name: nereus-web

services:
  web:
    build:
      context: ..
      dockerfile: build/web.Dockerfile
      args:
        WEB_ASSET_PATH: ${WEB_ASSET_PATH:-apps/web}
    environment:
      CLUSTER_API_UPSTREAM: ${CLUSTER_API_UPSTREAM:?set CLUSTER_API_UPSTREAM to the cluster host and port}
    read_only: true
    tmpfs:
      - /etc/nginx/conf.d:size=1m,uid=101,gid=101,mode=0755
      - /tmp:size=16m,mode=1777
      - /var/cache/nginx:size=16m,mode=0755
    security_opt:
      - no-new-privileges:true
    labels:
      - traefik.enable=true
      - traefik.http.routers.nereus-web.rule=Host(`${WEB_HOST:-nereus.fiwlabs.dev}`)
      - traefik.http.routers.nereus-web.entrypoints=websecure
      - traefik.http.routers.nereus-web.tls=true
      - traefik.http.routers.nereus-web.tls.certresolver=porkbun
      - traefik.http.services.nereus-web.loadbalancer.server.port=8080
      - traefik.docker.network=proxy
    networks:
      - proxy
    restart: unless-stopped

networks:
  proxy:
    external: true