services:
  docs:
    labels:
      caddy.reverse_proxy: "{{upstreams 8080}}"
      caddy.header.Cache-Control: "public, max-age=31536000, immutable"
      caddy.header.X-Content-Type-Options: nosniff
      caddy.header.X-Frame-Options: DENY
      caddy.header.Referrer-Policy: strict-origin-when-cross-origin
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,size=50m
      - /config/caddy:size=10m
      - /data/caddy:size=10m