# The public entry point. nginx-proxy watches the Docker socket and writes a
# vhost for every container that sets VIRTUAL_HOST; acme-companion requests and
# renews the certificate for every LETSENCRYPT_HOST.
#
# Two things about this stack drive decisions elsewhere in the repository:
#
#   - proxy-net is external. Every stack that wants to be reachable joins it, so
#     something has to create it before any of them start. That is stack_networks
#     in the role, and it is why site.yml deploys this stack first.
#   - conf/, vhost/ and html/ are bind mounts holding plain files. Editing one
#     changes nothing until nginx reloads, because Compose sees an unchanged
#     compose file and does not recreate the container. That is what
#     compose_stack_synced and the post_tasks reload are for.
services:
  reverse-proxy:
    container_name: reverse-proxy
    image: nginxproxy/nginx-proxy:1.6
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./proxy-data/conf:/etc/nginx/conf.d
      - ./proxy-data/vhost:/etc/nginx/vhost.d
      - ./proxy-data/html:/usr/share/nginx/html
      - ./proxy-data/dhparam:/etc/nginx/dhparam
      - ./proxy-data/certs:/etc/nginx/certs:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - proxy-net

  acme-companion:
    container_name: reverse-proxy-acme
    image: nginxproxy/acme-companion:2.4
    restart: unless-stopped
    volumes_from:
      - reverse-proxy
    volumes:
      - ./proxy-data/certs:/etc/nginx/certs
      - ./proxy-data/acme:/etc/acme.sh
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      # Let's Encrypt sends expiry warnings here.
      DEFAULT_EMAIL: admin@example.com
    networks:
      - proxy-net

networks:
  proxy-net:
    external: true