# Managed by Ansible — do not edit manually
services:
  mail-db:
    image: postgres:{{ roundcube_db_version }}
    container_name: mail-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: roundcube
      POSTGRES_PASSWORD: "{{ roundcube_db_password }}"
      POSTGRES_DB: roundcube
    volumes:
      - {{ mail_data_dir }}/db:/var/lib/postgresql/data
    networks:
      - mail_internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U roundcube"]
      interval: 10s
      timeout: 5s
      retries: 5

  dovecot:
    image: dovecot/dovecot:{{ dovecot_version }}
    container_name: dovecot
    restart: unless-stopped
    volumes:
      - {{ mail_data_dir }}/dovecot.conf:/etc/dovecot/dovecot.conf:ro
      - {{ mail_data_dir }}/passwd:/etc/dovecot/passwd:ro
      - {{ mail_data_dir }}/maildir:/var/mail
    networks:
      - traefik_public
      - mail_internal
    labels:
      - "traefik.enable=true"
      # TCP router — Traefik terminates TLS on port 993 and forwards plain IMAP to port 143
      - "traefik.tcp.routers.imaps.rule=HostSNI(`{{ domain_mail }}`)"
      - "traefik.tcp.routers.imaps.entrypoints=imaps"
      - "traefik.tcp.routers.imaps.tls.certresolver=letsencrypt"
      - "traefik.tcp.services.imaps.loadbalancer.server.port=143"

{% if fetchmail_accounts | default([]) | length > 0 %}
  fetchmail:
    image: alpine:3
    container_name: fetchmail
    restart: unless-stopped
    # apk add runs on each start — acceptable for a home server
    command: ["sh", "-c", "apk add --no-cache fetchmail && exec fetchmail --nodetach -f /etc/fetchmail/fetchmailrc"]
    volumes:
      - {{ mail_data_dir }}/fetchmailrc:/etc/fetchmail/fetchmailrc:ro
    networks:
      - traefik_public
      - mail_internal
    depends_on:
      - dovecot

{% endif %}
  roundcube:
    image: roundcube/roundcubemail:{{ roundcube_version }}
    container_name: roundcube
    restart: unless-stopped
    environment:
      # Database
      ROUNDCUBEMAIL_DB_TYPE: pgsql
      ROUNDCUBEMAIL_DB_HOST: mail-db
      ROUNDCUBEMAIL_DB_PORT: "5432"
      ROUNDCUBEMAIL_DB_USER: roundcube
      ROUNDCUBEMAIL_DB_PASSWORD: "{{ roundcube_db_password }}"
      ROUNDCUBEMAIL_DB_NAME: roundcube
      # IMAP — local Dovecot container
      ROUNDCUBEMAIL_DEFAULT_HOST: "dovecot"
      ROUNDCUBEMAIL_DEFAULT_PORT: "143"
      # SMTP — outgoing mail server (leave empty if not configured)
      ROUNDCUBEMAIL_SMTP_SERVER: "{{ roundcube_smtp_host }}"
      ROUNDCUBEMAIL_SMTP_PORT: "{{ roundcube_smtp_port }}"
      # Security
      ROUNDCUBEMAIL_DES_KEY: "{{ roundcube_des_key }}"
      ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
    networks:
      - traefik_public
      - mail_internal
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mail.rule=Host(`{{ domain_mail }}`)"
      - "traefik.http.routers.mail.entrypoints=websecure"
      - "traefik.http.routers.mail.tls.certresolver=letsencrypt"
      - "traefik.http.services.mail.loadbalancer.server.port=80"
      - "traefik.http.routers.mail.middlewares=rate-limit@docker"
    depends_on:
      mail-db:
        condition: service_healthy
      dovecot:
        condition: service_started

networks:
  traefik_public:
    external: true
  mail_internal:
    internal: true