services:
  mealie:
    image: ghcr.io/mealie-recipes/mealie:v3.12.0
    container_name: mealie
    restart: unless-stopped

    environment:
      TZ: Europe/Berlin
      ALLOW_SIGNUP: "false"
      PUID: "99"
      PGID: "100"

      DB_ENGINE: postgres
      POSTGRES_SERVER: mealie-postgres
      POSTGRES_DB: mealie
      POSTGRES_USER: mealie
      POSTGRES_PASSWORD: ${MEALIE_DB_PASSWORD}

      BASE_URL: https://mealie.kaleschke.info

    volumes:
      - /mnt/user/appdata/mealie/data:/app/data

    networks:
      - frontend_net
      - mealie_internal

    security_opt:
      - no-new-privileges:true

    labels:
      - traefik.enable=true
      - traefik.docker.network=frontend_net
      - traefik.http.routers.mealie.rule=Host(`mealie.kaleschke.info`)
      - traefik.http.routers.mealie.entrypoints=websecure
      - traefik.http.routers.mealie.tls=true
      - traefik.http.routers.mealie.tls.certresolver=le
      - traefik.http.services.mealie.loadbalancer.server.port=9000

  mealie-postgres:
    image: postgres:17
    container_name: mealie-postgres
    restart: unless-stopped

    environment:
      TZ: Europe/Berlin
      POSTGRES_USER: mealie
      POSTGRES_DB: mealie
      POSTGRES_PASSWORD: ${Kallilab-Mealie-2026!}
      PGDATA: /var/lib/postgresql/data

    volumes:
      - /mnt/user/appdata/mealie/postgres:/var/lib/postgresql/data

    networks:
      - mealie_internal

    security_opt:
      - no-new-privileges:true

networks:
  frontend_net:
    external: true

  mealie_internal:
    driver: bridge
    internal: true