services:
  mealie:
    image: ghcr.io/mealie-recipes/mealie:v3.19.2@sha256:f68e959bf66f4f458893ea58facac71690fe6f2ac7a31466b5cecb41b4e99c02
    container_name: mealie
    restart: unless-stopped

    environment:
      TZ: Europe/Berlin
      ALLOW_SIGNUP: "false"
      PUID: "99"
      PGID: "100"

      DB_ENGINE: postgres
      POSTGRES_SERVER: mealie-postgres
      POSTGRES_DB: mealie
      POSTGRES_USER: mealie
      POSTGRES_PASSWORD: ${MEALIE_POSTGRES_PASSWORD}

      BASE_URL: https://mealie.kaleschke.info

    volumes:
      - /mnt/user/appdata/mealie/data:/app/data

    networks:
      - frontend_net
      - mealie_internal

    security_opt:
      - no-new-privileges:true

    labels:
      - traefik.enable=true
      - traefik.docker.network=frontend_net
      - traefik.http.routers.mealie.rule=Host(`mealie.kaleschke.info`)
      - traefik.http.routers.mealie.entrypoints=websecure
      - traefik.http.routers.mealie.tls=true
      - traefik.http.routers.mealie.tls.certresolver=le
      - traefik.http.services.mealie.loadbalancer.server.port=9000

  mealie-postgres:
    image: postgres:17.9@sha256:5b96f1a16bd9768b060dd2ffe55cb6225c4d9ef4d214a8b21eb08134869a97e4
    container_name: mealie-postgres
    restart: unless-stopped

    environment:
      TZ: Europe/Berlin
      POSTGRES_USER: mealie
      POSTGRES_DB: mealie
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      PGDATA: /var/lib/postgresql/data

    volumes:
      - /mnt/user/appdata/mealie/postgres:/var/lib/postgresql/data
      - /mnt/user/appdata/secrets/mealie_postgres_password.txt:/run/secrets/postgres_password:ro

    networks:
      - mealie_internal

    security_opt:
      - no-new-privileges:true

networks:
  frontend_net:
    external: true

  mealie_internal:
    driver: bridge
    internal: true