services:
  certmate:
    build:
      context: .
      args:
        REQUIREMENTS_FILE: requirements.txt
        # Optional extras layered on top of the main requirements.
        # Accepts a SPACE-SEPARATED list of requirements files so one
        # image can carry both DNS plugins and remote storage backends.
        # Set in .env to bake them in at image build time, e.g.:
        #   EXTRA_REQUIREMENTS=requirements-azure.txt requirements-storage-all.txt
        #   EXTRA_REQUIREMENTS=requirements-storage-all.txt
        #   EXTRA_REQUIREMENTS=requirements-aws.txt requirements-gcp.txt
        # Defaults to empty (skipped).
        EXTRA_REQUIREMENTS: ${EXTRA_REQUIREMENTS:-}
    # Uncomment to use pre-built multi-platform image instead of building locally:
    # image: YOUR_DOCKERHUB_USERNAME/certmate:latest
    # platform: linux/amd64  # Optional: force specific platform (linux/amd64, linux/arm64)
    container_name: certmate
    ports:
      - "127.0.0.1:8000:8000"  # Bind to localhost only; use nginx profile for external access
    environment:
      - FLASK_ENV=production
      - SECRET_KEY=${SECRET_KEY:-}  # Auto-generated if empty; set a strong value for production
      # - SECRET_KEY_FILE=${SECRET_KEY_FILE:-}  # Alternative: path to a file containing the secret key
      - CLOUDFLARE_TOKEN=${CLOUDFLARE_TOKEN}
      - API_BEARER_TOKEN=${API_BEARER_TOKEN:-}  # Auto-generated if empty; set a strong value for production
      #- API_BEARER_TOKEN_FILE=${API_BEARER_TOKEN_FILE:-}  # Alternative: path to a file containing the bearer token
      - BEHIND_PROXY=${BEHIND_PROXY:-false}  # Set true when CertMate runs behind nginx or another trusted reverse proxy
      - PORT=${PORT:-8000}                      # Internal listen port; also update ports: mapping if changed
      - GUNICORN_TIMEOUT=${GUNICORN_TIMEOUT:-300}  # Worker timeout; increase for slow DNS providers
      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL:-}    # Overrides the email set via the web UI when set
    volumes:
      - ./certificates:/app/certificates:rw
      - ./logs:/app/logs:rw
      - ./data:/app/data:rw
      - ./backups:/app/backups:rw
    restart: unless-stopped
    cap_drop:
      - ALL
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1.0'
        reservations:
          memory: 128M
    healthcheck:
      test: ["CMD", "sh", "-c", "curl -f http://localhost:${PORT:-8000}/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Optional: Add nginx reverse proxy
  nginx:
    image: nginx:alpine
    container_name: certmate-nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certificates:/etc/nginx/ssl:ro
    depends_on:
      certmate:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:80/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    restart: unless-stopped
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
    profiles:
      - nginx

networks:
  default:
    name: certmate_network