# Dedicated candidate HTTPS entry point. Render with the base, production, and
# candidate ingress overlays, then run the isolation preflight before startup.
# The key files must be copies confined to the candidate root, never an NPM bind.
services:
  tls:
    image: caddy:2.10-alpine@sha256:4c6e91c6ed0e2fa03efd5b44747b625fec79bc9cd06ac5235a779726618e530d
    command: ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
    environment:
      XDG_CONFIG_HOME: /config
      XDG_DATA_HOME: /data
    volumes:
      - ./deploy/validation/Caddyfile:/etc/caddy/Caddyfile:ro
      - ${MODELFORGE_CANDIDATE_TLS_DIR:?set a certificate copy directory inside the candidate root}/fullchain.pem:/run/tls/fullchain.pem:ro
      - ${MODELFORGE_CANDIDATE_TLS_DIR:?set a certificate copy directory inside the candidate root}/privkey.pem:/run/tls/privkey.pem:ro
    networks:
      - ingress
    ports:
      - "0.0.0.0:18444:8443"
    read_only: true
    tmpfs:
      - /config:size=4m,mode=0700
      - /data:size=4m,mode=0700
      - /tmp:size=4m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    depends_on:
      api:
        condition: service_healthy
      web:
        condition: service_started
    restart: unless-stopped