services:
  mail:
    image: ghcr.io/docker-mailserver/docker-mailserver:latest
    hostname: mail.sendico.io
    environment:
      - MAIL_DOMAIN=sendico.io
      - MAIL_HOSTNAME=mail
      - MAIL_FQDN=mail.sendico.io
      - SSL_TYPE=letsencrypt
    env_file: .env
    volumes:
      - /srv/infra/compose/mail/data:/var/mail
      - /srv/infra/compose/mail/state:/var/mail-state
      - /srv/infra/compose/mail/logs:/var/log/mail
      - /srv/infra/compose/mail/config:/tmp/docker-mailserver
      - traefik_letsencrypt:/etc/letsencrypt:ro       # 👈 общие сертификаты Traefik
    ports:
      - target: 25
        published: 25
        protocol: tcp
        mode: host
      - target: 465
        published: 465
        protocol: tcp
        mode: host
      - target: 587
        published: 587
        protocol: tcp
        mode: host
      - target: 993
        published: 993
        protocol: tcp
        mode: host
    cap_add:
      - NET_ADMIN
      - SYS_PTRACE
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.hostname == infra
    stop_grace_period: 1m
    networks:
      - cicd

  webmail:
    image: djmaze/snappymail:latest
    depends_on:
      - mail
    environment:
      SNAPPYMAIL_DEFAULT_HOST: mail.sendico.io
      SNAPPYMAIL_DEFAULT_PORT: 993
      SNAPPYMAIL_SMTP_SERVER: mail.sendico.io
      SNAPPYMAIL_SMTP_PORT: 587
      SNAPPYMAIL_SMTP_SECURE: "STARTTLS"
    volumes:
      - webmail_data:/var/lib/snappymail
    networks:
      - cicd
    ports:
      - "8088:80"
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.hostname == infra
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.webmail.rule=Host(`webmail.sendico.io`)"
        - "traefik.http.routers.webmail.entrypoints=websecure"
        - "traefik.http.routers.webmail.tls.certresolver=letsencrypt"
        - "traefik.http.services.webmail.loadbalancer.server.port=8888"

networks:
  cicd:
    external: true

volumes:
  webmail_data:
  traefik_letsencrypt:
    external: true