# Managed by Ansible — do not edit manually
services:
  dl-web:
    image: nginx:alpine
    container_name: dl-web
    restart: unless-stopped
    volumes:
      - {{ dl_data_dir }}/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - {{ dl_data_dir }}/files:/var/www/dl:ro
    networks:
      - traefik_public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dl.rule=Host(`{{ domain_dl }}`)"
      - "traefik.http.routers.dl.entrypoints=websecure"
      - "traefik.http.routers.dl.tls.certresolver=letsencrypt"
      - "traefik.http.services.dl.loadbalancer.server.port=80"
      - "traefik.http.routers.dl.middlewares=rate-limit@docker"

{% if dl_sftp_authorized_keys | default('') | length > 0 %}
  dl-sftp:
    image: atmoz/sftp
    container_name: dl-sftp
    restart: unless-stopped
    volumes:
      - {{ dl_data_dir }}/files:/home/{{ dl_upload_user }}/files
      - {{ dl_data_dir }}/authorized_keys:/home/{{ dl_upload_user }}/.ssh/keys/authorized_keys:ro
    ports:
      - "{{ dl_sftp_port }}:22"
    # Empty password disables password auth — key auth only
    command: "{{ dl_upload_user }}::1001:1001:files"
{% endif %}

networks:
  traefik_public:
    external: true