services:
  cv-service:
    build: .
    env_file: .env
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    mem_limit: 2g
    cpus: 2
    security_opt:
      - no-new-privileges:true
    # Aucun port publié : seul Caddy (HTTPS) peut joindre le service.

  caddy:
    image: caddy:2
    restart: unless-stopped
    depends_on:
      - cv-service
    ports:
      - "80:80"
      - "443:443"
    environment:
      - CV_DOMAINE=${CV_DOMAINE}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config

volumes:
  caddy_data:
  caddy_config: