# jpaul.io hub page — a single container behind Traefik. The site is baked into
# the image by CI (see .gitea/workflows/build.yml + Dockerfile); Watchtower
# recreates the container when a new image is published, so what's running
# always matches what CI built.
#
#   First run:  docker compose up -d
#   Updates:    automatic — push to main -> CI builds -> Watchtower redeploys.
services:
  jpaulio:
    image: git.jpaul.io/justin/jpaulio:latest
    container_name: jpaulio
    restart: always
    pull_policy: always
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jpaulio.rule=Host(`jpaul.io`) || Host(`www.jpaul.io`)"
      - "traefik.http.routers.jpaulio.entrypoints=websecure"
      - "traefik.http.routers.jpaulio.tls.certresolver=myresolver"
      # A compound (||) rule doesn't auto-populate the ACME domain list, so name
      # the cert domains explicitly: one cert for the apex + www SAN.
      - "traefik.http.routers.jpaulio.tls.domains[0].main=jpaul.io"
      - "traefik.http.routers.jpaulio.tls.domains[0].sans=www.jpaul.io"
      - "traefik.http.services.jpaulio.loadbalancer.server.port=80"
      # Watchtower auto-updates this container when a new image is published.
      - "com.centurylinklabs.watchtower.enable=true"

networks:
  web:
    external: true