feat: implement the caddy plugin

This plugin uses a docker-compose based Caddy installation in conjunction with injected container labels to route requests. It only exposes the minimal necessary for routing traffic to docker containers. Users wishing to customize further labels may explore using the docker-options plugin to attach additional labels during the 'deploy' phase.

plugins/caddy-vhosts/command-functions

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/internal-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+cmd-caddy-report() {
+  declare desc="displays a caddy report for one or more apps"
+  declare cmd="caddy:report"
+  [[ "$1" == "$cmd" ]] && shift 1
+  declare APP="$1" INFO_FLAG="$2"
+
+  if [[ -n "$APP" ]] && [[ "$APP" == --* ]]; then
+    INFO_FLAG="$APP"
+    APP=""
+  fi
+
+  if [[ -z "$APP" ]] && [[ -z "$INFO_FLAG" ]]; then
+    INFO_FLAG="true"
+  fi
+
+  if [[ -z "$APP" ]]; then
+    for app in $(dokku_apps); do
+      cmd-caddy-report-single "$app" "$INFO_FLAG" | tee || true
+    done
+  else
+    cmd-caddy-report-single "$APP" "$INFO_FLAG"
+  fi
+}
+
+cmd-caddy-report-single() {
+  declare APP="$1" INFO_FLAG="$2"
+  if [[ "$INFO_FLAG" == "true" ]]; then
+    INFO_FLAG=""
+  fi
+  verify_app_name "$APP"
+  local flag_map=(
+    "--caddy-image: $(fn-caddy-image)"
+    "--caddy-letsencrypt-email: $(fn-caddy-letsencrypt-email)"
+    "--caddy-letsencrypt-server: $(fn-caddy-letsencrypt-email)"
+    "--caddy-log-level: $(fn-caddy-log-level)"
+    "--caddy-polling-interval: $(fn-caddy-polling-interval)"
+    "--caddy-tls-internal: $(fn-caddy-tls-internal "$APP")"
+  )
+
+  if [[ -z "$INFO_FLAG" ]]; then
+    dokku_log_info2_quiet "${APP} caddy information"
+    for flag in "${flag_map[@]}"; do
+      key="$(echo "${flag#--}" | cut -f1 -d' ' | tr - ' ')"
+      dokku_log_verbose "$(printf "%-30s %-25s" "${key^}" "${flag#*: }")"
+    done
+  else
+    local match=false
+    local value_exists=false
+    for flag in "${flag_map[@]}"; do
+      valid_flags="${valid_flags} $(echo "$flag" | cut -d':' -f1)"
+      if [[ "$flag" == "${INFO_FLAG}:"* ]]; then
+        value=${flag#*: }
+        size="${#value}"
+        if [[ "$size" -ne 0 ]]; then
+          echo "$value" && match=true && value_exists=true
+        else
+          match=true
+        fi
+      fi
+    done
+    [[ "$match" == "true" ]] || dokku_log_fail "Invalid flag passed, valid flags:${valid_flags}"
+  fi
+}
+
+cmd-caddy-logs() {
+  declare desc="display caddy logs from command line"
+  declare cmd="caddy:logs"
+  [[ "$1" == "$cmd" ]] && shift 1
+  local NUM="100" TAIL=false
+
+  local TEMP=$(getopt -o htn: --long help,tail,num: -n 'dokku caddy:logs' -- "$@")
+  local EXIT_CODE="$?"
+  if [[ "$EXIT_CODE" != 0 ]]; then
+    fn-caddy-logs-usage >&2
+    exit 1
+  fi
+  eval set -- "$TEMP"
+
+  while true; do
+    case "$1" in
+      -t | --tail)
+        local TAIL=true
+        shift
+        ;;
+      -n | --num)
+        local NUM="$2"
+        shift 2
+        ;;
+      --)
+        shift
+        break
+        ;;
+      *) dokku_log_fail "Internal error" ;;
+    esac
+  done
+
+  fn-caddy-logs "$TAIL" "$NUM"
+}
+
+cmd-caddy-show-config() {
+  declare desc="display caddy config"
+  declare cmd="caddy:show-config"
+  [[ "$1" == "$cmd" ]] && shift 1
+
+  local TMP_COMPOSE_FILE=$(mktemp "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
+  trap "rm -rf '$TMP_COMPOSE_FILE' >/dev/null" RETURN INT TERM EXIT
+
+  fn-caddy-template-compose-file "$TMP_COMPOSE_FILE"
+  cat "$TMP_COMPOSE_FILE"
+}
+
+cmd-caddy-start() {
+  declare desc="Starts the caddy server"
+  declare cmd="caddy:start"
+  [[ "$1" == "$cmd" ]] && shift 1
+
+  local TMP_COMPOSE_FILE=$(mktemp "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
+  trap "rm -rf '$TMP_COMPOSE_FILE' >/dev/null" RETURN INT TERM EXIT
+
+  fn-caddy-template-compose-file "$TMP_COMPOSE_FILE"
+  "$DOCKER_BIN" compose -f "$TMP_COMPOSE_FILE" -p caddy up -d --quiet-pull
+}
+
+cmd-caddy-stop() {
+  declare desc="Starts the caddy server"
+  declare cmd="caddy:start"
+  [[ "$1" == "$cmd" ]] && shift 1
+
+  local TMP_COMPOSE_FILE=$(mktemp "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
+  trap "rm -rf '$TMP_COMPOSE_FILE' >/dev/null" RETURN INT TERM EXIT
+
+  fn-caddy-template-compose-file "$TMP_COMPOSE_FILE"
+  "$DOCKER_BIN" compose -f "$TMP_COMPOSE_FILE" -p caddy down --remove-orphans
+}

plugins/caddy-vhosts/commands

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+[[ " caddy:help help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/help-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+case "$1" in
+  help | caddy:help)
+    cmd-caddy-help "$@"
+    ;;
+
+  *)
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
+    ;;
+esac

plugins/caddy-vhosts/core-post-deploy

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/internal-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+trigger-caddy-vhosts-core-post-deploy() {
+  declare desc="caddy-vhosts core-post-deploy plugin trigger"
+  declare trigger="core-post-deploy"
+  declare APP="$1"
+  local tls_internal
+
+  if [[ "$(plugn trigger proxy-type "$APP")" != "caddy" ]]; then
+    return
+  fi
+
+  tls_internal="$(fn-caddy-tls-internal)"
+  dokku_log_info1 "Routing app via caddy"
+  if [[ "$tls_internal" == "true" ]]; then
+    dokku_log_warn "Warning: using caddy's internal, locally-trusted CA to produce certificates for this site"
+  fi
+}
+
+trigger-caddy-vhosts-core-post-deploy "$@"

plugins/caddy-vhosts/docker-args-process-deploy

@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/internal-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+trigger-caddy-vhosts-docker-args-process-deploy() {
+  declare desc="nginx-vhosts core-post-deploy plugin trigger"
+  declare trigger="docker-args-process-deploy"
+  declare APP="$1" IMAGE_SOURCE_TYPE="$2" IMAGE_TAG="$3" PROC_TYPE="$4" CONTAINER_INDEX="$5"
+  local app_domains caddy_domains is_app_listening letsencrypt_email output proxy_container_port proxy_host_port port_map proxy_port_map proxy_scheme proxy_schemes scheme tls_internal
+  local proxy_container_http_port proxy_container_http_port_candidate proxy_host_http_port_candidate
+  local proxy_container_https_port proxy_container_https_port_candidate proxy_host_https_port_candidate
+  local app_urls_path="$DOKKU_ROOT/$APP/URLS"
+  local STDIN=$(cat)
+
+  if [[ "$PROC_TYPE" != "web" ]]; then
+    return
+  fi
+
+  if [[ "$(plugn trigger proxy-type "$APP")" != "caddy" ]]; then
+    return
+  fi
+
+  if [[ "$(plugn trigger proxy-is-enabled "$APP")" != "true" ]]; then
+    return
+  fi
+
+  if ! plugn trigger domains-vhost-enabled "$APP" 2>/dev/null; then
+    return
+  fi
+
+  # run this silently or the output will be set as a label
+  plugn trigger domains-setup "$APP" >/dev/null
+
+  # ensure we have a port mapping
+  plugn trigger proxy-configure-ports "$APP"
+
+  # gather port mapping information
+  # we only support proxying a single port for http and https listeners
+  # so this block parses the port mappings and tries to find the correct
+  # mapping to expose
+  is_app_listening="false"
+  proxy_port_map="$(plugn trigger config-get "$APP" DOKKU_PROXY_PORT_MAP)"
+  for port_map in $proxy_port_map; do
+    proxy_scheme="$(awk -F ':' '{ print $1 }' <<<"$port_map")"
+    proxy_host_port="$(awk -F ':' '{ print $2 }' <<<"$port_map")"
+    proxy_container_port="$(awk -F ':' '{ print $3 }' <<<"$port_map")"
+
+    if [[ "$proxy_scheme" == "http" ]]; then
+      is_app_listening="true"
+      if [[ -z "$proxy_container_http_port_candidate" ]]; then
+        proxy_container_http_port_candidate="$proxy_container_port"
+        proxy_host_http_port_candidate="$proxy_host_port"
+      fi
+
+      if [[ "$proxy_host_port" == "80" ]] && [[ -z "$proxy_container_http_port" ]]; then
+        proxy_container_http_port="$proxy_container_port"
+      fi
+    fi
+
+    if [[ "$proxy_scheme" == "https" ]]; then
+      is_app_listening="true"
+      if [[ -z "$proxy_container_https_port_candidate" ]]; then
+        proxy_container_https_port_candidate="$proxy_container_port"
+        proxy_host_https_port_candidate="$proxy_host_port"
+      fi
+
+      if [[ "$proxy_host_port" == "443" ]] && [[ -z "$proxy_container_https_port" ]]; then
+        proxy_container_https_port="$proxy_container_port"
+      fi
+    fi
+  done
+
+  app_domains="$(plugn trigger domains-list "$APP")"
+  if [[ -n "$app_domains" ]]; then
+    caddy_domains="$(echo "$app_domains" | xargs)"
+  fi
+
+  # add the labels for caddy here
+  # prefer the https:443 mapping to http:80 mapping
+  if [[ -n "$is_app_listening" ]] && [[ -n "$caddy_domains" ]]; then
+    has_443_mapping=false
+    tls_internal="$(fn-caddy-tls-internal)"
+    if [[ -n "$proxy_container_https_port" ]] || [[ -n "$proxy_container_https_port_candidate" ]]; then
+      has_443_mapping=true
+    fi
+
+    ssl_warning_mapping="https:443"
+    if [[ "$tls_internal" == "true" ]]; then
+      output="--label caddy.tls=internal"
+      if [[ "$has_443_mapping" == "false" ]]; then
+        ssl_warning_mapping="http:80"
+        proxy_host_https_port_candidate="$proxy_host_http_port_candidate"
+        proxy_container_https_port_candidate="$proxy_container_http_port_candidate"
+        proxy_container_https_port="$proxy_container_http_port"
+      fi
+    fi
+
+    letsencrypt_email="$(fn-caddy-letsencrypt-email)"
+    scheme="http"
+    if [[ -n "$letsencrypt_email" ]] && [[ "$has_443_mapping" == "true" ]]; then
+      output="--label caddy=${caddy_domains}"
+      scheme="https"
+      if [[ -z "$proxy_container_https_port" ]]; then
+        warning_scheme="$(awk -F ':' '{ print $1 }' <<<"$ssl_warning_mapping")"
+        dokku_log_warn "Warning: $ssl_warning_mapping port mapping not found"
+        dokku_log_warn "Utilizing first warning_scheme port mapping, http:$proxy_host_https_port_candidate:$proxy_container_https_port_candidate"
+        proxy_container_https_port="$proxy_container_https_port_candidate"
+      fi
+
+      output="$output --label \"caddy.reverse_proxy={{ upstreams $proxy_container_https_port }}\""
+    elif [[ -n "$proxy_container_http_port" ]] || [[ -n "$proxy_container_http_port_candidate" ]]; then
+      caddy_domains="${caddy_domains// /:80 }"
+      output="--label caddy=${caddy_domains}:80"
+      if [[ -z "$proxy_container_http_port" ]]; then
+        dokku_log_warn "Warning: http:80 port mapping not found"
+        dokku_log_warn "Utilizing first http port mapping, http:$proxy_host_http_port_candidate:$proxy_container_http_port_candidate"
+        proxy_container_http_port="$proxy_container_http_port_candidate"
+      fi
+
+      output="$output --label \"caddy.reverse_proxy={{ upstreams $proxy_container_http_port }}\""
+    fi
+
+    echo "# THIS FILE IS GENERATED BY DOKKU - DO NOT EDIT, YOUR CHANGES WILL BE OVERWRITTEN" >"$app_urls_path"
+    xargs -I{} echo "$scheme://{}" <<<"$(echo "${app_domains}" | tr ' ' '\n' | sort -u)" >>"$app_urls_path"
+  fi
+
+  echo -n "$STDIN$output"
+}
+
+trigger-caddy-vhosts-docker-args-process-deploy "$@"

plugins/caddy-vhosts/help-functions

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+cmd-caddy-help() {
+  declare desc="help command"
+  declare CMD="$1"
+  local plugin_name="caddy"
+  local plugin_description="Manage mounted volumes"
+
+  if [[ "$CMD" == "${plugin_name}:help" ]]; then
+    echo -e "Usage: dokku ${plugin_name}[:COMMAND]"
+    echo ''
+    echo "$plugin_description"
+    echo ''
+    echo 'Additional commands:'
+    fn-help-content | sort | column -c2 -t -s,
+  elif [[ $(ps -o command= $PPID) == *"--all"* ]]; then
+    fn-help-content
+  else
+    cat <<help_desc
+    $plugin_name, $plugin_description
+help_desc
+  fi
+}
+
+fn-help-content() {
+  declare desc="return help content"
+  cat <<help_content
+    caddy:report [<app>] [<flag>], Displays an caddy report for one or more apps
+    caddy:set <app> <property> (<value>), Set or clear an caddy property for an app
+    caddy:show-config <app>, Display caddy compose config
+    caddy:start, Starts the caddy server
+    caddy:stop, Stops the caddy server
+help_content
+}

plugins/caddy-vhosts/install

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+trigger-caddy-install() {
+  declare desc="installs the caddy plugin"
+  declare trigger="install"
+
+  mkdir -p "${DOKKU_LIB_ROOT}/data/caddy"
+  chown -R "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "${DOKKU_LIB_ROOT}/data/caddy"
+
+  fn-plugin-property-setup "caddy"
+}
+
+trigger-caddy-install "$@"

plugins/caddy-vhosts/internal-functions

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+fn-caddy-logs() {
+  declare desc="shows the logs for the caddy container"
+  declare TAIL="$1" NUM="$2"
+  local dokku_logs_args=("--tail" "$NUM")
+
+  if [[ "$TAIL" == "true" ]]; then
+    dokku_logs_args+=("--follow")
+  fi
+
+  "$DOCKER_BIN" logs caddy-caddy-1 "${dokku_logs_args[@]}"
+}
+
+fn-caddy-logs-usage() {
+  declare desc="logs specific usage"
+  echo "Usage: dokku caddy:logs"
+  echo " display recent caddy log output"
+  echo ""
+  echo " -n, --num NUM        # the number of lines to display"
+  echo " -t, --tail           # continually stream logs"
+}
+
+fn-caddy-template-compose-file() {
+  declare desc="templates out the compose file"
+  declare OUTPUT_PATH="$1"
+  local COMPOSE_TEMPLATE="$PLUGIN_AVAILABLE_PATH/caddy-vhosts/templates/compose.yml.sigil"
+
+  CUSTOM_COMPOSE_TEMPLATE="$(plugn trigger caddy-template-source "$APP")"
+  if [[ -n "$CUSTOM_COMPOSE_TEMPLATE" ]]; then
+    COMPOSE_TEMPLATE="$CUSTOM_COMPOSE_TEMPLATE"
+  fi
+
+  local SIGIL_PARAMS=(CADDY_DATA_DIR="${DOKKU_LIB_ROOT}/data/caddy"
+    CADDY_IMAGE="$(fn-caddy-image)"
+    CADDY_LETSENCRYPT_EMAIL="$(fn-caddy-letsencrypt-email)"
+    CADDY_LETSENCRYPT_SERVER="$(fn-caddy-letsencrypt-server)"
+    CADDY_LOG_LEVEL="$(fn-caddy-log-level)"
+    CADDY_POLLING_INTERVAL="$(fn-caddy-polling-interval)")
+
+  sigil -f "$COMPOSE_TEMPLATE" "${SIGIL_PARAMS[@]}" | cat -s >"$OUTPUT_PATH"
+}
+
+fn-caddy-image() {
+  fn-plugin-property-get-default "caddy" "--global" "image" "lucaslorentz/caddy-docker-proxy:2.7"
+}
+
+fn-caddy-letsencrypt-email() {
+  fn-plugin-property-get-default "caddy" "--global" "letsencrypt-email" ""
+}
+
+fn-caddy-letsencrypt-server() {
+  fn-plugin-property-get-default "caddy" "--global" "letsencrypt-server" "https://acme-v02.api.letsencrypt.org/directory"
+}
+
+fn-caddy-log-level() {
+  local log_level
+  log_level="$(fn-plugin-property-get-default "caddy" "--global" "log-level" "ERROR")"
+  echo "${log_level^^}"
+}
+
+fn-caddy-polling-interval() {
+  fn-plugin-property-get-default "caddy" "--global" "polling-interval" "5s"
+}
+
+fn-caddy-tls-internal() {
+  declare APP="$1"
+  fn-plugin-property-get-default "caddy" "$APP" "tls-internal" "false"
+}

plugins/caddy-vhosts/plugin.toml

@@ -0,0 +1,4 @@
+[plugin]
+description = "dokku core caddy-vhosts plugin"
+version = "0.27.10"
+[plugin.config]

plugins/caddy-vhosts/subcommands/default

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/help-functions"
+
+cmd-caddy-help "caddy:help"

plugins/caddy-vhosts/subcommands/logs

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/command-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+cmd-caddy-logs "$@"

plugins/caddy-vhosts/subcommands/report

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/command-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+cmd-caddy-report "$@"

plugins/caddy-vhosts/subcommands/set

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+cmd-caddy-set() {
+  declare desc="set or clear an caddy property for an app"
+  declare cmd="caddy:set"
+  [[ "$1" == "$cmd" ]] && shift 1
+  declare APP="$1" KEY="$2" VALUE="$3"
+  local VALID_KEYS=("image" "letsencrypt-email" "letsencrypt-server" "log-level" "polling-interval" "tls-internal")
+  local GLOBAL_KEYS=("image" "letsencrypt-email" "letsencrypt-server" "log-level" "polling-interval")
+
+  [[ -z "$KEY" ]] && dokku_log_fail "No key specified"
+
+  if ! fn-in-array "$KEY" "${VALID_KEYS[@]}"; then
+    dokku_log_fail "Invalid key specified, valid keys include: image letsencrypt-email letsencrypt-server log-level polling-interval tls-internal"
+  fi
+
+  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}"; then
+    if [[ "$APP" == "--global" ]]; then
+      dokku_log_fail "The key '$KEY' cannot be set globally"
+    fi
+    verify_app_name "$APP"
+  fi
+
+  if [[ -n "$VALUE" ]]; then
+    dokku_log_info2_quiet "Setting ${KEY} to ${VALUE}"
+    fn-plugin-property-write "caddy" "$APP" "$KEY" "$VALUE"
+  else
+    dokku_log_info2_quiet "Unsetting ${KEY}"
+    fn-plugin-property-delete "caddy" "$APP" "$KEY"
+  fi
+}
+
+cmd-caddy-set "$@"

plugins/caddy-vhosts/subcommands/show-config

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/command-functions"
+
+cmd-caddy-show-config "$@"

plugins/caddy-vhosts/subcommands/start

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/command-functions"
+
+cmd-caddy-start "$@"

plugins/caddy-vhosts/subcommands/stop

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_AVAILABLE_PATH/caddy-vhosts/command-functions"
+
+cmd-caddy-stop "$@"

plugins/caddy-vhosts/templates/compose.yml.sigil

@@ -0,0 +1,34 @@
+---
+version: "3.7"
+
+services:
+  caddy:
+    image: "{{ $.CADDY_IMAGE }}"
+
+    environment:
+      - CADDY_INGRESS_NETWORKS=bridge
+      - CADDY_DOCKER_POLLING_INTERVAL={{ $.CADDY_POLLING_INTERVAL }}
+
+    labels: # Global options
+      - caddy.log.format=json
+      - caddy.log.level={{ $.CADDY_LOG_LEVEL }}
+      {{ if $.CADDY_LETSENCRYPT_EMAIL }}
+      - "caddy.email={{ $.CADDY_LETSENCRYPT_EMAIL }}"
+      - "caddy.acme_ca={{ $.CADDY_LETSENCRYPT_SERVER }}"
+      {{ else }}
+      - "caddy.auto_https=off"
+      {{ end }}
+
+    network_mode: bridge
+
+    ports:
+      - "80:80"
+      {{ if $.CADDY_LETSENCRYPT_EMAIL }}
+      - "443:443"
+      {{ end }}
+
+    restart: unless-stopped
+
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "{{ $.CADDY_DATA_DIR }}:/data"