services:
  web:
    image: nginx:alpine
    container_name: phasefinal-web
    restart: unless-stopped
    volumes:
      - /opt/docker/conf/phasefinal-web/site:/usr/share/nginx/html:ro
      - /opt/docker/conf/phasefinal-web/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    networks:
      - tnet
    healthcheck:
      # 127.0.0.1, NOT localhost: in this image `localhost` resolves to ::1 and
      # nginx listens on IPv4 only, so `localhost` gives "Connection refused"
      # forever. Traefik SKIPS unhealthy containers, so a wrong healthcheck here
      # silently means "no route" rather than "unhealthy service".
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    labels:
      - traefik.enable=true
      - traefik.http.routers.phasefinal-web.rule=Host(`www.phasefinal.com`)
      - traefik.http.routers.phasefinal-web.tls=true
      - traefik.http.routers.phasefinal-web.tls.certresolver=anaprod
      - traefik.http.services.phasefinal-web.loadbalancer.server.port=80
      # apex -> www, 301
      - traefik.http.routers.phasefinal-apex.rule=Host(`phasefinal.com`)
      - traefik.http.routers.phasefinal-apex.tls=true
      - traefik.http.routers.phasefinal-apex.tls.certresolver=anaprod
      - traefik.http.routers.phasefinal-apex.service=phasefinal-web
      - traefik.http.routers.phasefinal-apex.middlewares=phasefinal-to-www
      - traefik.http.middlewares.phasefinal-to-www.redirectregex.regex=^https?://phasefinal\.com/(.*)
      - traefik.http.middlewares.phasefinal-to-www.redirectregex.replacement=https://www.phasefinal.com/$${1}
      - traefik.http.middlewares.phasefinal-to-www.redirectregex.permanent=true

networks:
  tnet:
    name: traefik-net
    external: true