docker-compose.https.yml

# HTTPS overlay — layer on top of docker-compose.yml:
#
#   docker compose -f docker-compose.yml -f docker-compose.https.yml up -d
#
# Prerequisites:
#   1. Set DOMAIN in your .env file (e.g. DOMAIN=confdex.example.com)
#   2. Point your domain's DNS A record to this server's public IP
#   3. Open ports 80 and 443 on your firewall / router
#   4. Run once to issue the certificate (see README for the exact command)

services:
  # ConfDex no longer exposes port 8000 directly — Nginx is the only entry point
  confdex:
    ports: !reset []
    environment:
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}

  nginx:
    image: nginx:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/default.conf.template:/etc/nginx/templates/default.conf.template:ro
      - certbot_www:/var/www/certbot:ro
      - certbot_certs:/etc/letsencrypt:ro
    # Only substitute ${DOMAIN} — leave nginx's own $variables untouched
    command: >
      /bin/sh -c "
        envsubst '$$DOMAIN' < /etc/nginx/templates/default.conf.template
          > /etc/nginx/conf.d/default.conf &&
        nginx -g 'daemon off;'
      "
    environment:
      - DOMAIN=${DOMAIN}
    depends_on:
      - confdex

  certbot:
    image: certbot/certbot
    restart: unless-stopped
    volumes:
      - certbot_www:/var/www/certbot
      - certbot_certs:/etc/letsencrypt
    # Auto-renew every 12 hours
    entrypoint: >
      /bin/sh -c "trap exit TERM;
        while :; do certbot renew; sleep 12h & wait $${!}; done"

volumes:
  certbot_www:
  certbot_certs: