name: nginx
services:
  nginx:
    image: nginx:1.31.7-alpine
    container_name: nginx
    volumes:
      - /srv/data/nginx/templates:/etc/nginx/templates:ro
      - /srv/data/nginx/certs:/etc/nginx/certs:ro
    environment:
      BASE_DOMAIN: ${BASE_DOMAIN}
      EO_ORIGIN_TOKEN: ${EO_ORIGIN_TOKEN}
      NGINX_ENVSUBST_FILTER: '^(BASE_DOMAIN|EO_ORIGIN_TOKEN)$'
      NGINX_ENVSUBST_OUTPUT_DIR: /etc/nginx
    ports:
      - "192.168.10.101:80:80"
      - "192.168.10.101:443:443"
      - "[::]:18443:443"
    networks:
      proxy:
        ipv4_address: 172.30.0.2
        ipv6_address: fd71:2da4:cf55::2
      host-access:
        ipv4_address: 172.31.255.2
    extra_hosts:
      - "host.internal:172.31.255.1"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
        reservations:
          cpus: "0.05"
          memory: 16M
  acme-sh:
    image: neilpang/acme.sh:3.1.4
    container_name: acme.sh
    volumes:
      - /srv/data/nginx/acme-sh:/acme.sh
      - /srv/data/nginx/certs:/certs
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      CF_Token: ${CF_TOKEN}
      CF_Zone_ID: ${CF_ZONE_ID}
    command: daemon
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: "0.2"
          memory: 64M
        reservations:
          cpus: "0.05"
          memory: 16M
networks:
  proxy:
    name: proxy
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: br-proxy
    enable_ipv6: true
    ipam:
      config:
        - subnet: 172.30.0.0/24
          ip_range: 172.30.0.128/25
          gateway: 172.30.0.1
        - subnet: fd71:2da4:cf55::/64
          ip_range: fd71:2da4:cf55:0:8000::/65
          gateway: fd71:2da4:cf55::1
  host-access:
    name: host-access
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: br-host-access
    internal: true
    ipam:
      config:
        - subnet: 172.31.255.0/29
          gateway: 172.31.255.1