services:
  #Let's Encrypt requires domain's public A/AAAA DNS records pointed at your machine.
  certbot:
    build:
      # The repository root, not ./docker: the Dockerfile copies
      # ./docker/scripts/, which a context of ./docker cannot see.
      context: .
      dockerfile: ./docker/Dockerfile
    image: registry.bitdeals.org/certbot
    restart: unless-stopped
    environment:
      - CERTBOT_DOMAIN=
      - CERTBOT_EMAIL= # optional for notifications
    volumes:
      - certificates:/etc/certificates
      - letsencrypt:/etc/letsencrypt
      # The base image declares /var/lib/letsencrypt as a VOLUME as well. Left
      # unmounted it gets a fresh anonymous volume on every container creation,
      # so a redeploy leaves an orphan behind each time. Naming it keeps the
      # work directory in one place across recreations.
      - letsencrypt_work:/var/lib/letsencrypt
      # HAProxy's runtime API socket, through which the renewed certificate is
      # installed. Shared with haproxy and with nothing else: reaching that
      # socket is equivalent to holding the TLS private key.
      - haproxy_admin:/var/lib/haproxy

volumes:
  certificates:
  letsencrypt:
  letsencrypt_work:
  haproxy_admin: