###############################################################
# Networks
###############################################################
networks:
  proxy-net:
    name: proxy-net
    external: true

###############################################################
# Services
###############################################################
services:
  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:4.5.5-ls248
    container_name: sabnzbd
    mem_limit: 2048m
    environment:
      - PUID=0
      - PGID=0
      - TZ=America/New_York
    volumes:
      - /mnt/appdata/sabnzbd/data:/config
      - /mnt/media/incoming/downloads-sab/complete/:/downloads
      - /mnt/media/incoming/downloads-sab/incomplete:/incomplete-downloads
      - /mnt/media/incoming/downloads-sab/history:/history
    # ports:
    #   - 7777:8080
    restart: unless-stopped
    networks:
      - proxy-net
    # labels:
    #   - "traefik.enable=true"
    #   - "traefik.http.routers.sabnzbd.rule=Host(`sab.castaldifamily.com`)"
    #   - "traefik.http.routers.sabnzbd.entrypoints=websecure"
    #   - "traefik.http.routers.sabnzbd.tls.certresolver=letsencrypt"
    #   - "traefik.http.services.sabnzbd.loadbalancer.server.port=8080"
  sabnzbd_outpost:
    image: ghcr.io/goauthentik/proxy:2026.2.2
    container_name: sabnzbd_outpost
    networks:
      - proxy-net
    environment:
      AUTHENTIK_HOST: https://sso.castaldifamily.com
      AUTHENTIK_TOKEN: xvPTq2ASWspkW9Z7H44RPwLZ9LhFqBrtQ11eXPlE7QWGhsixWU7Rc07xVmsw
      AUTHENTIK_INSECURE: "false"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.sabnzbd-proxy.entrypoints=websecure"
      - "traefik.http.routers.sabnzbd-proxy.rule=Host(`sabnzbd.castaldifamily.com`)"
      - "traefik.http.routers.sabnzbd-proxy.tls=true"
      - "traefik.http.routers.sabnzbd-proxy.tls.certresolver=cloudflare"
      - "traefik.http.services.sabnzbd-proxy.loadbalancer.server.port=9000"