# Automatic HTTPS on your own domain, on top of docker-compose.yml.
#
#   echo "DOMAIN=secret.example.com" > .env
#   docker compose -f docker-compose.yml -f docker-compose.tls.yml up -d
#
# Point the domain at this host first: Caddy answers an ACME challenge on ports
# 80 and 443 to obtain the certificate.

services:
  app:
    # Only Caddy is published; the app is reached over the compose network.
    ports: !reset []
    environment:
      - APP_URL=https://${DOMAIN:?set DOMAIN in .env}
      # Caddy, one hop in front, appends the client's address.
      - ADDRESS_HEADER=X-Forwarded-For
      - XFF_DEPTH=1

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    command: caddy reverse-proxy --from ${DOMAIN:?set DOMAIN in .env} --to app:3000
    ports:
      - "80:80"
      - "443:443"
    volumes:
      # Certificates. Without this volume, every restart asks Let's Encrypt for
      # new ones and hits its rate limits.
      - caddy-data:/data
    depends_on:
      - app

volumes:
  caddy-data: