services:
  haraka-inbound:
    image: ${HARAKA_IMAGE:-git.elektrine.com/elektrine/elektrine-haraka}:${HARAKA_IMAGE_TAG:-latest}
    ports:
      - "25:25"
    volumes:
      - ../logs:/app/logs
      - ../config:/app/config
      - ../config/dkim:/data/haraka/dkim
      - ../plugins:/app/plugins:ro
      - ../lib:/app/lib:ro
      - ../scripts:/app/scripts:ro
      - ssl-certs:/app/ssl
    environment:
      - NODE_ENV=production
      - HARAKA_ROLE=inbound-mx
      - HARAKA_API_KEY=${HARAKA_API_KEY:-}
      - PHOENIX_API_KEY=${PHOENIX_API_KEY:-}
      - PHOENIX_WEBHOOK_URL=${PHOENIX_WEBHOOK_URL:-}
      - PHOENIX_VERIFY_URL=${PHOENIX_VERIFY_URL:-}
      - PHOENIX_DOMAINS_URL=${PHOENIX_DOMAINS_URL:-}
      - LOCAL_DOMAINS=${LOCAL_DOMAINS:-}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}
      - ELEKTRINE_QUEUE_NAME=${ELEKTRINE_QUEUE_NAME:-elektrine:inbound}
      - ELEKTRINE_DLQ_NAME=${ELEKTRINE_DLQ_NAME:-elektrine:inbound:dlq}
      - HARAKA_DOMAIN=${HARAKA_DOMAIN:-mail.example.com}
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - haraka-network
      - main-app-network
    depends_on:
      - redis
      - clamav
      - spamassassin

  haraka-submission:
    image: ${HARAKA_IMAGE:-git.elektrine.com/elektrine/elektrine-haraka}:${HARAKA_IMAGE_TAG:-latest}
    volumes:
      - ../logs:/app/logs
      - ../config:/app/config
      - ../config/dkim:/data/haraka/dkim
      - ../plugins:/app/plugins:ro
      - ../lib:/app/lib:ro
      - ../scripts:/app/scripts:ro
      - ssl-certs:/app/ssl
    environment:
      - NODE_ENV=production
      - HARAKA_ROLE=submission
      - HARAKA_API_KEY=${HARAKA_API_KEY:-}
      - PHOENIX_API_KEY=${PHOENIX_API_KEY:-}
      - PHOENIX_VERIFY_URL=${PHOENIX_VERIFY_URL:-}
      - PHOENIX_DOMAINS_URL=${PHOENIX_DOMAINS_URL:-}
      - LOCAL_DOMAINS=${LOCAL_DOMAINS:-}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}
      - HARAKA_DOMAIN=${HARAKA_DOMAIN:-mail.example.com}
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - haraka-network
      - main-app-network
    depends_on:
      - redis

  haraka-outbound:
    image: ${HARAKA_IMAGE:-git.elektrine.com/elektrine/elektrine-haraka}:${HARAKA_IMAGE_TAG:-latest}
    ports:
      - "127.0.0.1:${HARAKA_HTTP_BIND_PORT:-18080}:8080"
    volumes:
      - ../logs:/app/logs
      - ../config:/app/config
      - ../config/dkim:/data/haraka/dkim
      - ../plugins:/app/plugins:ro
      - ../lib:/app/lib:ro
      - ../scripts:/app/scripts:ro
      - ssl-certs:/app/ssl
    environment:
      - NODE_ENV=production
      - HARAKA_ROLE=outbound-relay
      - HARAKA_API_KEY=${HARAKA_API_KEY:-}
      - PHOENIX_API_KEY=${PHOENIX_API_KEY:-}
      - HARAKA_HTTP_API_KEY=${HARAKA_HTTP_API_KEY:-}
      - PHOENIX_WEBHOOK_URL=${PHOENIX_WEBHOOK_URL:-}
      - PHOENIX_VERIFY_URL=${PHOENIX_VERIFY_URL:-}
      - PHOENIX_DOMAINS_URL=${PHOENIX_DOMAINS_URL:-}
      - LOCAL_DOMAINS=${LOCAL_DOMAINS:-}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}
      - HARAKA_HTTP_PORT=8080
      - HARAKA_HTTP_HOST=0.0.0.0
      - HARAKA_DOMAIN=${HARAKA_DOMAIN:-mail.example.com}
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - haraka-network
      - main-app-network
    depends_on:
      - redis

  haraka-worker:
    image: ${HARAKA_IMAGE:-git.elektrine.com/elektrine/elektrine-haraka}:${HARAKA_IMAGE_TAG:-latest}
    command: ["node", "/app/scripts/elektrine-worker.js"]
    volumes:
      - ../logs:/app/logs
      - ../config:/app/config
      - ../config/dkim:/data/haraka/dkim
      - ../plugins:/app/plugins:ro
      - ../lib:/app/lib:ro
      - ../scripts:/app/scripts:ro
    environment:
      - NODE_ENV=production
      - HARAKA_ROLE=worker
      - HARAKA_API_KEY=${HARAKA_API_KEY:-}
      - PHOENIX_API_KEY=${PHOENIX_API_KEY:-}
      - PHOENIX_WEBHOOK_URL=${PHOENIX_WEBHOOK_URL:-}
      - PHOENIX_VERIFY_URL=${PHOENIX_VERIFY_URL:-}
      - PHOENIX_DOMAINS_URL=${PHOENIX_DOMAINS_URL:-}
      - LOCAL_DOMAINS=${LOCAL_DOMAINS:-}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379}
      - ELEKTRINE_QUEUE_NAME=${ELEKTRINE_QUEUE_NAME:-elektrine:inbound}
      - ELEKTRINE_DLQ_NAME=${ELEKTRINE_DLQ_NAME:-elektrine:inbound:dlq}
      - WEBHOOK_MAX_RETRIES=${WEBHOOK_MAX_RETRIES:-5}
      - WEBHOOK_RETRY_BASE_MS=${WEBHOOK_RETRY_BASE_MS:-1000}
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - haraka-network
      - main-app-network
    depends_on:
      - redis

  cert-copier:
    image: ${CERT_COPIER_IMAGE:-alpine:3.20}
    volumes:
      - main-caddy-data:/caddy-data:ro
      - ssl-certs:/ssl-certs
    environment:
      - HARAKA_DOMAIN=${HARAKA_DOMAIN:-mail.example.com}
    command: >
      sh -c "
        while true; do
          if [ -f /caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.elektrine.com/wildcard_.elektrine.com.crt ]; then
            cp /caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.elektrine.com/wildcard_.elektrine.com.crt /ssl-certs/cert.crt
            cp /caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.elektrine.com/wildcard_.elektrine.com.key /ssl-certs/cert.key
            chmod 644 /ssl-certs/cert.crt
            chmod 600 /ssl-certs/cert.key
          elif [ -f /caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/$$HARAKA_DOMAIN/$$HARAKA_DOMAIN.crt ]; then
            cp /caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/$$HARAKA_DOMAIN/$$HARAKA_DOMAIN.crt /ssl-certs/cert.crt
            cp /caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/$$HARAKA_DOMAIN/$$HARAKA_DOMAIN.key /ssl-certs/cert.key
            chmod 644 /ssl-certs/cert.crt
            chmod 600 /ssl-certs/cert.key
          fi
          sleep 30
        done
      "
    networks:
      - haraka-network
    restart: unless-stopped

  redis:
    image: ${REDIS_IMAGE:-redis:7-alpine}
    command:
      - redis-server
      - --appendonly
      - yes
      - --appendfsync
      - everysec
      - --save
      - "900 1"
      - --save
      - "300 10"
      - --save
      - "60 10000"
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - redis-data:/data
    restart: unless-stopped
    networks:
      - haraka-network

  clamav:
    image: ${CLAMAV_IMAGE:-clamav/clamav:stable}
    ports:
      - "127.0.0.1:3310:3310"
    volumes:
      - clamav-data:/var/lib/clamav
    environment:
      - CLAMAV_NO_FRESHCLAM=false
    restart: unless-stopped
    networks:
      - haraka-network

  spamassassin:
    image: ${SPAMASSASSIN_IMAGE:-dinkel/spamassassin:latest}
    ports:
      - "127.0.0.1:783:783"
    volumes:
      - spamassassin-data:/var/lib/spamassassin
    environment:
      - SA_UPDATE=1
    restart: unless-stopped
    networks:
      - haraka-network

networks:
  haraka-network:
    driver: bridge
  main-app-network:
    external: true
    name: ${MAIN_APP_NETWORK:-docker_elektrine_network}

volumes:
  main-caddy-data:
    external: true
    name: ${MAIN_CADDY_VOLUME:-elektrine_caddy_data}
  redis-data:
  ssl-certs:
  clamav-data:
  spamassassin-data: