docker-compose.ssl.yml

# NightMend HTTPS overlay
# Usage: docker compose -f docker-compose.yml -f docker-compose.ssl.yml up -d
#
# For production with Let's Encrypt:
#   docker compose -f docker-compose.yml -f docker-compose.ssl.yml -f docker-compose.prod.yml up -d

services:
  nginx-ssl:
    build: ./nginx
    ports:
      - "${HTTPS_PORT:-443}:443"
      - "${HTTP_PORT:-80}:80"
    environment:
      - DOMAIN=${DOMAIN:-localhost}
    volumes:
      - ${SSL_CERT_DIR:-./nginx/certs}:/etc/nginx/ssl:ro
      - ${CERTBOT_WEBROOT:-./nginx/certbot}:/var/www/certbot:ro
    depends_on:
      - frontend
    restart: unless-stopped
    networks:
      - default

  # Certbot sidecar for Let's Encrypt auto-renewal
  # Only needed in production; remove or don't start in dev
  certbot:
    image: certbot/certbot
    volumes:
      - ${SSL_CERT_DIR:-./nginx/certs}:/etc/letsencrypt
      - ${CERTBOT_WEBROOT:-./nginx/certbot}:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
    profiles:
      - production