version: '3.7'

services:
  proxy:
    build:
      context: ./proxy
      args:
        USER_UID: ${UID_PROXY:-12001}
        GROUP_UID: ${UID_PROXY:-12001}
    env_file:
      - ./certbot/files/domains.env
    restart: always
    image: proxy
    container_name: proxy
    ports:
      - "80:8080"
      - "443:8443"
    restart: always
    networks:
      - service_kweb
    volumes:
      # cert volume
      - proxy_ssl:/service/ssl:ro
      # /.well-known/acme-challenge/ volume
      - proxy_certbot:/service/html/certbot:ro
  
  certbot:
    depends_on:
      - proxy
    build:
      context: ./certbot
      args:
        USER_UID: ${UID_CERTBOT:-12002}
        GROUP_UID: ${UID_PROXY:-12002}
    env_file:
      - ./certbot/files/domains.env
      - ./production.env # set PRODUCTION= here
    restart: always
    image: certbot
    container_name: certbot
    restart: always
    volumes:
      # cert volume
      - proxy_ssl:/service/ssl:rw
      # /.well-known/acme-challenge/ volume (webroot)
      - proxy_certbot:/service/html:rw
      # certbot directories
      - certbot_ssl:/service/letsencrypt/ssl:rw
      - certbot_work:/service/letsencrypt/work:rw
      - certbot_logs:/service/letsencrypt/log:rw

  # TODO: put this in its own docker-compose
  # as the proxy does not require it
  kweb:
    build:
      context: ./kweb
      args:
        USER_UID: ${UID_KWEB:-12003}
        GROUP_UID: ${UID_KWEB:-12003}
    restart: always
    image: kweb
    container_name: kweb
    restart: always
    networks:
      - service_kweb
    volumes:
      - service_kweb:/service/html:ro

volumes:
  # proxy volumes
  proxy_ssl:
    name: proxy_ssl
  proxy_certbot:
    name: proxy_certbot
  proxy_www:
    name: proxy_www
  # certbot volumes
  certbot_ssl:
    name: certbot_ssl
  certbot_work:
    name: certbot_work
  certbot_logs:
    name: certbot_logs
  # service volumes
  service_kweb:
    name: service_kweb

networks:
  service_kweb:
    name: service_kweb