services:
  auth:
    build: ./auth
    restart: on-failure
    ports:
      - "8080:8080"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.auth.rule=PathPrefix(`/auth/`) || PathPrefix(`/.well-known/`)"

  api:
    build: ./api
    restart: on-failure
    ports:
      - "3000:3000"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=PathPrefix(`/api/`)"
      - "traefik.http.routers.api.middlewares=phantom-token"
      - "traefik.http.middlewares.phantom-token.forwardauth.address=http://auth:8080/auth/jwt"
      - "traefik.http.middlewares.phantom-token.forwardauth.authRequestHeaders=Authorization,X-Api-Key"
      - "traefik.http.middlewares.phantom-token.forwardauth.authResponseHeaders=Authorization"

  traefik:
    image: traefik:v3.3
    restart: on-failure
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.web.address=:7891"
      - "--accesslog=true"
    ports:
      - "7891:7891"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"