version: '3'

services:
  scirius:
    container_name: mistborn_production_scirius
    image: "cyber5k/scirius:${MISTBORN_TAG}"
    #environment:
    #  - SECRET_KEY: <SECRET KEY>
    env_file:
      - ../.envs/.production/.scirius
    volumes:
      - /var/log/suricata:/logs
      - /etc/suricata/rules:/etc/suricata/rules
      - ../../mistborn_volumes/extra/scirius/static:/static
      - ../../mistborn_volumes/extra/scirius/data:/data
      - /var/run:/var/run:ro
      - /var/run/suricata/suricata-command.socket:/var/run/suricata/suricata-command.socket:ro
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
      - /run/systemd/system:/run/systemd/system:ro
      - /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket:ro
      - /bin/systemctl:/bin/systemctl:ro
      - /lib:/lib:ro
    cap_add:
      - SYS_ADMIN
    privileged: true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.scirius-http.rule=Host(`scirius.mistborn`)"
      - "traefik.http.routers.scirius-http.entrypoints=web"
      - "traefik.http.routers.scirius-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.scirius-https.rule=Host(`scirius.mistborn`)"
      - "traefik.http.routers.scirius-https.entrypoints=websecure"
      - "traefik.http.routers.scirius-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.scirius-https.tls.certresolver=basic"
      - "traefik.http.services.scirius-service.loadbalancer.server.port=8000"
    restart: unless-stopped 

networks:
  default:
    external:
      name: mistborn_default