services:
  npm:
    # Built-in SQLite database — no DB_MYSQL_* / DB_SQLITE_* env vars needed.
    image: jc21/nginx-proxy-manager:latest
    container_name: npm
    restart: unless-stopped
    ports:
      - "80:80"   # HTTP, proxied traffic
      - "443:443" # HTTPS, proxied traffic
      - "81:81"   # Admin UI
    # `default` keeps the existing setup; `proxy` reaches containers that
    # publish no ports (Vaultwarden) by container name.
    networks:
      - default
      - proxy
    volumes:
      # Both contain the INWX DNS-challenge password in plain text — never commit.
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

networks:
  proxy:
    # Created once by hand: docker network create proxy
    external: true