# VPS overlay: attaches the static web service to the shared Traefik network.
# Applied together with compose.yml on the production host:
#   docker compose -f compose.yml -f compose.vps.yml up -d
services:
  web:
    labels:
      traefik.enable: 'true'
      traefik.docker.network: web

      # HTTPS routers -------------------------------------------------------
      traefik.http.routers.desfoto.rule: Host(`desfoto.de`)
      traefik.http.routers.desfoto.entrypoints: https
      traefik.http.routers.desfoto.tls.certresolver: le
      traefik.http.routers.desfoto.priority: '200'
      traefik.http.routers.desfoto.service: desfoto

      traefik.http.routers.desfoto-www.rule: Host(`www.desfoto.de`)
      traefik.http.routers.desfoto-www.entrypoints: https
      traefik.http.routers.desfoto-www.tls.certresolver: le
      traefik.http.routers.desfoto-www.priority: '200'
      traefik.http.routers.desfoto-www.middlewares: desfoto-canonical
      traefik.http.routers.desfoto-www.service: desfoto

      # HTTP is already redirected to HTTPS by the global Traefik entrypoint
      # redirection (see /srv/stack/docker-compose.yml); the ACME http-challenge
      # is answered by Traefik itself before the redirect.
      traefik.http.middlewares.desfoto-canonical.redirectregex.regex: ^https?://(?:www\.)?desfoto\.de/(.*)
      traefik.http.middlewares.desfoto-canonical.redirectregex.replacement: https://desfoto.de/$${1}
      traefik.http.middlewares.desfoto-canonical.redirectregex.permanent: 'true'

      traefik.http.services.desfoto.loadbalancer.server.port: '80'
    networks:
      - default
      - web

networks:
  web:
    external: true