services:
  bentopdf:
    image: bentopdfteam/bentopdf:2.8.5@sha256:2d867aacb8ab5b196d00ee86944b1899d09d72df355384c5e15cf974737963a0
    container_name: bentopdf
    restart: unless-stopped
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,mode=1777
      - /var/cache/nginx:rw,noexec,nosuid,nodev,uid=101,gid=101,mode=0755
      - /var/run:rw,noexec,nosuid,nodev,uid=101,gid=101,mode=0755
    networks:
      - frontend_net
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    labels:
      - traefik.enable=true
      - traefik.docker.network=frontend_net
      - traefik.http.routers.bentopdf.rule=Host(`pdf.kaleschke.info`)
      - traefik.http.routers.bentopdf.entrypoints=websecure
      - traefik.http.routers.bentopdf.tls=true
      - traefik.http.routers.bentopdf.tls.certresolver=le
      - traefik.http.routers.bentopdf.middlewares=authelia@file,secure-headers@file,bentopdf-coi@docker
      - traefik.http.middlewares.bentopdf-coi.headers.customresponseheaders.Cross-Origin-Opener-Policy=same-origin
      - traefik.http.middlewares.bentopdf-coi.headers.customresponseheaders.Cross-Origin-Embedder-Policy=require-corp
      - traefik.http.services.bentopdf.loadbalancer.server.port=8080

networks:
  frontend_net:
    external: true