# Managed by Ansible — do not edit manually
services:
  mail-db:
    image: postgres:{{ roundcube_db_version }}
    container_name: mail-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: roundcube
      POSTGRES_PASSWORD: "{{ roundcube_db_password }}"
      POSTGRES_DB: roundcube
    volumes:
      - {{ mail_data_dir }}/db:/var/lib/postgresql/data
    networks:
      - mail_internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U roundcube"]
      interval: 10s
      timeout: 5s
      retries: 5

  roundcube:
    image: roundcube/roundcubemail:{{ roundcube_version }}
    container_name: roundcube
    restart: unless-stopped
    environment:
      # Database
      ROUNDCUBEMAIL_DB_TYPE: pgsql
      ROUNDCUBEMAIL_DB_HOST: mail-db
      ROUNDCUBEMAIL_DB_PORT: "5432"
      ROUNDCUBEMAIL_DB_USER: roundcube
      ROUNDCUBEMAIL_DB_PASSWORD: "{{ roundcube_db_password }}"
      ROUNDCUBEMAIL_DB_NAME: roundcube
      # IMAP — leave empty to let users enter their own server at login,
      # or set to a specific host to lock it down (e.g. ssl://imap.example.com)
      ROUNDCUBEMAIL_DEFAULT_HOST: "{{ roundcube_imap_host }}"
      ROUNDCUBEMAIL_DEFAULT_PORT: "{{ roundcube_imap_port }}"
      # SMTP
      ROUNDCUBEMAIL_SMTP_SERVER: "{{ roundcube_smtp_host }}"
      ROUNDCUBEMAIL_SMTP_PORT: "{{ roundcube_smtp_port }}"
      # Security — 24-character random string used to encrypt session data
      ROUNDCUBEMAIL_DES_KEY: "{{ roundcube_des_key }}"
      ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
    networks:
      - traefik_public
      - mail_internal
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mail.rule=Host(`{{ domain_mail }}`)"
      - "traefik.http.routers.mail.entrypoints=websecure"
      - "traefik.http.routers.mail.tls.certresolver=letsencrypt"
      - "traefik.http.services.mail.loadbalancer.server.port=80"
    depends_on:
      mail-db:
        condition: service_healthy

networks:
  traefik_public:
    external: true
  mail_internal:
    internal: true