services:
  web:
    build: .
    image: djnizz-website:latest
    container_name: djnizz-web
    restart: unless-stopped
    # Kein ports-Mapping: der Node-Prozess ist nur im internen Netz
    # erreichbar, nach aussen geht ausschliesslich Caddy.
    expose:
      - '4321'
    networks:
      - djnizz
    security_opt:
      - no-new-privileges:true

  caddy:
    image: caddy:2-alpine
    container_name: djnizz-caddy
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      - '443:443/udp' # HTTP/3
    environment:
      DOMAIN: ${DOMAIN:-djnizz.at}
      ACME_EMAIL: ${ACME_EMAIL:-business.djnizz@gmail.com}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data # Zertifikate - dieses Volume nicht loeschen
      - caddy_config:/config
      - caddy_logs:/var/log/caddy
    depends_on:
      - web
    networks:
      - djnizz
    security_opt:
      - no-new-privileges:true

volumes:
  caddy_data:
  caddy_config:
  caddy_logs:

networks:
  djnizz: