version: '3.8'

# Caddy Reverse Proxy for Homelab Services
# Location: /srv/docker/caddy/docker-compose.yml
# Last Updated: April 27, 2026
#
# This service acts as a reverse proxy and HTTPS termination point for internal services
# Routes requests to appropriate backends and handles TLS encryption

services:
  caddy:
    image: caddy:latest
    container_name: caddy
    restart: unless-stopped

    # Network ports
    ports:
      # Port 80: HTTP (redirects to HTTPS)
      - "80:80"
      # Port 443: HTTPS (main service port)
      - "443:443"

    # Volume mounts
    volumes:
      # Configuration file (read-only to prevent accidental modification)
      - ./Caddyfile:/etc/caddy/Caddyfile:ro

      # Persistent storage for certificates and configuration
      # These volumes survive container restarts and updates
      - caddy_data:/data
      - caddy_config:/config

      # Log directory (optional, for debugging)
      - ./logs:/var/log/caddy

    # Environment variables
    environment:
      # ACME server for Let's Encrypt (public domain setup)
      # For internal use, Caddy will generate self-signed certificates
      CADDY_ACME_CA: "https://acme-v02.api.letsencrypt.org/directory"

      # Email for Let's Encrypt renewal notifications (optional, for public domains)
      CADDY_ACME_EMAIL: "jgitta@jgitta.com"

    # Network connectivity
    networks:
      - docker_network

    # Container labels for identification and monitoring
    labels:
      com.example.description: "Caddy reverse proxy for homelab services"
      com.example.version: "latest"

    # Health check - ensures container is working
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:80"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

    # Container logging
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "caddy=true"

# Named volumes for persistent data
volumes:
  # Certificate storage (TLS certificates, whether self-signed or Let's Encrypt)
  caddy_data:
    driver: local

  # Configuration storage (Caddy internal config and metadata)
  caddy_config:
    driver: local

# Network definition
networks:
  docker_network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

# Usage Instructions:
#
# Start the service:
#   cd /srv/docker/caddy
#   docker-compose up -d
#
# Check status:
#   docker-compose ps
#
# View logs:
#   docker-compose logs -f caddy
#
# Reload configuration (no downtime):
#   docker-compose restart caddy
#
# Stop the service:
#   docker-compose down
#
# Update to latest Caddy version:
#   docker-compose pull
#   docker-compose up -d