###############################################################
# Networks
###############################################################
networks:
  proxy-net:
    name: proxy-net
    external: true

###############################################################
# Services
###############################################################
services:
  sonarr:
    image: lscr.io/linuxserver/sonarr:4.0.17.2952-ls307
    container_name: sonarr
    mem_limit: 5120m
    ports:
      - 8989:8989
    environment:
      - PUID=0
      - PGID=0
      - TZ=America/New_York
    volumes:
      - /mnt/appdata/sonarr/data:/config
      - /mnt/media/tvshows:/tv
      - /mnt/media/incoming/downloads-sab/complete/sonarr:/downloads
    restart: unless-stopped
    networks:
      - proxy-net
    # labels:
    #   - "traefik.enable=true"
    #   - "traefik.http.routers.sonarr.entrypoints=websecure"
    #   - "traefik.http.routers.sonarr.rule=Host(`sonarr.castaldifamily.com`)"
    #   - "traefik.http.routers.sonarr.tls=true"
    #   - "traefik.http.routers.sonarr.tls.certresolver=cloudflare"
    #   - "traefik.http.services.sonarr.loadbalancer.server.port=8989"

  sonarr_outpost:
    image: ghcr.io/goauthentik/proxy
    # Optionally specify the container's network, which must be able to reach the core authentik server.
    networks:
      - proxy-net
    container_name: sonarr_outpost
    environment:
        AUTHENTIK_HOST: https://sso.castaldifamily.com
        AUTHENTIK_INSECURE: "false"
        AUTHENTIK_TOKEN: cJ4UWeFQ2DUTyvR22s588ciFuLSw698HTVxnEf7ecN3dq3nFOyVod6ngE66Z
        # Optional setting to be used when `authentik_host` for internal communication doesn't match the public URL.
        AUTHENTIK_HOST_BROWSER: https://sonarr.castaldifamily.com
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.sonarr.entrypoints=websecure"
      - "traefik.http.routers.sonarr.rule=Host(`sonarr.castaldifamily.com`)"
      - "traefik.http.routers.sonarr.tls=true"
      - "traefik.http.routers.sonarr.tls.certresolver=cloudflare"
      - "traefik.http.services.sonarr.loadbalancer.server.port=9000"