services:
  super-productivity:
    # TODO (Codex, erster Deploy): Digest am Container per `docker inspect` auslesen
    # und Tag durch `johannesjo/super-productivity:v18.8.0@sha256:<digest>` ersetzen.
    image: johannesjo/super-productivity:v18.8.0
    container_name: super-productivity
    restart: unless-stopped

    security_opt:
      - no-new-privileges:true

    networks:
      - frontend_net

    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=frontend_net"
      - "traefik.http.routers.super-productivity.rule=Host(`sp.kaleschke.info`)"
      - "traefik.http.routers.super-productivity.entrypoints=websecure"
      - "traefik.http.routers.super-productivity.tls=true"
      - "traefik.http.routers.super-productivity.tls.certresolver=le"
      - "traefik.http.routers.super-productivity.middlewares=authelia@file,secure-headers@file"
      - "traefik.http.services.super-productivity.loadbalancer.server.port=80"

networks:
  frontend_net:
    external: true