# Production stack. The public-facing site is published on host port 1337 (put your
# TLS terminator / Cloudflare in front of it). nginx inside the site container proxies
# /api/contact to the relay over the internal network, so only one port is exposed.

services:
  site:
    build:
      context: ../site
      dockerfile: Dockerfile
    image: git.cesnimda.uk/cesnimda/resumesite-site:latest
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /var/run
    ports:
      - '${SITE_PORT:-1337}:1337'
    depends_on:
      - relay
    networks: [web]
    logging:
      driver: json-file
      options: { max-size: '10m', max-file: '3' }

  relay:
    build:
      context: ../relay
      dockerfile: Dockerfile
    image: git.cesnimda.uk/cesnimda/resumesite-relay:latest
    restart: unless-stopped
    read_only: true
    environment:
      - Smtp__Host=${SMTP_HOST:-}
      - Smtp__Port=${SMTP_PORT:-587}
      - Smtp__User=${SMTP_USER:-}
      - Smtp__Password=${SMTP_PASSWORD:-}
      - Relay__FromAddress=${RELAY_FROM:-}
      - Relay__ToAddress=${RELAY_TO:-connor.babbington@cesnimda.co.uk}
      - Relay__AllowedOrigin=${RELAY_ALLOWED_ORIGIN:-https://cesnimda.co.uk}
      - Relay__RateLimitPerWindow=${RELAY_RATE_LIMIT:-5}
      - Relay__WindowSeconds=${RELAY_WINDOW_SECONDS:-600}
    networks: [web]
    logging:
      driver: json-file
      options: { max-size: '10m', max-file: '3' }

networks:
  web:
    driver: bridge