services:
  nginx:
    image: nginx:09051708
    container_name: nginx-proxy
    ports:
      - "8081:80"
      - "8443:8443"
    volumes:
      # 证书：宿主机 acme.sh 写入，nginx 只读
      - /etc/letsencrypt:/etc/letsencrypt:ro
      # ACME HTTP-01 挑战文件：宿主机 acme.sh 写入，nginx 只读
      - /var/www/certbot:/var/www/certbot:ro
      # HTTPS server 块：默认为空，证书就绪后由 enable-ssl.sh 写入
      - ./ssl.d:/etc/nginx/ssl.d:ro
    restart: unless-stopped
    networks:
      - trim-default

networks:
  trim-default:
    external: true