# Production stack (DOCKER_SPEC §2). Publishes no host ports — Traefik (the host's
# existing reverse proxy) discovers these containers on the shared traefik_proxy
# network via the labels below and routes cesnimda.co.uk to the site, and
# cesnimda.co.uk/api/contact to the relay. Entrypoint / cert-resolver names match
# the host Traefik convention; override via the .env values if they differ.

services:
  site:
    build:
      context: ../site
      dockerfile: Dockerfile
    image: git.cesnimda.uk/cesnimda/resumesite-site:latest
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /var/run
    networks: [proxy]
    labels:
      - traefik.enable=true
      - traefik.docker.network=${PROXY_NETWORK:-traefik_proxy}
      - traefik.http.routers.resumesite.rule=Host(`${SITE_HOST:-cesnimda.co.uk}`)
      - traefik.http.routers.resumesite.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure-external}
      - traefik.http.routers.resumesite.tls=true
      - traefik.http.services.resumesite.loadbalancer.server.port=8080
    logging:
      driver: json-file
      options: { max-size: '10m', max-file: '3' }

  relay:
    build:
      context: ../relay
      dockerfile: Dockerfile
    image: git.cesnimda.uk/cesnimda/resumesite-relay:latest
    restart: unless-stopped
    read_only: true
    environment:
      - Smtp__Host=${SMTP_HOST}
      - Smtp__Port=${SMTP_PORT:-587}
      - Smtp__User=${SMTP_USER}
      - Smtp__Password=${SMTP_PASSWORD}
      - Relay__FromAddress=${RELAY_FROM:-}
      - Relay__ToAddress=${RELAY_TO}
      - Relay__AllowedOrigin=${RELAY_ALLOWED_ORIGIN:-https://cesnimda.co.uk}
      - Relay__RateLimitPerWindow=${RELAY_RATE_LIMIT:-5}
      - Relay__WindowSeconds=${RELAY_WINDOW_SECONDS:-600}
    networks: [proxy]
    labels:
      - traefik.enable=true
      - traefik.docker.network=${PROXY_NETWORK:-traefik_proxy}
      # More specific rule than the site router, so /api/contact wins.
      - traefik.http.routers.resumerelay.rule=Host(`${SITE_HOST:-cesnimda.co.uk}`) && PathPrefix(`/api/contact`)
      - traefik.http.routers.resumerelay.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure-external}
      - traefik.http.routers.resumerelay.tls=true
      - traefik.http.services.resumerelay.loadbalancer.server.port=8081
    logging:
      driver: json-file
      options: { max-size: '10m', max-file: '3' }

networks:
  proxy:
    external: true
    name: ${PROXY_NETWORK:-traefik_proxy}