version: "3.9"

networks:
  traefik_proxy:
    external: true
  wp_net:
    external: false

services:
  wp_db:
    image: mariadb:11
    container_name: wordpress_db
    restart: unless-stopped
    networks:
      - wp_net
    environment:
      - MYSQL_ROOT_PASSWORD=change_root_password
      - MYSQL_DATABASE=wordpress
      - MYSQL_USER=wpuser
      - MYSQL_PASSWORD=change_wp_password
    volumes:
      - ./db:/var/lib/mysql

  wordpress:
    image: wordpress:latest
    container_name: wordpress_app
    restart: unless-stopped
    networks:
      - traefik_proxy
      - wp_net
    environment:
      - WORDPRESS_DB_HOST=wp_db:3306
      - WORDPRESS_DB_NAME=wordpress
      - WORDPRESS_DB_USER=wpuser
      - WORDPRESS_DB_PASSWORD=change_wp_password

      - WORDPRESS_HOME=https://example.com/wp
      - WORDPRESS_SITEURL=https://example.com/wp
    volumes:
      - ./wp:/var/www/html
    labels:
      - "traefik.enable=true"

      # HTTPS router for /wp
      - "traefik.http.routers.wp-https.rule=Host(`example.com`) && PathPrefix(`/wp`)"
      - "traefik.http.routers.wp-https.entrypoints=websecure"
      - "traefik.http.routers.wp-https.tls.certresolver=letsencrypt"
      - "traefik.http.routers.wp-https.priority=10"
      # Uncomment to require Authelia before WP
      # - "traefik.http.routers.wp-https.middlewares=authelia-auth@file"