# notify stack — ntfy push, FreshRSS reader, and the Vigilant RSS watcher.
#
# Volume -> bind-mount conversion:
#   vigilant cache -> /config/vigilant/cache  (SSD; regenerable)
# ntfy + freshrss are proxied (ntfy.ginnoir.com, freshrss.ginnoir.com). Vigilant
# only needs egress to post to ntfy's public URL; all three join edge.

services:
  ntfy:
    image: binwiederhier/ntfy:latest
    container_name: ntfy
    command:
      - serve
    restart: unless-stopped
    networks: [edge]
    env_file:
      - stack.env
    environment:
      - NTFY_DEFAULT_HOST=https://ntfy.ginnoir.com
      - NTFY_BASE_URL=https://ntfy.ginnoir.com
      - NTFY_CACHE_FILE=/var/lib/ntfy/cache.db
      - NTFY_AUTH_FILE=/var/lib/ntfy/auth.db
      - NTFY_AUTH_DEFAULT_ACCESS=read-write
      - NTFY_BEHIND_PROXY=true
      - NTFY_ATTACHMENT_CACHE_DIR=/var/lib/ntfy/attachments
      - NTFY_ENABLE_LOGIN=true
    user: 1000:1000
    volumes:
      - /config/ntfy/var/cache/ntfy:/var/cache/ntfy
      - /config/ntfy/etc/ntfy:/etc/ntfy
      - /config/ntfy/var/lib/ntfy:/var/lib/ntfy
    ports:
      - "8000:80"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1",
        ]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 40s

  freshrss:
    image: freshrss/freshrss:latest
    container_name: freshrss
    hostname: freshrss
    restart: unless-stopped
    networks: [edge]
    logging:
      options:
        max-size: 10m
    volumes:
      - /config/freshrss/data:/var/www/FreshRSS/data
      - /config/freshrss/extensions:/var/www/FreshRSS/extensions
    ports:
      - "9999:80"
    env_file:
      - stack.env
    environment:
      - CRON_MIN=3,33
      - TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
      - FRESHRSS_INSTALL=--default-user ginnoir --api-enabled --base-url https://freshrss.ginnoir.com

  vigilant:
    container_name: vigilant
    image: ghcr.io/verifiedjoseph/vigilant:latest
    restart: unless-stopped
    networks: [edge]
    env_file:
      - stack.env
    environment:
      - VIGILANT_NOTIFICATION_SERVICE=ntfy
      - VIGILANT_NOTIFICATION_NTFY_URL=https://ntfy.ginnoir.com/
      - VIGILANT_NOTIFICATION_NTFY_TOPIC=RSS
    volumes:
      - /config/vigilant/feeds.yaml:/app/feeds.yaml
      - /config/vigilant/cache:/app/cache
    security_opt:
      - no-new-privileges:true

networks:
  edge:
    name: edge
    external: true