8080
      - traefik.docker.network=front
    networks:
      - default
      - front

  # Add a helper container for volume permissions
  # Run via docker compose --profile mysql_helper up -d
  mysql_helper:
    image: mysql:9.4
    command: chown -R mysql:mysql /var/lib/mysql
    volumes:
      - ${MYSQL_DATA_DIR:-db_data}:/var/lib/mysql
    user: root
    profiles: [ "helper" ]

volumes:
  db_data:
  userfiles:
  public_userfiles:
  plugins:
  logs:

networks:
  front:
    external: true