version: '3.8'

services:
  # Nginx 보안 프록시 + SSL (기존 젤리핀 앱용)
  nginx-security:
    image: nginx:alpine
    container_name: home-service-proxy-ssl
    restart: unless-stopped
    ports:
      - "8097:80" # HTTP (Let's Encrypt 인증용)
      - "8443:443" # HTTPS (최종 접속용)
    volumes:
      - ./nginx-ssl.conf:/etc/nginx/nginx.conf:ro
      - ./security.conf:/etc/nginx/conf.d/security.conf:ro
      - ./fail2ban-log:/var/log/nginx
      - ./ssl-certs:/etc/nginx/ssl:ro
      - ./certbot-webroot:/var/www/certbot:ro
    networks:
      - home-service-proxy-net

  # Certbot (Let's Encrypt)
  certbot:
    image: certbot/certbot
    container_name: home-service-certbot
    volumes:
      - ./ssl-certs:/etc/letsencrypt
      - ./certbot-webroot:/var/www/certbot
    command: certonly --webroot --webroot-path=/var/www/certbot --email ahn@hyungi.net --agree-tos --no-eff-email --expand -d jellyfin.hyungi.net -d komga.hyungi.net -d webdav.hyungi.net
    profiles:
      - ssl-setup

  # Fail2Ban 보안 모니터링
  fail2ban:
    image: crazymax/fail2ban:latest
    container_name: home-service-fail2ban-ssl
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - ./fail2ban-data:/data
      - ./fail2ban-log:/var/log/nginx:ro
      - ./fail2ban.conf:/etc/fail2ban/jail.local:ro
    environment:
      - TZ=Asia/Seoul
      - F2B_LOG_LEVEL=INFO
    networks:
      - home-service-proxy-net

networks:
  home-service-proxy-net:
    driver: bridge