# webfinger stack -- one Caddy container that serves /.well-known/webfinger
# at $BASE_DOMAIN (for OIDC discovery from Tailscale et al.) and redirects
# everything else to $REDIRECT_URL.
#
# Standalone: this binds 80/443 itself, so don't run it on the same host as
# another stack that also wants those ports unless you put a TCP balancer
# in front or merge the configs.

name: webfinger

volumes:
  caddy-data:
  caddy-config:

services:
  caddy:
    image: caddy:${CADDY_TAG:-2-alpine}
    container_name: caddy-webfinger
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"     # HTTP/3
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    environment:
      BASE_DOMAIN: "${BASE_DOMAIN}"
      ISSUER_URL: "${ISSUER_URL}"
      REDIRECT_URL: "${REDIRECT_URL}"
      ACME_EMAIL: "${ACME_EMAIL}"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:2019/config/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s