version: "3.9"

# ummah2.falahos.my — WordPress on Contabo Docker Swarm
# Deploy: docker stack deploy -c docker-stack.yml --with-registry-auth ummah2

services:
  db:
    image: mariadb:11
    environment:
      MYSQL_ROOT_PASSWORD: "FalahDB_Root_2026!"
      MYSQL_DATABASE: ummah2_wp
      MYSQL_USER: ummah2_wp
      MYSQL_PASSWORD: "FalahDB_WP_2026!"
    volumes:
      - ummah2-db-data:/var/lib/mysql
    networks:
      - ummah2-internal
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure

  wordpress:
    image: wordpress:6.7-php8.3-apache
    depends_on:
      - db
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: ummah2_wp
      WORDPRESS_DB_USER: ummah2_wp
      WORDPRESS_DB_PASSWORD: "FalahDB_WP_2026!"
      WORDPRESS_TABLE_PREFIX: wp_umm_
      WORDPRESS_DEBUG: "false"
      PHP_MEMORY_LIMIT: 256M
      WORDPRESS_CONFIG_EXTRA: |
        define('WP_MEMORY_LIMIT', '256M');
        define('WP_HOME', 'https://ummah2.falahos.my');
        define('WP_SITEURL', 'https://ummah2.falahos.my');
        $_SERVER['HTTPS'] = 'on';
        define('FORCE_SSL_ADMIN', true);
    volumes:
      - ummah2-wp-data:/var/www/html
    networks:
      - ummah2-internal
      - falah_traefik-net
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=falah_traefik-net"
        # HTTPS router
        - "traefik.http.routers.ummah2wp.rule=Host(`ummah2.falahos.my`)"
        - "traefik.http.routers.ummah2wp.entrypoints=websecure"
        - "traefik.http.routers.ummah2wp.tls=true"
        - "traefik.http.routers.ummah2wp.middlewares=ratelimit-public,sec-headers,compress"
        - "traefik.http.services.ummah2wp.loadbalancer.server.port=80"
        # HTTP router (Cloudflare handles HTTP→HTTPS)
        - "traefik.http.routers.ummah2wp-http.rule=Host(`ummah2.falahos.my`)"
        - "traefik.http.routers.ummah2wp-http.entrypoints=web"
        - "traefik.http.routers.ummah2wp-http.service=ummah2wp"

networks:
  ummah2-internal:
    driver: overlay
    attachable: true
  falah_traefik-net:
    external: true

volumes:
  ummah2-db-data:
    external: true
    name: ummah2-db-data
  ummah2-wp-data:
    external: true
    name: ummah2-wp-data