version: '3'
services:
  homepage:
    image: ghcr.io/gethomepage/homepage:latest  
    container_name: homepage
    restart: unless-stopped

    # Ports only needed if bypassing Traefik locally. 
    # Safe to remove/comment out when using Traefik properly.
    ports:
      - "10000:3000"
    
    volumes:
      - /mnt/docker/homepage/config:/app/config
      - /var/run/docker.sock:/var/run/docker.sock:ro  # Read-only for safety
    
    environment:
      - HOMEPAGE_ALLOWED_HOSTS=homepage.ljh31.de
    
    labels:
      - traefik.enable=true
      # Fixed rule syntax with parentheses
      - traefik.http.routers.homepage.rule=Host(`homepage.ljh31.de`)
      - traefik.http.routers.homepage.entrypoints=websecure
      - traefik.http.routers.homepage.tls.certresolver=letsencrypt
      # TLS is automatically enabled by certresolver, but explicit flag doesn't hurt
      - traefik.http.routers.homepage.tls=true
      - traefik.http.routers.homepage.middlewares=error-404@file,error-500@file
      - traefik.http.services.homepage.loadbalancer.server.port=3000
    networks:
      - infra-traefik_traefik-net  # 🔗 Attach here

networks:
  infra-traefik_traefik-net:
    external: true