services:
  traefik:
    container_name: traefik
    image: traefik:v3.3
    command: --api.insecure=true --providers.docker
    ports:
      - 80:80
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  nginx:
    container_name: nginx
    image: nginx:latest
    labels:
      traefik.enable: true
      traefik.http.routers.nginx.rule: Host(`nginx.dev.local`)
      traefik.http.services.nginx.loadbalancer.server.port: 80
      traefik.http.routers.nginx.middlewares: tinyauth

  tinyauth:
    container_name: tinyauth
    build:
      context: .
      dockerfile: Dockerfile
    environment:
      - SECRET=some-random-32-chars-string
      - APP_URL=http://tinyauth.dev.local
      - USERS=user:$$2a$$10$$UdLYoJ5lgPsC0RKqYH/jMua7zIn0g9kPqWmhYayJYLaZQ/FTmH2/u # user:password
    labels:
      traefik.enable: true
      traefik.http.routers.tinyauth.rule: Host(`tinyauth.dev.local`)
      traefik.http.services.tinyauth.loadbalancer.server.port: 3000
      traefik.http.middlewares.tinyauth.forwardauth.address: http://tinyauth:3000/api/auth/traefik
      traefik.http.middlewares.tinyauth.forwardauth.authResponseHeaders: Remote-User