# cadprox - web UI for the Caddy reverse proxy configuration
#
# network_mode: host is required, not stylistic. The Caddy admin API listens on
# 127.0.0.1:2019 on the host loopback and Caddy itself is in host mode, so this
# is the only way cadprox can reach it to hot-reload without restarting Caddy.
#
# The Caddyfile is mounted read-write because cadprox is the writer. Caddy keeps
# its own read-only mount, so a cadprox edit does not disturb the running
# container until the admin API accepts the new config.

services:
  cadprox:
    build: .
    image: cadprox:1.0
    container_name: cadprox
    restart: unless-stopped
    network_mode: host

    volumes:
      # The managed Caddyfile. Read-write: cadprox writes it, Caddy reads it.
      - /home/bdm/caddy:/caddy
      # Audit log and runtime state. The generated admin credential is not
      # written here any more, because the password now comes from the file
      # below; this directory is kept for the audit log and for the fallback
      # path if CADPROX_ADMIN_PASSWORD_FILE is ever removed.
      - ./data:/data
      # The admin password, kept out of this file so it never appears in
      # `docker inspect` output or in version control. Read-only.
      - ./CADPRox_Secrets:/run/secrets/cadprox-admin:ro

    environment:
      CADPROX_CADDYFILE: /caddy/Caddyfile
      CADPROX_CADDY_ADMIN: http://127.0.0.1:2019
      CADPROX_CADDY_BIN: caddy
      CADPROX_DATA: /data
      # The UI port. cadprox listens on the host network, so this binds 0.0.0.0
      # of the host directly. It is set here explicitly so the value is
      # visible in `docker compose config`.
      #
      # This deliberately does NOT appear in the PORTS column of `docker ps`:
      # publishing a port requires bridge networking, and bridge networking
      # cannot reach Caddy's admin API on 127.0.0.1:2019. Docker also discards
      # a "ports:" entry under host mode with only a warning, so adding one
      # would look like a mapping that is not there. The port is plain HTTP on
      # the LAN - do not forward it to the internet.
      CADPROX_PORT: "8090"
      CADPROX_ADMIN_USER: admin
      # Read from CADPRox_Secrets, mounted above at /run/secrets/cadprox-admin.
      CADPROX_ADMIN_PASSWORD_FILE: /run/secrets/cadprox-admin