# HTTPS overlay. Use together with the base compose file:
#   docker compose -f docker-compose.yml -f docker-compose.tls.yml up -d --build
#
# Requires a TLS certificate under ./certs/{fullchain.pem,privkey.pem}.
# For a quick internal/test cert (self-signed):
#   openssl req -x509 -newkey rsa:2048 -nodes -days 825 \
#     -keyout certs/privkey.pem -out certs/fullchain.pem -subj "/CN=<your-host>"
# For production, drop in the cert issued for your internal domain (corporate CA / public CA).
services:
  web:
    ports:
      - "${WEB_TLS_PORT:-443}:443"   # base file already maps WEB_PORT:80 (used for the redirect)
    volumes:
      - ./certs:/etc/nginx/certs:ro
      - ../frontend/nginx-tls.conf:/etc/nginx/conf.d/default.conf:ro

  app:
    environment:
      # The public link in the pass email/SMS + the secure-cookie switch.
      ACS_PUBLIC_BASE_URL: ${ACS_PUBLIC_BASE_URL:-https://localhost}
      ACS_COOKIE_SECURE: "true"