# Rendered by the provisioning CLI (Phase 4). Static site: nginx only, no PHP,
# no DB. Web root served read-only.
name: {{ slug }}

services:
  nginx:
    image: {{ nginx_image }}
    container_name: {{ slug }}_nginx
    restart: unless-stopped
    volumes:
      - {{ webroot }}:/var/www/html:ro
      - ./nginx-site.conf:/etc/nginx/conf.d/default.conf:ro
    networks: [proxy]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.{{ slug }}.rule=Host(`{{ domains | join('`) || Host(`') }}`)"
      - "traefik.http.routers.{{ slug }}.entrypoints=websecure"
      - "traefik.http.routers.{{ slug }}.tls.certresolver=le"
      - "traefik.http.routers.{{ slug }}.middlewares=security-headers@file"
      - "traefik.http.services.{{ slug }}.loadbalancer.server.port=80"
    deploy:
      resources:
        limits:
          cpus: "{{ resources.cpu }}"
          memory: {{ resources.memory }}

networks:
  proxy:
    external: true