services:
  # Caddy
  caddy:
    #image: bensuperpc/caddy-l4:latest
    image: caddy:latest
    container_name: caddy
    profiles:
      - caddy
    depends_on:
      main_infrastructure:
        condition: service_completed_successfully
    restart: on-failure:7
    ports:
      - 80:80/tcp
      - 80:80/udp
      - 443:443/tcp
      - 443:443/udp
    volumes:
      - caddy_data:/data:rw
      - caddy_config:/config:rw
      - ./config:/etc/caddy:ro
      - wordpress:/var/www/html:rw
      - public_data:/public_data:ro

    networks:
      - caddy-infra
      - caddy-media
      - caddy-tools
      - caddy-files
      - caddy-dev
      - caddy-ai
      - caddy-web
    env_file:
      - ./env/caddy.env
    environment:
      - TZ=${TZ:-Europe/Paris}
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: pidof caddy || exit 1
      interval: 120s
      timeout: 10s
      retries: 3

  caddy_backup:
    image: mazzolino/restic:latest
    container_name: caddy_backup
    profiles:
      - caddy
    depends_on:
      - caddy
    restart: on-failure:7
    env_file:
      - ./env/caddy_backup.env
    environment:
      - TZ=${TZ:-Europe/Paris}
    volumes:
      - caddy_backup:/mnt/restic
      - caddy_data:/data:ro
    network_mode: none
    cap_drop:
      - NET_ADMIN
      - NET_RAW
      - SYS_ADMIN

volumes:
  caddy_data:
    name: caddy_data
  caddy_config:
    name: caddy_config
  caddy_backup:
    name: caddy_backup
  wordpress:
    name: wordpress
  public_data:
    name: public_data

networks:
  caddy-infra:
    driver: bridge
    name: caddy-infra
  caddy-media:
    driver: bridge
    name: caddy-media
  caddy-tools:
    driver: bridge
    name: caddy-tools
  caddy-files:
    driver: bridge
    name: caddy-files
  caddy-dev:
    driver: bridge
    name: caddy-dev
  caddy-ai:
    driver: bridge
    name: caddy-ai
  caddy-web:
    driver: bridge
    name: caddy-web
