# Managed by Ansible (nginx-proxy role)
services:
  certbot:
    image: {{ nginx_proxy_certbot_image }}
    container_name: {{ nginx_proxy_certbot_container }}
    volumes:
      - {{ nginx_proxy_certs_dir }}:/etc/letsencrypt
      - {{ nginx_proxy_scripts_dir }}:/scripts:ro
      - {{ nginx_proxy_domains_dir }}:/etc/cert-domains.d:ro
    environment:
      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
      CERTBOT_EMAIL: ${CERTBOT_EMAIL}
      CERTBOT_STAGING: "{{ '1' if nginx_proxy_certbot_staging | bool else '0' }}"
    entrypoint: /bin/sh
    command:
      - -c
      - |
        while true; do
          /scripts/certbot-init.sh || echo "issuance failed; will retry next cycle"
          certbot renew --quiet
          sleep 12h
        done
    restart: unless-stopped

  nginx:
    image: {{ nginx_proxy_nginx_image }}
    container_name: {{ nginx_proxy_nginx_container }}
    network_mode: host
    volumes:
      # Directory mounts (not single files) so Ansible's atomic file
      # replacement is visible inside the container.
      - {{ nginx_proxy_conf_dir }}:/etc/nginx/conf.d:ro
      - {{ nginx_proxy_certs_dir }}:/etc/nginx/certs:ro
    command:
      - /bin/sh
      - -c
      - |
        ( while :; do sleep {{ nginx_proxy_reload_interval }}; nginx -s reload; done ) &
        exec nginx -g 'daemon off;'
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/nginx-health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s