# HTTPS for FusionTerm with automatic certificates (Let's Encrypt, via Caddy).
# Used as an override next to docker-compose.yml — the installer sets it up
# when you run it with FUSIONTERM_DOMAIN=ft.example.com:
#
#   curl -fsSL https://fusionterm.com/install.sh | FUSIONTERM_DOMAIN=ft.example.com sh
#
# Or by hand, in the folder with docker-compose.yml:
#   1. Point a DNS name (A/AAAA record) at this server; open ports 80 and 443.
#   2. Save this file as docker-compose.override.yml and create .env with
#        FUSIONTERM_DOMAIN=ft.example.com
#   3. docker compose up -d
#
# What changes: Caddy answers on 80/443, gets and renews the certificate, and
# forwards to FusionTerm, which is no longer published on port 5577. The
# sign-in cookie is only sent over HTTPS and the client address comes from Caddy.
services:
  fusionterm:
    ports: !reset []
    environment:
      FORCE_SECURE_COOKIE: "true"
      TRUST_PROXY: "1"

  caddy:
    image: caddy:2.10.2
    restart: unless-stopped
    depends_on:
      - fusionterm
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    environment:
      FUSIONTERM_DOMAIN: ${FUSIONTERM_DOMAIN:?Set FUSIONTERM_DOMAIN in .env, e.g. ft.example.com}
    command: caddy reverse-proxy --from ${FUSIONTERM_DOMAIN} --to fusionterm:5577
    volumes:
      - caddy-data:/data
      - caddy-config:/config
    cap_drop: [ALL]
    cap_add: [NET_BIND_SERVICE]
    security_opt:
      - no-new-privileges:true
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  caddy-data:
  caddy-config: