services:
  reverse-proxy:
    image: "jwilder/nginx-proxy:latest"
    container_name: "reverse-proxy"
    volumes:
      - app:/app
      - html:/usr/share/nginx/html
      - dhparam:/etc/nginx/dhparam
      - vhost:/etc/nginx/vhost.d
      - certs:/etc/nginx/certs
      - confd:/etc/nginx/conf.d
      - /run/docker.sock:/tmp/docker.sock:ro
      - /etc/localtime:/etc/localtime:ro
      # Логи в bind-mount для удобства
      - /mnt/nginx-proxy/logs:/var/log/nginx
    restart: "always"
    networks:
      - net  # Существующая сеть!
    # КРИТИЧЕСКИ: Ограничиваем порты только на нужные IP
    ports:
      - "80:80"      # Основной IP для других сервисов
      - "443:443"    # Основной IP для других сервисов
    labels:
      - "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy=true"
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '0.5'      # Максимум 0.5 ядра
          memory: 256M     # Макс 256MB RAM
        reservations:
          cpus: '0.1'      # Гарантированные 0.1 ядра
          memory: 128M     # Гарантированные 128MB

  letsencrypt:
    image: "jrcs/letsencrypt-nginx-proxy-companion:latest"
    container_name: "letsencrypt-helper"
    volumes:
      - apple:/app
      - html:/usr/share/nginx/html
      - dhparam:/etc/nginx/dhparam
      - vhost:/etc/nginx/vhost.d
      - certs:/etc/nginx/certs
      - /run/docker.sock:/var/run/docker.sock:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      NGINX_PROXY_CONTAINER: "reverse-proxy"
      DEFAULT_EMAIL: "<адрес электронной почты на которую зарегистрирован letsencrypt>"
      # Для тестирования (потом убрать):
      # - "ACME_CA_URI=https://acme-staging-v02.api.letsencrypt.org/directory"
    restart: "always"
    depends_on:
      - reverse-proxy
    networks:
      - net
    healthcheck:
      test: ["CMD", "pgrep", "letsencrypt_ser"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '0.2'
          memory: 128M
        reservations:
          cpus: '0.05'
          memory: 64M

volumes:
  app:
    driver: local
    driver_opts:
      type: none
      device: /mnt/nginx-proxy/app
      o: bind
  apple:
    driver: local
    driver_opts:
      type: none
      device: /mnt/nginx-proxy/apple
      o: bind
  certs:
    driver: local
    driver_opts:
      type: none
      device: /mnt/nginx-proxy/certs
      o: bind
  html:
    driver: local
    driver_opts:
      type: none
      device: /mnt/nginx-proxy/html
      o: bind
  vhost:
    driver: local
    driver_opts:
      type: none
      device: /mnt/nginx-proxy/vhost
      o: bind
  dhparam:
    driver: local
    driver_opts:
      type: none
      device: /mnt/nginx-proxy/dhparam
      o: bind
  confd:
    driver: local
    driver_opts:
      type: none
      device: /mnt/nginx-proxy/conf.d
      o: bind

networks:
  net:
    external: true
    name: net  # Явно указываем существующую сеть