services:
  squid:
    image: ubuntu/squid:latest
    container_name: squid
    restart: unless-stopped
    ports:
      - "3128:3128"
    volumes:
      - /opt/squid/config/squid.conf:/etc/squid/squid.conf:ro
      - /opt/squid/config/vpn_domains.txt:/etc/squid/vpn_domains.txt:ro
      - /opt/squid/cache:/var/spool/squid
      - /opt/squid/logs:/var/log/squid
    networks:
      - traefik-net

  wpad:
    image: nginx:alpine
    container_name: wpad
    restart: unless-stopped
    volumes:
      - /opt/squid/wpad/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - /opt/squid/wpad/wpad.dat:/var/www/wpad/wpad.dat:ro
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.wpad.loadbalancer.server.port=80"
      - "traefik.http.routers.wpad-lan.rule=Host(`wpad.lan`)"
      - "traefik.http.routers.wpad-lan.entrypoints=websecure"
      - "traefik.http.routers.wpad-lan.tls=true"
      - "traefik.http.routers.wpad-lan.tls.certresolver=stepca"
      - "traefik.http.routers.wpad-lan.service=wpad"

  configurator:
    build: /opt/squid/configurator
    container_name: squid-configurator
    restart: unless-stopped
    environment:
      - SQUID_CONTAINER=squid
      - PORT=8080
    volumes:
      - /opt/squid/config:/squid-config
      - /opt/squid/wpad:/wpad
      - /opt/squid/configurator/data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik-net
    depends_on:
      - squid
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.squid-cfg.loadbalancer.server.port=8080"
      - "traefik.http.routers.squid-cfg-lan.rule=Host(`squid.lan`)"
      - "traefik.http.routers.squid-cfg-lan.entrypoints=websecure"
      - "traefik.http.routers.squid-cfg-lan.tls=true"
      - "traefik.http.routers.squid-cfg-lan.tls.certresolver=stepca"
      - "traefik.http.routers.squid-cfg-lan.service=squid-cfg"
      # Forward-Auth via Pocket ID (analog zu deinen anderen Stacks)
      # - "traefik.http.routers.squid-cfg-lan.middlewares=pocketid-auth@file"

networks:
  traefik-net:
    external: true