docker-compose.prod.yml

# Production overlay — use with:
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
#
# To build from source instead of pulling published images:
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
#
# DNS required before first deploy:
#   demo.alon.systems     → <server public IP>
#   api.demo.alon.systems → <server public IP>

services:

  # ── Reverse proxy / TLS terminator ─────────────────────────────────────────
  caddy:
    image: caddy:2-alpine
    networks:
      sentinel_net:
        ipv4_address: 172.28.0.10
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - admin
      - api
    restart: unless-stopped

  # ── Remove public ports; enable trusted-proxy mode ─────────────────────────
  # api stays on the default network (postgres, worker, init) and sentinel_net
  # (caddy). TRUSTED_PROXY_IPS matches Caddy's fixed IP on sentinel_net.
  api:
    networks:
      default: {}
      sentinel_net: {}
    ports: !reset []
    environment:
      COOKIE_SECURE: "true"
      TRUST_PROXY_HEADERS: "true"
      TRUSTED_PROXY_IPS: "172.28.0.10"

  # admin only needs sentinel_net: caddy reaches it there, and its nginx
  # proxy_pass to api:3000 resolves via sentinel_net as well.
  admin:
    networks:
      sentinel_net: {}
    ports: !reset []

networks:
  sentinel_net:
    ipam:
      driver: default
      config:
        - subnet: "172.28.0.0/24"

volumes:
  caddy_data:
  caddy_config: