services:
  server:
    image: headscale/headscale:latest
    restart: unless-stopped
    command: serve
    networks:
      - proxy
    volumes:
      - ./config:/etc/headscale
      - ./data:/var/lib/headscale
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"

      ## SERVICE
      # Prod Router
      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
      - "traefik.http.routers.headscale.entrypoints=websecure"
      - "traefik.http.routers.headscale.service=headscale"
      - "traefik.http.routers.headscale.tls=true"
      # Local Router
      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
      - "traefik.http.routers.headscale-local.entrypoints=websecure"
      - "traefik.http.routers.headscale-local.service=headscale"
      - "traefik.http.routers.headscale-local.tls=true"
      # Dev Router
      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
      - "traefik.http.routers.headscale-dev.service=headscale"
      - "traefik.http.routers.headscale-dev.tls=true"

      ## METRICS
      # Prod Router
      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
      - "traefik.http.routers.headscale-metrics.tls=true"
      # Local Router
      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
      - "traefik.http.routers.headscale-metrics-local.tls=true"
      # Dev Router
      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
      - "traefik.http.routers.headscale-metrics-dev.tls=true"
  web:
    image: goodieshq/headscale-admin:latest
    restart: unless-stopped
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "treafik.docker.network=proxy"
      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
      
      # Prod Router
      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
      - "traefik.http.routers.headscale-ui.service=headscale-ui"
      - "traefik.http.routers.headscale-ui.tls=true"
      # Local Router
      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
      - "traefik.http.routers.headscale-ui-local.service=headscale-ui"
      - "traefik.http.routers.headscale-ui-local.tls=true"
      # Dev Router
      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
      - "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
      - "traefik.http.routers.headscale-ui-dev.tls=true"

networks:
  proxy:
    external: true