services:
  nginx:
    image: nginx:09051708
    container_name: nginx-proxy
    ports:
      - "8081:80"
      - "8443:8443"
    volumes:
      # 证书（只读）
      - certbot-certs:/etc/letsencrypt:ro
      # ACME 验证目录（只读）：certbot 写入挑战文件，nginx 直接对外提供
      - certbot-webroot:/var/www/certbot:ro
      # HTTPS server 块：默认为空，证书就绪后由 enable-ssl.sh 写入
      - ./ssl.d:/etc/nginx/ssl.d:ro
    restart: unless-stopped
    networks:
      - trim-default

volumes:
  # 与 certbot/docker-compose.yml 共用，物理卷名由 certbot 侧固定为同名
  certbot-certs:
    external: true
  certbot-webroot:
    external: true

networks:
  trim-default:
    external: true