# VPS overlay: attaches the static web service to the shared Traefik network.
# Applied together with compose.yml on the production host:
#   docker compose -f compose.yml -f compose.vps.yml up -d
services:
  web:
    labels:
      traefik.enable: 'true'
      traefik.docker.network: web

      # HTTPS routers -------------------------------------------------------
      traefik.http.routers.desfoto.rule: Host(`desfoto.de`)
      traefik.http.routers.desfoto.entrypoints: https
      traefik.http.routers.desfoto.tls.certresolver: le
      traefik.http.routers.desfoto.priority: '200'
      traefik.http.routers.desfoto.service: desfoto

      traefik.http.routers.desfoto-www.rule: Host(`www.desfoto.de`)
      traefik.http.routers.desfoto-www.entrypoints: https
      traefik.http.routers.desfoto-www.tls.certresolver: le
      traefik.http.routers.desfoto-www.priority: '200'
      traefik.http.routers.desfoto-www.middlewares: desfoto-canonical
      traefik.http.routers.desfoto-www.service: desfoto

      # HTTP -> HTTPS. The shared Traefik instance is running WITHOUT the
      # global entrypoint redirection that /srv/stack/docker-compose.yml
      # declares (live-config drift, documented in docs/deployment.md), so
      # desfoto.de carries its own http router instead of relying on the
      # proxy's global configuration. If that global redirect is ever enabled,
      # this router simply becomes unreachable. The ACME http-challenge is
      # answered by Traefik's internal acme-http router (maximum priority)
      # before this redirect can apply.
      traefik.http.routers.desfoto-http.rule: Host(`desfoto.de`) || Host(`www.desfoto.de`)
      traefik.http.routers.desfoto-http.entrypoints: http
      traefik.http.routers.desfoto-http.middlewares: desfoto-http-to-https
      traefik.http.routers.desfoto-http.service: noop@internal
      traefik.http.middlewares.desfoto-http-to-https.redirectscheme.scheme: https
      traefik.http.middlewares.desfoto-http-to-https.redirectscheme.permanent: 'true'
      traefik.http.middlewares.desfoto-canonical.redirectregex.regex: ^https?://(?:www\.)?desfoto\.de/(.*)
      traefik.http.middlewares.desfoto-canonical.redirectregex.replacement: https://desfoto.de/$${1}
      traefik.http.middlewares.desfoto-canonical.redirectregex.permanent: 'true'

      traefik.http.services.desfoto.loadbalancer.server.port: '80'
    networks:
      - default
      - web

networks:
  web:
    external: true