services:
  timelog:
    build:
      context: .
    image: timelog:latest
    container_name: timelog
    restart: unless-stopped

    environment:
      # Your domain, e.g. timelog.example.com — Caddy fetches a certificate for it.
      # Set to :80 instead if you terminate TLS on an upstream reverse proxy.
      SITE_ADDRESS: ${SITE_ADDRESS:?set SITE_ADDRESS in .env}
      # Used by Let's Encrypt for expiry warnings. Required: Caddy fails to parse
      # its config with an empty value, so this is checked here rather than
      # crash-looping the container.
      ACME_EMAIL: ${ACME_EMAIL:?set ACME_EMAIL in .env}

    ports:
      - ${LISTEN_IP:?0.0.0.0}:80:80 # required: the ACME HTTP challenge and the HTTPS redirect
      - ${LISTEN_IP:?0.0.0.0}:443:443
      - ${LISTEN_IP:?0.0.0.0}:443:443/udp # HTTP/3

    volumes:
      # Certificates live here. Without this volume Caddy re-issues on every
      # recreate and will hit the Let's Encrypt rate limit within a few restarts.
      - ./caddy/data:/data
      - ./caddy/config:/config