# Rendered by the provisioning CLI (Phase 4) into deployments/<customer>/<site>/.
# Render context is documented in site-templates/README.md.
name: {{ slug }}

services:
  nginx:
    image: {{ nginx_image }}
    container_name: {{ slug }}_nginx
    restart: unless-stopped
    depends_on: [fpm]
    volumes:
      - {{ webroot }}:/var/www/html:ro
      - ./nginx-site.conf:/etc/nginx/conf.d/default.conf:ro
    networks: [proxy, site]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.{{ slug }}.rule=Host(`{{ domains | join('`) || Host(`') }}`)"
      - "traefik.http.routers.{{ slug }}.entrypoints=websecure"
      - "traefik.http.routers.{{ slug }}.tls.certresolver=le"
      - "traefik.http.routers.{{ slug }}.middlewares=security-headers@file"
      - "traefik.http.services.{{ slug }}.loadbalancer.server.port=80"
    deploy:
      resources:
        limits:
          cpus: "{{ resources.cpu }}"
          memory: {{ resources.memory }}

  fpm:
    image: {{ php_image }}
    container_name: {{ slug }}_fpm
    restart: unless-stopped
    volumes:
      - {{ webroot }}:/var/www/html
{% if database %}
    env_file: [.env]
    environment:
      DB_HOST: mariadb
      DB_NAME: db_{{ slug_underscored }}
      DB_USER: u_{{ slug_underscored }}
      # DB_PASSWORD is injected from .env
    networks: [site, platform]
{% else %}
    networks: [site]
{% endif %}
    deploy:
      resources:
        limits:
          cpus: "{{ resources.cpu }}"
          memory: {{ resources.memory }}

networks:
  proxy:
    external: true
{% if database %}
  platform:
    external: true
{% endif %}
  site:
    name: {{ slug }}_net