docker-compose.yml

networks:
  clearnet-tier:
    driver: bridge

services:
  red_engine:
    image: red-engine-image
    container_name: red_engine_node
    restart: unless-stopped
    userns_mode: keep-id
    networks:
      - clearnet-tier
    ports:
      - "127.0.0.1:8080:8080"
    # .env is automatically loaded by compose; variables listed here are passed
    # through to the container so the node works even without config.json.
    environment:
      - RED_ADMIN_TOKEN=${RED_ADMIN_TOKEN:-}
      - RED_WEBHOOK_SECRET=${RED_WEBHOOK_SECRET:-}
      - RED_ADDR=${RED_ADDR:-:8080}
      - RED_DATA_DIR=${RED_DATA_DIR:-data}
      - RED_SITE_NAME=${RED_SITE_NAME:-}
      - RED_NODE_NAME=${RED_NODE_NAME:-}
    volumes:
      - ./data:/app/data:rw
      - ./config.json:/app/config.json:rw
    user: "${UID:-1000}:1000"

  caddy_proxy:
    image: docker.io/library/caddy:latest
    container_name: caddy_proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    networks:
      - clearnet-tier
    volumes:
      - ./caddy_routing:/etc/caddy
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - red_engine
    command: >
      /bin/sh -c '
      if [ ! -f /etc/caddy/Caddyfile ]; then
        echo "Generating default Caddyfile..."
        echo ":80 {" > /etc/caddy/Caddyfile
        echo "    header X-Content-Type-Options nosniff" >> /etc/caddy/Caddyfile
        echo "    header X-Frame-Options DENY" >> /etc/caddy/Caddyfile
        echo "    header X-XSS-Protection \"1; mode=block\"" >> /etc/caddy/Caddyfile
        echo "    reverse_proxy red_engine:8080" >> /etc/caddy/Caddyfile
        echo "}" >> /etc/caddy/Caddyfile
      fi;
      caddy run --config /etc/caddy/Caddyfile --adapter caddyfile'

volumes:
  caddy_data:
  caddy_config: