# proxy stack — Caddy reverse proxy / TLS terminator.
#
# Caddy is the single ingress for the whole estate. It joins only the shared
# `edge` network (owned by the management plane); every service it proxies also
# joins `edge`, so `reverse_proxy <service>:<port>` resolves by container name.
# This replaces Caddy's old membership in 11 separate per-stack networks.
#
# The Caddyfile itself is unchanged — upstreams are service names that resolve
# over edge. It is bind-mounted from /config/caddy/Caddyfile and hot-reloaded
# by the GitHub Actions runner on push (deploy.yml).
#
# serfriz/caddy-cloudflare-ddns bundles caddy-dns/cloudflare (DNS-01 ACME),
# caddy-cloudflare-ip (real client IPs behind CF), caddy-dynamicdns.

services:
  caddy:
    container_name: caddy
    image: serfriz/caddy-cloudflare-ddns:latest
    restart: unless-stopped
    networks:
      - edge
    ports:
      - "80:80"
      - "443:443"
    env_file:
      - stack.env
    environment:
      - CF_API_TOKEN=${CF_API_TOKEN}
    volumes:
      - /config/caddy/Caddyfile:/etc/caddy/Caddyfile
      - /config/caddy/site:/srv
      - /config/caddy/data:/data
      - /config/caddy/config:/config
      - /storage1/Books:/srv/Books
      # Pokémon ROM-hack library (box art + guides + spreadsheets), served
      # read-only and LAN-only by the romhacks-files.ginnoir.com site so the
      # Obsidian catalog notes can embed art and link guides.
      - /storage1/labdata/romhacks/library:/srv/romhacks:ro

networks:
  edge:
    name: edge
    external: true