{% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
  {% set service_name = NEXTCLOUD_PROXY_SERVICE %}
  {{ service_name }}:
    {% include 'roles/sys-svc-container/templates/deploy.yml.j2' %}
    {{ lookup('container_image', application_id, 'proxy') }}
    {{ lookup('compose_only', 'container_name', NEXTCLOUD_PROXY_CONTAINER) }}
    logging:
      driver: journald
    {{ lookup('compose_restart') }}
    {{ lookup('container_ports', ['nextcloud', 'http', DOCKER_BIND_HOST]) | indent(4) }}
    {{ lookup('container_volumes', service_name) | indent(4) }}
    {{ lookup('container_healthcheck', service_name, samples=(groups[application_id] | default([]) | length) if DEPLOYMENT_MODE == 'swarm' else 1) | indent(4) }}
    {{ lookup('container_networks') | indent(4) }}
    {{ lookup('container_extra_hosts', extra_hosts=(
         ['host.docker.internal:host-gateway'] if NEXTCLOUD_HPB_NETWORK_MODE == 'host' else []
       )) | indent(4) }}

  {% set service_name = NEXTCLOUD_SERVICE %}
  {% set container_healthcheck_start_period = '20m' %}
  {{ service_name }}:
    {{ lookup('container_image', application_id, 'nextcloud') }}
    {{ lookup('compose_only', 'container_name', NEXTCLOUD_CONTAINER) }}
    {{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}

    {{ lookup('container_volumes', service_name) | indent(4) }}
    {% if DEPLOYMENT_MODE == 'swarm' %}
    environment:
      TASK_SLOT: "{% raw %}{{.Task.Slot}}{% endraw %}"
    {% endif %}
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "{{ (not NETWORK_IPV6_ENABLED | bool) | int }}"
    healthcheck:
      test: ["CMD", "su", "{{ NEXTCLOUD_DOCKER_USER }}", "-s", "/bin/sh", "-c", "php -r 'exit(@fsockopen(\"127.0.0.1\", {{ NEXTCLOUD_FPM_PORT }}) ? 0 : 1);' && php {{ NEXTCLOUD_INTERNAL_OCC_COMMAND }} status"]
      # nocheck: healthcheck-timing-override  occ boots the whole Nextcloud stack per probe, so it stays off a 30s loop
      interval: 1m
      # nocheck: healthcheck-timing-override  occ regularly needs more than the 5s default to answer
      timeout: 30s
      retries: 10
      # nocheck: healthcheck-timing-override  a role variable the linter cannot compare, tuned per deployment size
      start_period: {{ container_healthcheck_start_period }}
      start_interval: 5s
    {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
    {{ lookup('container_extra_hosts') | indent(4) }}
    {{ lookup('container_depends_on', application_id) | indent(4) }}
    {{ lookup('container_networks', provider_self_alias=False) | indent(4) }}

  {% if NEXTCLOUD_MCP_ENABLED | bool %}
  {% set service_name = NEXTCLOUD_CONTEXT_AGENT_SERVICE %}
  {% set container_port = NEXTCLOUD_CONTEXT_AGENT_PORT %}
  {{ service_name }}:
    {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
    {{ lookup('container_image', application_id, 'context_agent') }}
    {{ lookup('compose_only', 'container_name', NEXTCLOUD_CONTEXT_AGENT_CONTAINER) }}
    environment:
      APP_ID: {{ NEXTCLOUD_CONTEXT_AGENT_SERVICE }}
      APP_VERSION: "{{ NEXTCLOUD_CONTEXT_AGENT_VERSION }}"
      APP_HOST: 0.0.0.0
      APP_PORT: "{{ container_port }}"
      APP_SECRET: "{{ NEXTCLOUD_CONTEXT_AGENT_SECRET }}"
      NEXTCLOUD_URL: "{{ NEXTCLOUD_CONTEXT_AGENT_NEXTCLOUD_URL }}"
    {{ lookup('container_healthcheck', service_name) | indent(4) }}
    expose:
      - "{{ container_port }}"
    {{ lookup('container_networks', provider_self_alias=False) | indent(4) }}
  {% endif %}

  {% if NEXTCLOUD_HPB_SIGNALING_ENABLED | bool %}
  {% set service_name = NEXTCLOUD_HPB_SERVICE %}
  {% set container_port = NEXTCLOUD_HPB_SIGNALING_PORT %}
  {{ service_name }}:
    {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
    {{ lookup('container_healthcheck', service_name) | indent(4) }}
    {{ lookup('container_image', application_id, 'talk') }}
    {{ lookup('compose_only', 'container_name', NEXTCLOUD_HPB_CONTAINER) }}
    init: true
    {% if NEXTCLOUD_HPB_NETWORK_MODE == 'bridge' %}
    {% if NEXTCLOUD_HPB_TURN_ONBOARD_ENABLED | bool and NEXTCLOUD_HPB_TURN_ONBOARD_PUBLISH_PORTS | bool %}
    {{ lookup('container_ports',
              {'service': 'nextcloud', 'protocol': 'stun_turn',
               'ip': NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST,
               'transport': ['tcp', 'udp'], 'container': 'same'},
              {'service': 'nextcloud', 'protocol': 'relay',
               'ip': NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST,
               'transport': ['udp', 'tcp'], 'container': 'same'}) | indent(4) }}
    {% endif %}
    expose:
      - "{{ container_port }}"
    {{ lookup('container_networks', provider_self_alias=False) | indent(4) }}
    {% else %}
    network_mode: {{ NEXTCLOUD_HPB_NETWORK_MODE }}
    {% endif %}
  {% endif %}

  {% if NEXTCLOUD_WHITEBOARD_ENABLED %}
  {% set service_name = NEXTCLOUD_WHITEBOARD_SERVICE %}
  {% set container_port = NEXTCLOUD_WHITEBOARD_PORT_INTERNAL %}
  {{ service_name }}:
    {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
    build:
      context: .
      dockerfile: {{ NEXTCLOUD_WHITEBOARD_SERVICE_DOCKERFILE }}
    {{ lookup('compose_only', 'pull_policy', 'never') }}
    {{ lookup('container_image', application_id, 'whiteboard') }}
    {{ lookup('container_healthcheck', service_name) | indent(4) }}
    {{ lookup('compose_only', 'container_name', NEXTCLOUD_WHITEBOARD_CONTAINER) }}
    {{ lookup('container_volumes', service_name) | indent(4) }}
    environment:
      - NODE_OPTIONS=--max-old-space-size={{ NEXTCLOUD_WHITEBOARD_MAX_OLD_SPACE_SIZE }}
    expose:
      - "{{ container_port }}"
    shm_size: 1g
    {{ lookup('container_networks', provider_self_alias=False) | indent(4) }}
    {%+ if lookup('engine', 'redis', application_id, 'local') %}{{ lookup('depends_on', {'redis': 'service_healthy'}) }}{% endif %}
  {% endif %}


  {% set service_name = NEXTCLOUD_CRON_SERVICE %}
  {{ service_name }}:
    {% include 'roles/sys-svc-container/templates/deploy.yml.j2' %}
    {{ lookup('compose_only', 'container_name', NEXTCLOUD_CRON_CONTAINER) }}
    {{ lookup('container_image', application_id, 'nextcloud') }}
    {{ lookup('compose_restart') }}
    logging:
      driver: journald
    {{ lookup('container_volumes', service_name) | indent(4) }}
    entrypoint: /cron.sh
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "{{ (not NETWORK_IPV6_ENABLED | bool) | int }}"
    healthcheck:
      test: ["CMD", "su", "{{ NEXTCLOUD_DOCKER_USER }}", "-s", "/bin/sh", "-c", "php {{ NEXTCLOUD_INTERNAL_OCC_COMMAND }} status"]
      # nocheck: healthcheck-timing-override  occ boots the whole Nextcloud stack per probe, so it stays off a 30s loop
      interval: 1m
      # nocheck: healthcheck-timing-override  occ regularly needs more than the 5s default to answer
      timeout: 30s
      retries: 10
      # nocheck: healthcheck-timing-override  a role variable the linter cannot compare, tuned per deployment size
      start_period: {{ container_healthcheck_start_period }}
      start_interval: 5s
    {{ lookup('container_depends_on', application_id) | indent(4) }}
    {{ lookup('container_networks', provider_self_alias=False) | indent(4) }}

  {% if NEXTCLOUD_RECORDING_ENABLED | bool %}
  {% set service_name = 'talk_recording' %}
  {{ service_name }}:
    {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
    {{ lookup('container_image', application_id, 'talk_recording') }}
    {{ lookup('compose_only', 'container_name', NEXTCLOUD_RECORDING_CONTAINER) }}
    environment:
      - HPB_DOMAIN={{ NEXTCLOUD_HPB_DOMAIN }}
      - NC_DOMAIN={{ NEXTCLOUD_DOMAIN }}
      - RECORDING_SECRET={{ NEXTCLOUD_RECORDING_SECRET }}
      - INTERNAL_SECRET={{ NEXTCLOUD_HPB_INTERNAL_SECRET }}
      - TZ={{ HOST_TIMEZONE }}
    expose:
      - "{{ NEXTCLOUD_RECORDING_PORT }}"
    {{ lookup('container_networks', provider_self_alias=False) | indent(4) }}
    {{ lookup('container_volumes', service_name) | indent(4) }}
  {% endif %}

  {% if NEXTCLOUD_MCP_ENABLED | bool %}
  {% set service_name = NEXTCLOUD_MCP_ADAPTER_SERVICE %}
  {% set container_port = NEXTCLOUD_MCP_ADAPTER_PORT %}
  {% set docker_compose_env = [NEXTCLOUD_MCP_ADAPTER_INSTANCE_DIR, 'upstream.env'] | path_join %}
  {{ service_name }}:
    {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
    {{ lookup('container_image', application_id, NEXTCLOUD_MCP_ADAPTER_SERVICE) }}
    build:
      context: {{ NEXTCLOUD_MCP_ADAPTER_INSTANCE_DIR }}
      dockerfile: Dockerfile
      args:
        MCP_ADAPTER_BASE_IMAGE: {{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_MCP_ADAPTER_SERVICE ~ '.image') }}
        MCP_ADAPTER_BASE_VERSION: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_MCP_ADAPTER_SERVICE ~ '.version') }}"
    {{ lookup('compose_only', 'container_name', NEXTCLOUD_MCP_ADAPTER_CONTAINER) }}
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    environment:
      ADAPTER_CONTRACT: {{ NEXTCLOUD_MCP_ADAPTER_CONTRACT | to_json | to_json | replace('$', '$$') }}
      ADAPTER_BEARER: {{ NEXTCLOUD_MCP_ADAPTER_BEARER | to_json }}
      ADAPTER_PORT: "{{ container_port }}"
    {{ lookup('container_healthcheck', service_name) | indent(4) }}
    expose:
      - "{{ container_port }}"
    {{ lookup('container_networks', own_network_only=True, provider_self_alias=False) | indent(4) }}
  {% endif %}

{{ lookup('compose_volumes', extra_volumes=lookup('nextcloud_extra_volumes')) }}

{{ lookup('compose_networks') }}