# Single-service Docker Compose for ui.suaveplan.com.
#
# The Caddy container serves /srv/registry from the OVH host as
# read-only. Cert state survives container restarts via the named
# `caddy_data` and `caddy_config` volumes — restarting the container
# does NOT trigger an ACME re-issuance.
#
# Usage on the OVH host:
#   cp .env.example .env  # fill in placeholder values if any deploy
#                         # script reads them; runtime needs none.
#   docker compose up -d
#
# Verify:
#   curl -fsSL https://ui.suaveplan.com/health  # → "ok"
#   docker compose ps                            # status: healthy

services:
  registry:
    build:
      context: .
      dockerfile: Dockerfile
    image: suaveplan/registry:latest
    container_name: suaveplan-registry
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      # Static content tree — populated by the GitHub Actions deploy
      # job via rsync. Read-only inside the container; Caddy never
      # mutates the served files.
      - /srv/registry:/srv/registry:ro
      # Cert state and config cache. Persists across container
      # rebuilds so Let's Encrypt isn't re-hit on every deploy.
      - caddy_data:/data
      - caddy_config:/config
    environment:
      # No secrets here. ACME contact email is baked into Caddyfile.
      TZ: UTC
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O- --no-check-certificate https://127.0.0.1/health | grep -q '^ok$$' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"

volumes:
  caddy_data:
    name: suaveplan_registry_caddy_data
  caddy_config:
    name: suaveplan_registry_caddy_config