services:

  ntfy:
    image: binwiederhier/ntfy:${NTFY_VERSION}
    restart: unless-stopped
    networks:
      - web
    command:
      - serve
    environment:
      - TZ=UTC
      - NTFY_BASE_URL=https://push.${DOMAIN}
      - NTFY_LISTEN_HTTP=0.0.0.0:80
      - NTFY_CACHE_FILE=/var/cache/ntfy/cache.db
      - NTFY_CACHE_DURATION=24h
      - NTFY_BEHIND_PROXY=true
      - NTFY_ATTACHMENT_CACHE_DIR=/var/cache/ntfy/attachments
      - NTFY_KEEPALIVE_INTERVAL=45s
      - NTFY_AUTH_DEFAULT_ACCESS=deny-all
      - NTFY_AUTH_FILE=/var/lib/ntfy/user.db
      - NTFY_ENABLE_SIGNUP=false
      - NTFY_ENABLE_LOGIN=true
      - NTFY_ENABLE_RESERVATIONS=false
    volumes:
      - ${VOLUMES_PATH}/push/ntfy/cache/:/var/cache/ntfy
      - ${VOLUMES_PATH}/push/ntfy/varlib/:/var/lib/ntfy/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.push.rule=Host(`push.${DOMAIN}`)"
      - "traefik.http.routers.push.entrypoints=websecure"
      - "traefik.http.routers.push.tls.certresolver=netcup"
      - "traefik.http.routers.push.tls.options=intermediate@file"
      - "traefik.http.services.push.loadbalancer.server.port=80"
      - "docker.group=push"
      - "diun.enable=true"

networks:
  push:
  web:
    external: true