# Rendered by the provisioning CLI (Phase 4). WordPress always has a database.
# Uses the official WordPress php-fpm image; nginx serves it and proxies PHP.
name: {{ slug }}

services:
  nginx:
    image: {{ nginx_image }}
    container_name: {{ slug }}_nginx
    restart: unless-stopped
    depends_on: [fpm]
    volumes:
      - {{ webroot }}:/var/www/html:ro
      - ./nginx-site.conf:/etc/nginx/conf.d/default.conf:ro
    networks: [proxy, site]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.{{ slug }}.rule=Host(`{{ domains | join('`) || Host(`') }}`)"
      - "traefik.http.routers.{{ slug }}.entrypoints=websecure"
      - "traefik.http.routers.{{ slug }}.tls.certresolver=le"
      - "traefik.http.routers.{{ slug }}.middlewares=security-headers@file"
      - "traefik.http.services.{{ slug }}.loadbalancer.server.port=80"
    deploy:
      resources:
        limits:
          cpus: "{{ resources.cpu }}"
          memory: {{ resources.memory }}

  fpm:
    image: {{ wordpress_image }}
    container_name: {{ slug }}_fpm
    restart: unless-stopped
    env_file: [.env]
    environment:
      WORDPRESS_DB_HOST: mariadb
      WORDPRESS_DB_NAME: db_{{ slug_underscored }}
      WORDPRESS_DB_USER: u_{{ slug_underscored }}
      # WORDPRESS_DB_PASSWORD is injected from .env
    volumes:
      - {{ webroot }}:/var/www/html
    networks: [site, platform]
    deploy:
      resources:
        limits:
          cpus: "{{ resources.cpu }}"
          memory: {{ resources.memory }}

networks:
  proxy:
    external: true
  platform:
    external: true
  site:
    name: {{ slug }}_net