Generador de Caddyfile y Docker Compose

# Caddyfile — Nanton Systems Config Generator
miempresa.com {
    # Compresión automática y Headers de Seguridad de grado SecOps
    encode zstd gzip

    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "strict-origin-when-cross-origin"
        -Server
    }

    # Raíz de WordPress y soporte PHP-FPM
    root * /var/www/html
    php_fastcgi wordpress:9000
    file_server

    # Bloqueo de archivos sensibles y exploits comunes
    @forbidden {
        path /wp-config.php
        path /xmlrpc.php
        path /wp-content/uploads/*.php
        path */.*
    }
    respond @forbidden 403

    # Logs estructurados
    log {
        output file /var/log/caddy/access.log {
            roll_size 10mb
            roll_keep 5
        }
    }
}

# docker-compose.yml — Nanton Systems Stack
services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./site:/var/www/html
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - wordpress
    networks:
      - nanton_net

  wordpress:
    image: wordpress:php8.3-fpm-alpine
    restart: unless-stopped
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: wp_user
      WORDPRESS_DB_PASSWORD: ${DB_PASSWORD:-GenerarPasswordSeguro123!}
      WORDPRESS_DB_NAME: wp_production
    volumes:
      - ./site:/var/www/html
    depends_on:
      - db
    networks:
      - nanton_net

  db:
    image: mariadb:11.4
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${ROOT_DB_PASSWORD:-RootSuperPassword123!}
      MYSQL_DATABASE: wp_production
      MYSQL_USER: wp_user
      MYSQL_PASSWORD: ${DB_PASSWORD:-GenerarPasswordSeguro123!}
    volumes:
      - db_data:/var/lib/mysql
    networks:
      - nanton_net

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --save "" --appendonly no --maxmemory 256mb --maxmemory-policy allkeys-lru
    networks:
      - nanton_net

volumes:
  caddy_data:
  caddy_config:
  db_data:

networks:
  nanton_net:
    driver: bridge