services:
  glance:
    image: glanceapp/glance:v0.8.5
    container_name: glance
    restart: unless-stopped
    environment:
      TZ: Europe/Berlin
      GLANCE_IMMICH_API_KEY: ${GLANCE_IMMICH_API_KEY:-}
      GLANCE_ADGUARD_USERNAME: ${GLANCE_ADGUARD_USERNAME:-}
      GLANCE_ADGUARD_PASSWORD: ${GLANCE_ADGUARD_PASSWORD:-}
      GLANCE_SPEEDTEST_API_KEY: ${GLANCE_SPEEDTEST_API_KEY:-}
    volumes:
      - ./config:/app/config:ro
    networks:
      - frontend_net
      - glance_socket_net
    depends_on:
      - glance-docker-socket-proxy
    labels:
      - traefik.enable=true
      - traefik.docker.network=frontend_net
      - traefik.http.routers.glance.rule=Host(`glance.kaleschke.info`)
      - traefik.http.routers.glance.entrypoints=websecure
      - traefik.http.routers.glance.tls=true
      - traefik.http.routers.glance.tls.certresolver=le
      - traefik.http.routers.glance.middlewares=authelia@file,secure-headers@file
      - traefik.http.services.glance.loadbalancer.server.port=8080
    security_opt:
      - no-new-privileges:true

  glance-docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:v0.4.2
    container_name: glance-docker-socket-proxy
    restart: unless-stopped
    environment:
      LOG_LEVEL: warning
      POST: "0"
      CONTAINERS: "1"
      INFO: "1"
      VERSION: "1"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - glance_socket_net
    expose:
      - "2375"
    security_opt:
      - no-new-privileges:true

networks:
  frontend_net:
    external: true
  glance_socket_net:
    name: glance_socket_net
    internal: true
    driver: bridge