switched to fully self contained docker

compose.yaml

@@ -1,20 +1,19 @@
-services:
-  migrate:
-    build: .
-    image: tai/tapm-deployment-broker:local
-    entrypoint: ["/usr/local/bin/tapm-migrate"]
-    env_file: .env
-    network_mode: host
-    restart: "no"
+name: tapm
 
+services:
   broker:
     build: .
     image: tai/tapm-deployment-broker:local
-    env_file: .env
-    network_mode: host
+    env_file:
+      - path: .env
+        required: false
     restart: unless-stopped
     init: true
     read_only: true
+    networks:
+      - edge
+    volumes:
+      - ./config/broker:/data
     security_opt:
       - no-new-privileges:true
     cap_drop:
@@ -22,8 +21,37 @@ services:
     tmpfs:
       - /tmp:size=16m,mode=1777
     healthcheck:
-      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:8080/health/ready"]
+      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8080/health/ready"]
       interval: 30s
       timeout: 5s
       retries: 3
-      start_period: 10s
+      start_period: 15s
+
+  nginx:
+    image: nginx:1.28-alpine
+    restart: unless-stopped
+    networks:
+      - edge
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./deploy/nginx/templates/bootstrap.conf.template:/etc/nginx/templates/default.conf.template:ro
+      - ./config/letsencrypt:/etc/letsencrypt:ro
+      - ./config/certbot-webroot:/var/www/certbot:ro
+    environment:
+      BROKER_DOMAIN: ${BROKER_DOMAIN}
+      GITEA_DOMAIN: ${GITEA_DOMAIN}
+    security_opt:
+      - no-new-privileges:true
+
+  certbot:
+    image: certbot/certbot:v5.7.0
+    profiles: ["tools"]
+    volumes:
+      - ./config/letsencrypt:/etc/letsencrypt
+      - ./config/certbot-webroot:/var/www/certbot
+
+networks:
+  edge:
+    name: tapm-edge