services:
  squid:
    image: ubuntu/squid:latest
    container_name: squid
    restart: unless-stopped
    command: ["squid", "-f", "/squid-config/squid.conf", "-NYC"]
    ports:
      - "3128:3128"
    volumes:
      - /opt/squid/config:/squid-config:ro
      - /opt/squid/cache:/var/spool/squid
      - /opt/squid/logs:/var/log/squid
    networks:
      - traefik-net

  wpad:
    image: nginx:alpine
    container_name: wpad
    restart: unless-stopped
    volumes:
      - /opt/squid/wpad/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - /opt/squid/wpad:/var/www/wpad:ro
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.wpad.loadbalancer.server.port=80"
      # HTTP für WPAD Auto-Discovery (kein TLS!)
      - "traefik.http.routers.wpad-http.rule=Host(`wpad.lan`) || Host(`wpad`)
      - "traefik.http.routers.wpad-http.entrypoints=web"
      - "traefik.http.routers.wpad-http.service=wpad"
      # HTTPS Variante bleibt erhalten
      - "traefik.http.routers.wpad-lan.rule=Host(`wpad.lan`)"
      - "traefik.http.routers.wpad-lan.entrypoints=websecure"
      - "traefik.http.routers.wpad-lan.tls=true"
      - "traefik.http.routers.wpad-lan.tls.certresolver=stepca"
      - "traefik.http.routers.wpad-lan.service=wpad"

  configurator:
    build: /opt/squid/configurator
    container_name: squid-configurator
    restart: unless-stopped
    environment:
      - SQUID_CONTAINER=squid
      - PORT=8080
    volumes:
      - /opt/squid/config:/squid-config
      - /opt/squid/wpad:/wpad
      - /opt/squid/configurator/data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik-net
    depends_on:
      - squid
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.squid-cfg.loadbalancer.server.port=8080"
      - "traefik.http.routers.squid-cfg-lan.rule=Host(`squid.lan`)"
      - "traefik.http.routers.squid-cfg-lan.entrypoints=websecure"
      - "traefik.http.routers.squid-cfg-lan.tls=true"
      - "traefik.http.routers.squid-cfg-lan.tls.certresolver=stepca"
      - "traefik.http.routers.squid-cfg-lan.service=squid-cfg"
      # Forward-Auth via Pocket ID (analog zu deinen anderen Stacks)
      # - "traefik.http.routers.squid-cfg-lan.middlewares=pocketid-auth@file"

networks:
  traefik-net:
    external: true
    name: proxy