# Copy to compose.override.yml on the host that runs traefik.
services:
  workspace:
    # Traefik only routes HTTP; SFTP (raw TCP) can't go through it, so its
    # port is published straight to the host instead. Restrict to your IP,
    # or leave it 127.0.0.1 and reach it over a VPN/SSH tunnel.
    # Requires WORKSPACE_SFTP_BIND=0.0.0.0:2222 in .env to actually listen.
    ports: !override
      - "127.0.0.1:2222:2222"
    networks:
      - narl
      - internal_net
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=narl"
      - "traefik.http.routers.workspace.rule=Host(`workspace.narl.io`)"
      - "traefik.http.routers.workspace.entrypoints=websecure"
      - "traefik.http.routers.workspace.tls.certresolver=https_resolver"
      - "traefik.http.services.workspace.loadbalancer.server.port=4242"

  # Mail, locally. Mailpit accepts everything on 1025 and shows it on 8025, so
  # the reminders can be read before a real relay is ever involved:
  #
  #     WORKSPACE_SMTP_URL=smtp://mailpit:1025
  #     WORKSPACE_MAIL_TO=you@example.org
  #
  # Nothing it receives leaves the host, which is the point of testing here.
  mailpit:
    image: axllent/mailpit:latest
    restart: unless-stopped
    networks:
      - internal_net
    ports:
      - "127.0.0.1:8025:8025"

networks:
  narl:
    external: true