services:
  timelog:
    build:
      context: .
    image: timelog:latest
    container_name: timelog
    restart: unless-stopped

    environment:
      # Your domain, e.g. timelog.example.com — Caddy fetches a certificate for it.
      # Set to :80 instead if you terminate TLS on an upstream reverse proxy.
      SITE_ADDRESS: ${SITE_ADDRESS:?set SITE_ADDRESS in .env}
      # Used by Let's Encrypt for expiry warnings. Required: Caddy fails to parse
      # its config with an empty value, so this is checked here rather than
      # crash-looping the container.
      ACME_EMAIL: ${ACME_EMAIL:?set ACME_EMAIL in .env}

    ports:
      - "80:80" # required: the ACME HTTP challenge and the HTTPS redirect
      - "443:443"
      - "443:443/udp" # HTTP/3

    volumes:
      # Certificates live here. Without this volume Caddy re-issues on every
      # recreate and will hit the Let's Encrypt rate limit within a few restarts.
      - caddy_data:/data
      - caddy_config:/config

volumes:
  caddy_data:
  caddy_config: