# Checked-in compose stack for the host.
# It pins the image by digest, stores data under `/opt/knot`, and lets Caddy
# handle HTTPS while knot SSH stays on host port 22.

services:
  knot:
    image: ${KNOT_IMAGE_REF}
    env_file:
      - ${KNOT_RUNTIME_ENV_FILE}
    restart: always
    ports:
      - "22:22"
    volumes:
      - /opt/knot/keys:/etc/ssh/keys
      - /opt/knot/repositories:/home/git/repositories
      - /opt/knot/server:/data
    healthcheck:
      test:
        - CMD-SHELL
        - curl -fsS http://127.0.0.1:5555 >/dev/null
      interval: 60s
      timeout: 30s
      start_period: 5s
      retries: 3

  caddy:
    image: caddy:alpine
    command: >
      caddy reverse-proxy
      --from ${PUBLIC_HOSTNAME}
      --to knot:5555
    depends_on:
      - knot
    restart: always
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - /opt/knot/caddy_data:/data