version: '3.8'

services:
  odoo:
    image: odoo:17
    container_name: odoo
    restart: unless-stopped
    networks:
      - traefik-public
      - database-internal
    environment:
      - HOST=postgres-main
      - PORT=5432
      - USER=odoo_user
      - PASSWORD=aeK3HvEL8E7pkic898XII4vCCyioM8yu
    volumes:
      - odoo-data:/var/lib/odoo
      - odoo-addons:/mnt/extra-addons
      - /opt/03-business/odoo/odoo.conf:/etc/odoo/odoo.conf:ro
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-public"
      
      # Mobile API router without Authelia (highest priority) - more permissive
      - "traefik.http.routers.odoo-api.rule=Host(`odoo.ai-impress.com`) && (PathPrefix(`/xmlrpc`) || PathPrefix(`/jsonrpc`) || PathPrefix(`/web/session`) || PathPrefix(`/web/database`) || PathPrefix(`/web/webclient`)|| Path(`/web/login`))"
      - "traefik.http.routers.odoo-api.entrypoints=websecure"
      - "traefik.http.routers.odoo-api.tls.certresolver=cloudflare"
      - "traefik.http.routers.odoo-api.priority=100"
      
      # Main router with Authelia for web access (lower priority)
      - "traefik.http.routers.odoo.rule=Host(`odoo.ai-impress.com`)"
      - "traefik.http.routers.odoo.entrypoints=websecure"
      - "traefik.http.routers.odoo.tls.certresolver=cloudflare"
      - "traefik.http.routers.odoo.middlewares=authelia@file"
      - "traefik.http.routers.odoo.priority=1"
      
      - "traefik.http.services.odoo.loadbalancer.server.port=8069"

volumes:
  odoo-data:
  odoo-addons:

networks:
  traefik-public:
    external: true
  database-internal:
    external: true
