Joplin Server —
Sync via HTTP, Web-UI via HTTPS

services:
  joplin:
    image: joplin/server:latest
    container_name: joplin
    restart: unless-stopped
    ports:
      # Auf Server-IP binden, nicht 127.0.0.1 !
      # Nginx auf Server1 muss von außen drauf zugreifen können
      - "10.0.1.83:22300:22300"
    environment:
      - APP_PORT=22300
      # APP_BASE_URL = URL die der Sync-Client einträgt
      # Muss exakt übereinstimmen — kein trailing slash, kein https!
      - APP_BASE_URL=http://203.0.113.10:22300
      - DB_CLIENT=pg
      - POSTGRES_PASSWORD=sicheres-passwort
      - POSTGRES_DATABASE=joplin
      - POSTGRES_USER=joplin
      - POSTGRES_PORT=5432
      - POSTGRES_HOST=joplin-db
    depends_on:
      - joplin-db

  joplin-db:
    image: postgres:16
    container_name: joplin-db
    restart: unless-stopped
    environment:
      - POSTGRES_PASSWORD=sicheres-passwort
      - POSTGRES_DATABASE=joplin
      - POSTGRES_USER=joplin
    volumes:
      - ./data/postgres:/var/lib/postgresql/data

networks:
  default:
    name: joplin-net

# VIP anlegen
config firewall vip
    edit "VIP-Joplin"
        set extip      203.0.113.10
        set extintf    "wan"
        set portforward enable
        set protocol   tcp
        set extport    22300
        set mappedip   10.0.1.83
        set mappedport 22300
    next
end

# Firewall Policy
config firewall policy
    edit 0
        set name     "Joplin-Sync"
        set srcintf  "wan"
        set dstintf  "lan"
        set srcaddr  "all"
        set dstaddr  "VIP-Joplin"
        set action   accept
        set service  "TCP_22300"
        set nat      disable
    next
end

server {
    listen 443 ssl;
    server_name joplin.local;

    ssl_certificate     /etc/nginx/certs/homelab.pem;
    ssl_certificate_key /etc/nginx/certs/homelab-key.pem;

    location / {
        proxy_pass         http://10.0.1.83:22300;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        # WebSocket für Echtzeit-Updates
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
    }
}

# Backup-Verzeichnis anlegen (einmalig)
# mkdir -p /opt/joplin/backups

# Täglich um 03:00 Uhr
0 3 * * * docker exec joplin-db pg_dump -U joplin joplin \
  > /opt/joplin/backups/joplin_$(date +\%Y\%m\%d).sql \
  && find /opt/joplin/backups -name "*.sql" -mtime +14 -delete