services:
  postgres:
    image: postgres:${POSTGRES_IMAGE_TAG}
    restart: ${RESTART_POLICY}
    #security_opt:
    #  - no-new-privileges:true
    #pids_limit: 100
    #read_only: true
    tmpfs:
      - /tmp
      - /var/run/postgresql
    volumes:
      - ${POSTGRES_DATA_PATH}:/var/lib/postgresql/data
    environment:
      - TZ
      - POSTGRES_USER
      - POSTGRES_PASSWORD
      - POSTGRES_DB
    networks:
      - default

  service:
    depends_on:
      - postgres
    image: mattermost/${MATTERMOST_IMAGE}:${MATTERMOST_IMAGE_TAG}
    labels:
      - traefik.enable=true
      - traefik.http.routers.mattermost.entrypoints=websecure
      - traefik.http.routers.mattermost.rule=Host(`chat.rskio.com`)
      - traefik.http.routers.mattermost.tls=true
      - traefik.http.routers.mattermost.tls.options=external@file
      - traefik.http.routers.mattermost.tls.certresolver=rskio_certresolver
      - traefik.http.routers.mattermost.service=mattermost@docker
      - traefik.http.services.mattermost.loadbalancer.server.port=8065
      - traefik.http.routers.mattermost.middlewares=secureHeaders@file
    restart: ${RESTART_POLICY}
    #security_opt:
    #  - no-new-privileges:true
    #pids_limit: 200
    #read_only: ${MATTERMOST_CONTAINER_READONLY}
    tmpfs:
      - /tmp
    volumes:
      - ${MATTERMOST_CONFIG_PATH}:/mattermost/config:rw
      - ${MATTERMOST_DATA_PATH}:/mattermost/data:rw
      - ${MATTERMOST_LOGS_PATH}:/mattermost/logs:rw
      - ${MATTERMOST_PLUGINS_PATH}:/mattermost/plugins:rw
      - ${MATTERMOST_CLIENT_PLUGINS_PATH}:/mattermost/client/plugins:rw
      - ${MATTERMOST_BLEVE_INDEXES_PATH}:/mattermost/bleve-indexes:rw
    environment:
      - TZ
      - MM_SQLSETTINGS_DRIVERNAME
      - MM_SQLSETTINGS_DATASOURCE
      - MM_BLEVESETTINGS_INDEXDIR
      - MM_SERVICESETTINGS_SITEURL
    networks:
      - default
      - traefik

networks:
  traefik:
    external: true