services:
  seaweedfs:
    image: chrislusf/seaweedfs:latest
    container_name: seaweedfs
    expose:
      - 9333 
      - 8333 # S3 API endpoint stays open for Next.js/Go apps
    volumes:
      - seaweedfs_data:/data
      # Mount your credentials file directly into the container
      - ./s3.json:/data/s3.json
    # -s3.config points to our mounted credentials file
    command: "server -dir=/data -s3 -s3.config=/data/s3.json"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9333/cluster/status"]
      interval: 5s
      timeout: 5s
      retries: 5
    labels:
      - "traefik.enable=true"
      
      # 1. Routing Rule: Listen for your Public IP (e.g., 123.45.67.89)
      # If you don't have a static IP, you can use a catch-all rule: "PathPrefix(`/`)"
      - "traefik.http.routers.filer.rule=Host(`fs.marcopedone.it`)"
      - "traefik.http.routers.filer.entrypoints=websecure"
      - "traefik.http.routers.filer.service=filer"
      - "traefik.http.routers.filer.tls.certresolver=letsencrypt"
      
      # 2. Assign the Service Port (SeaweedFS filer runs internally on 8888)
      - "traefik.http.services.filer.loadbalancer.server.port=8888"
      
      # 3. Attach the Auth Middleware to this Router
      - "traefik.http.routers.filer.middlewares=filer-auth"
      
      # 4. Define the Middleware (Paste your generated hashed string here)
      - "traefik.http.middlewares.filer-auth.basicauth.users=admin:$$2a$$12$$2w9VLBATy0eHhU4IAIg8t.bz9/ZSzS9yf5uv4Hn1nUhp28ZY7An8y"

volumes:
  seaweedfs_data: