services:
  haproxy:
    build:
      # The repository root, not ./docker: the Dockerfile copies
      # ./docker/haproxy.cfg, which a context of ./docker cannot see.
      context: .
      dockerfile: ./docker/Dockerfile
    image: registry.bitdeals.org/haproxy
    # `bind ... ssl crt` is resolved while the configuration is parsed, so an
    # empty certificates volume is a fatal start-up error rather than a warning.
    # certbot writes a self-signed placeholder on its own first start; until it
    # has, HAProxy needs to keep retrying. Order it after certbot too — in a
    # project that defines one, add: depends_on: [nginx, certbot]
    restart: unless-stopped
    volumes:
      - certificates:/usr/local/etc/haproxy/certificates:ro
      # The runtime API socket. Share this volume with certbot and with nothing
      # else: reaching the socket is equivalent to holding the TLS private key.
      - haproxy_admin:/var/lib/haproxy
    ports:
      - "80:80"
      - "443:443"

volumes:
  certificates:
  haproxy_admin: