# An instance published through another server's HAProxy (ADR 0039, D3, D10 to D12):
# halkyon.li at home, which ramiel reaches through WireGuard (host/, forward/). Caddy
# then publishes 443 on the tunnel's address alone, so nothing of the instance answers
# on the home network, and takes the visitor's address from HAProxy's PROXY header
# (forwarded.caddy). No 80 (ramiel's Caddy sends plain HTTP on to HTTPS) and no HTTP/3
# (HAProxy routes TCP alone). Switched on in .env, after the instance's own file:
#
#   COMPOSE_FILE=compose.learn.yaml:compose.forwarded.yaml:…
#
# The tunnel is the host's (wg-quick@wg-halkyon), started before Docker: host/README.md.

services:
  caddy:
    # In place of compose.learn.yaml's 80, 443 and 443/udp, never beside them.
    ports: !override
      - "10.61.97.2:443:443"
    volumes:
      - ./forwarded.caddy:/etc/caddy/global/forwarded.caddy:ro