---
services:
  traefik:
    networks:
      opencloud-net:
        aliases:
          - ${STALWART_DOMAIN:-stalwart.opencloud.test}

  stalwart:
    image: ghcr.io/stalwartlabs/stalwart:v0.16.9-alpine
    hostname: ${STALWART_DOMAIN:-stalwart.opencloud.test}
    networks:
      - opencloud-net
    ports:
      - "127.0.0.1:8443:443"
      - "127.0.0.1:8080:8080"
      - "127.0.0.1:143:143"
      - "127.0.0.1:993:993"
      - "127.0.0.1:1465:465"
    volumes:
      - ./config/stalwart/config.json:/etc/stalwart/config.json
      - stalwart-data:/var/lib/stalwart
    environment:
      STALWART_RECOVERY_ADMIN: "admin:secret"
      STALWART_PUBLIC_URL: "https://${STALWART_DOMAIN:-stalwart.opencloud.test}"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.stalwart.entrypoints=https"
      - "traefik.http.routers.stalwart.rule=Host(`${STALWART_DOMAIN:-stalwart.opencloud.test}`)"
      - "traefik.http.routers.stalwart.tls.certresolver=http"
      - "traefik.http.routers.stalwart.service=stalwart"
      - "traefik.http.services.stalwart.loadbalancer.server.port=8080"
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: unless-stopped
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        if [ ! -f /var/lib/stalwart/.initialized ]; then
          echo "Not initialized, starting in recovery mode"
          STALWART_RECOVERY_MODE=1 /usr/local/bin/stalwart --config /etc/stalwart/config.json &
          pid=$$!
          while [ ! -f /var/lib/stalwart/.initialized ]; do sleep 1; done
          echo "Initialized, stopping recovery mode"
          kill -TERM $$pid
          wait $$pid
        fi
        echo "Starting Stalwart in production mode"
        exec /usr/local/bin/stalwart --config /etc/stalwart/config.json

    healthcheck:
      test: ["CMD-SHELL", "curl -LsSf http://localhost:8080/healthz/live|grep -q '\"status\":200'"]
      interval: 10s
      retries: 5
      start_period: 3s
      timeout: 3s

  stalwart-import:
    build:
      context: ./config/stalwart/
      args:
        VERSION: "1.0.8"
      dockerfile_inline: |
        FROM alpine:latest AS downloader
        ARG VERSION
        RUN apk add --no-cache curl tar xz wget
        RUN arch=$(apk --print-arch) && \
            mkdir /cli && \
            curl --proto '=https' --tlsv1.2 -LsSf \
              https://github.com/stalwartlabs/cli/releases/download/v$${VERSION}/stalwart-cli-$${arch}-unknown-linux-musl.tar.xz \
              | tar xJf - --strip-components=1 -C /cli
        RUN mv /cli/stalwart-cli /stalwart-cli && rm -rf /cli/
        CMD ["/stalwart-cli"]

    networks:
      - opencloud-net
    volumes:
      - ./config/stalwart/${STALWART_AUTH_DIRECTORY:-idmldap}.json:/snapshot.json:ro
      - stalwart-data:/var/lib/stalwart
    environment:
      STALWART_URL: "http://stalwart:8080"
      STALWART_USER: "admin"
      STALWART_PASSWORD: "secret"
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        if [ -f /var/lib/stalwart/.initialized ]; then
          echo "Already initialized, skipping stalwart-cli."
          exit 0
        fi
        echo "Waiting for the Stalwart recovery API to become live"
        until wget -qO- $$STALWART_URL/healthz/live >/dev/null 2>&1; do sleep 1; done
        echo "Applying configuration"
        /stalwart-cli --debug apply --file /snapshot.json
        touch /var/lib/stalwart/.initialized
        echo "Successfully initialized"

    depends_on:
      - stalwart

  stalwart-reset:
    image: alpine:latest
    profiles:
      - maintenance
    volumes:
      - stalwart-data:/var/lib/stalwart
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        if [ -f /var/lib/stalwart/.initialized ]; then
          rm -f /var/lib/stalwart/.initialized
          echo "Success: Lockfile removed. Next time 'stalwart' boots, it will run in recovery mode."
        fi

volumes:
  stalwart-data: