services:
  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    hostname: nginx-proxy-manager
    domainname: nginx.gibbyb.com
    networks: ['nginx-bridge']
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      # ⚠️ ONLY 81 moves. 80 and 443 above MUST stay on 0.0.0.0 — they are the
      # public front door and firewalld already restricts them to Cloudflare ranges.
      # 81 is the admin UI and is reached over WireGuard (http://192.168.2.2:81).
      - '192.168.2.2:81:81' # Admin Web Port — WireGuard only
      #- '21:21' # FTP
      #- '22:22' # SSH
      #- '25565:25565' # Minecraft
    environment:
      - TZ=America/New_York
      - DB_POSTGRES_HOST
      - DB_POSTGRES_PORT
      - DB_POSTGRES_USER
      - DB_POSTGRES_PASSWORD
      - DB_POSTGRES_NAME
    labels:
      com.centurylinklabs.watchtower.enable: 'true'
    volumes:
      - ./volumes/data:/data:Z
      - ./volumes/letsencrypt:/etc/letsencrypt:Z
    #depends_on: [postgresql]

  #postgresql:
    #image: postgres:17
    #container_name: nginx-proxy-manager-db
    #hostname: nginx-proxy-manager-db
    #networks: ['nginx-bridge']
    #environment:
      #POSTGRES_USER: 'npm'
      #POSTGRES_PASSWORD: '<see this service .env on the machine>'
      #POSTGRES_DB: 'npm'
    #labels:
      #com.centurylinklabs.watchtower.enable: 'true'
    #volumes:
      #- ./volumes/postgres:/var/lib/postgresql/data
    #restart: unless-stopped

networks:
  # Created out-of-band so all nine stacks agree and there is no create race at boot:
  #   podman network create --subnet 172.18.0.0/24 nginx-bridge
  nginx-bridge:
    external: true